4 ms·

I've been considering replacing my EdgeRouter with a pfsense box (probably the Netgate 6100), have you been dissatisfied with your Netgate?

by ericd 5y ago

magicalhippo 5y ago
Unless something radical has changed in the last half year or so, pfSense will be a giant PITA if you have "residential" IPv6. That is, anything but a completely static prefix.
- ericd 5y ago
  Oh interesting, thanks for the heads up.
- technofiend 5y ago
  I am unhappy with pfsense's inability to push gigabit traffic on my hardware, but IPV6 works fine for me. I'd be curious what isp you have and what your issue is.
  - magicalhippo 5y ago
    My ISP has a dynamic prefix, so it changes "willy-nilly", sometimes per day. With pfSense, the issue was primarily two-fold. First was the fact that all the firewall rules and such did not support dynamic prefixes. Major PITA right there. Second was the DNS server, that is, when using pfSense as a DNS server I couldn't figure out how to prevent it from sending the public IPv6 address to clients. Thus when the (public) prefix changed, DNS stopped working on the clients. Some of this might have improved since I last used it, but I switched to OpenWRT and haven't looked back for a second.
imiric 5y ago
I also have an EdgeRouter, but will probably replace that last since it works fine and doesn't require any of the Ubiquiti Controller / Cloud shenanigans. I've had intermittent LAN dropouts on the SG3100 that I couldn't explain from the logs. That in addition to Netgate's hostility towards open source with how they're handling pfSense, and the whole pfSense+ product, just puts a bad taste in my mouth when it comes to supporting the company. For the hardware and software stack they provide, the devices are very overpriced IMO. Same with Ubiquiti, though at least with Ubiquiti you're paying for a set-it-and-forget-it network, as long as you're willing to fully invest in their ecosystem. They're the Apple of network prosumer equipment. But my main interest in abandoning both is investing in devices that I can upgrade and maintain independently and at my own pace. It will also be cheaper in the long run, though it does require some tinkering to setup.
- ericd 5y ago
  Got it, thanks very much for the summary! Agreed that the EdgeRouter is fine, but the one I have is a bit anemic (ER Lite), and I've been disappointed with Ubiquiti's push for increased telemetry/phoning home, so I didn't want to buy a more powerful ER to replace it.
- locusm 5y ago
  I find Ubiquiti wifi to be excellent and their EdgeRouter line has been reliable too but the routing products are just missing basic stuff.
- tw04 5y ago
  Why not just go to opnsense? That’s what most folks have moved to that have gotten fed up with netgates shenanigans.
  - imiric 5y ago
    I thought about it, but WiFi cards are generally better supported on Linux, and since I'll be running OpenWrt on the APs, I'd prefer having a unified OS for both APs and the router. I guess it will depend on how much I like OpenWrt :) I don't have any experience with it.
    - tw04 5y ago
      If you do go the OPNSense route, just be aware you need to disable the spectre/meltdown mitigations to get reasonable performance. pfsense has them disabled by default. In tunables you need: hw.ibrs_disable="1" hw.mds_disable="0" vm.pmap.pti="0"

I've been considering replacing my EdgeRouter with a pfsense box (probably the Netgate 6100), have you been dissatisfied with your Netgate?

by ericd 5y ago

I've been considering replacing my EdgeRouter with a pfsense box (probably the Netgate 6100), have you been dissatisfied with your Netgate?

magicalhippo 5y ago

Unless something radical has changed in the last half year or so, pfSense will be a giant PITA if you have "residential" IPv6. That is, anything but a completely static prefix.

ericd 5y ago
Oh interesting, thanks for the heads up.
technofiend 5y ago
I am unhappy with pfsense's inability to push gigabit traffic on my hardware, but IPV6 works fine for me. I'd be curious what isp you have and what your issue is.
- magicalhippo 5y ago
  My ISP has a dynamic prefix, so it changes "willy-nilly", sometimes per day. With pfSense, the issue was primarily two-fold. First was the fact that all the firewall rules and such did not support dynamic prefixes. Major PITA right there. Second was the DNS server, that is, when using pfSense as a DNS server I couldn't figure out how to prevent it from sending the public IPv6 address to clients. Thus when the (public) prefix changed, DNS stopped working on the clients. Some of this might have improved since I last used it, but I switched to OpenWRT and haven't looked back for a second.

imiric 5y ago

I also have an EdgeRouter, but will probably replace that last since it works fine and doesn't require any of the Ubiquiti Controller / Cloud shenanigans. I've had intermittent LAN dropouts on the SG3100 that I couldn't explain from the logs. That in addition to Netgate's hostility towards open source with how they're handling pfSense, and the whole pfSense+ product, just puts a bad taste in my mouth when it comes to supporting the company. For the hardware and software stack they provide, the devices are very overpriced IMO. Same with Ubiquiti, though at least with Ubiquiti you're paying for a set-it-and-forget-it network, as long as you're willing to fully invest in their ecosystem. They're the Apple of network prosumer equipment. But my main interest in abandoning both is investing in devices that I can upgrade and maintain independently and at my own pace. It will also be cheaper in the long run, though it does require some tinkering to setup.

ericd 5y ago
Got it, thanks very much for the summary! Agreed that the EdgeRouter is fine, but the one I have is a bit anemic (ER Lite), and I've been disappointed with Ubiquiti's push for increased telemetry/phoning home, so I didn't want to buy a more powerful ER to replace it.
locusm 5y ago
I find Ubiquiti wifi to be excellent and their EdgeRouter line has been reliable too but the routing products are just missing basic stuff.
tw04 5y ago
Why not just go to opnsense? That’s what most folks have moved to that have gotten fed up with netgates shenanigans.
- imiric 5y ago
  I thought about it, but WiFi cards are generally better supported on Linux, and since I'll be running OpenWrt on the APs, I'd prefer having a unified OS for both APs and the router. I guess it will depend on how much I like OpenWrt :) I don't have any experience with it.
  - tw04 5y ago
    If you do go the OPNSense route, just be aware you need to disable the spectre/meltdown mitigations to get reasonable performance. pfsense has them disabled by default. In tunables you need: hw.ibrs_disable="1" hw.mds_disable="0" vm.pmap.pti="0"