4 ms·

For those of us who know less about these things, how does this compare to something like OPNsense/pfSense in a homelab setting? When would one use OPNsense/pfS

by gizdan 5y ago

For those of us who know less about these things, how does this compare to something like OPNsense/pfSense in a homelab setting? When would one use OPNsense/pfSense over OpenWrt/Tomato?

bipson 5y ago
For starters, I don't think you will get OPNsense, pfSense or the likes running on OTS router hardware. So, if this is what you intend, there is not much choice. Then it depends on your requirements. If your homelab lands in the area of 95% of the typical use cases, you will be very fine with OpenWrt or Tomato, or actually even most original firmware. Unless you bought something that is ridden with bugs and will not get updates, there are most certainly no noticeable benefits of running an alternative firmware. (Things like bufferbloat come to mind, I prefer control over my buffers, but good routers firmwares also do this quite reasonably). Another difference: getting OPNsense/pfSense running (and well maintained) will require considerably more time and effort, than OpenWrt or Tomato. Actually, for most soho/home users I would recommend a FritzBox. They are really packed with features, are well updated, zero hassle. Unless you really, really need something more exotic, they will save you lots of time and money. Also: automatic updates (configurable). There is also MikroTik. Slightly more expensive than FritzBox, also packed, but slightly different audience (larger networks, less "user-friendly"...). Disclaimer: I have a FritzBox running PPPoE passthrough to an OpenWRT router running on a NanoPi 2RS dialing in over PPPoE, with a MikroTik CRS112 behind that running only as a switch. I have my reasons for that setup, but the time and money I wasted on that setup is really difficult to justify to an outsider (and sometimes to myself). The FritzBox worked really, really well.
- azalemeth 5y ago
  I mostly agree with this comment except for: > there are most certainly no noticeable benefits of running an alternative firmware For me, those are wireguard, pihole, and the unquantifiable benefit of freedom and choice. Oh, and vim at the cli, and usually a more complete environment than an outdated busybox shell.
  - ClumsyPilot 5y ago
    I have a small x86 home server running wireguard and Pi, but i prefer to keep the router 'stock' unless there are issues
  - bipson 5y ago
    Oh, you got me wrong there. I do the same. Wireguard's the reason why I run OpenWRT. (Although I'm hesitant to put a pihole up there too, it would not be the 'official' pihole or maybe in a container, both don't seem optimal). But what I meant is: From a practical standpoint, on a daily basis, besides your subjective feeling, nobody else notices a difference if your router has Vim or not - as long as it works. And any decent router nowadays usually works. And I think one should realize that this is tinkering for the tinkering's own sake. There are no objective benefits[*] if you ask an outsider, e.g. your partner. And now I have to manually keep my router up to date, against all possible bugs in numerous open source packages. In 2021 at least security updates should be automatic for OSS- period. [*] (Repeating:) UNLESS you have some specific requirements, e.g. VPN, multiple uplinks, specific software due to specific use cases, etc. In these cases OpenWRT/Tomato etc. are an somewhat easier and cheaper way to get your own stack running, compared to setting up a full-fledged OTS x86 box with Linux or BSD, even pfSense is more work and more expensive I would argue, where the benefits over OpenWRT are even less tangible.
slezyr 5y ago
Any time you can actually use it on your hardware. OpenWRT/Tomato can work on devices with 4MB RAM, 32MB ROM.

by gizdan 5y ago

For those of us who know less about these things, how does this compare to something like OPNsense/pfSense in a homelab setting? When would one use OPNsense/pfSense over OpenWrt/Tomato?

bipson 5y ago

For starters, I don't think you will get OPNsense, pfSense or the likes running on OTS router hardware. So, if this is what you intend, there is not much choice. Then it depends on your requirements. If your homelab lands in the area of 95% of the typical use cases, you will be very fine with OpenWrt or Tomato, or actually even most original firmware. Unless you bought something that is ridden with bugs and will not get updates, there are most certainly no noticeable benefits of running an alternative firmware. (Things like bufferbloat come to mind, I prefer control over my buffers, but good routers firmwares also do this quite reasonably). Another difference: getting OPNsense/pfSense running (and well maintained) will require considerably more time and effort, than OpenWrt or Tomato. Actually, for most soho/home users I would recommend a FritzBox. They are really packed with features, are well updated, zero hassle. Unless you really, really need something more exotic, they will save you lots of time and money. Also: automatic updates (configurable). There is also MikroTik. Slightly more expensive than FritzBox, also packed, but slightly different audience (larger networks, less "user-friendly"...). Disclaimer: I have a FritzBox running PPPoE passthrough to an OpenWRT router running on a NanoPi 2RS dialing in over PPPoE, with a MikroTik CRS112 behind that running only as a switch. I have my reasons for that setup, but the time and money I wasted on that setup is really difficult to justify to an outsider (and sometimes to myself). The FritzBox worked really, really well.

azalemeth 5y ago
I mostly agree with this comment except for: > there are most certainly no noticeable benefits of running an alternative firmware For me, those are wireguard, pihole, and the unquantifiable benefit of freedom and choice. Oh, and vim at the cli, and usually a more complete environment than an outdated busybox shell.
- ClumsyPilot 5y ago
  I have a small x86 home server running wireguard and Pi, but i prefer to keep the router 'stock' unless there are issues
- bipson 5y ago
  Oh, you got me wrong there. I do the same. Wireguard's the reason why I run OpenWRT. (Although I'm hesitant to put a pihole up there too, it would not be the 'official' pihole or maybe in a container, both don't seem optimal). But what I meant is: From a practical standpoint, on a daily basis, besides your subjective feeling, nobody else notices a difference if your router has Vim or not - as long as it works. And any decent router nowadays usually works. And I think one should realize that this is tinkering for the tinkering's own sake. There are no objective benefits[*] if you ask an outsider, e.g. your partner. And now I have to manually keep my router up to date, against all possible bugs in numerous open source packages. In 2021 at least security updates should be automatic for OSS- period. [*] (Repeating:) UNLESS you have some specific requirements, e.g. VPN, multiple uplinks, specific software due to specific use cases, etc. In these cases OpenWRT/Tomato etc. are an somewhat easier and cheaper way to get your own stack running, compared to setting up a full-fledged OTS x86 box with Linux or BSD, even pfSense is more work and more expensive I would argue, where the benefits over OpenWRT are even less tangible.

slezyr 5y ago

Any time you can actually use it on your hardware. OpenWRT/Tomato can work on devices with 4MB RAM, 32MB ROM.