9 ms·

Please use Opnsense now, or something else entirely (Vyos is great but CLI based). I was a big pfSense fan, telling myself that the odd stuff Netgate did was n

Please use Opnsense now, or something else entirely (Vyos is great but CLI based). I was a big pfSense fan, telling myself that the odd stuff Netgate did was normal/justified. Until the attack on Wireguard's Jason A. Donenfeld. Then I realised - it's all true. They are bordering on insane in that organisation. I regret suggesting my old workmate purchase some of their hardware now. Opnsense is a great replacement. I'm sure it's not perfect, but they're open, friendly, responsive and don't make you question every comment you write on their forum for fear of being banned.

robbiet480 5y ago
I recently switched to Ubiquiti’s Unifi line and am extremely happy, mostly for moral reasons, compared to how I felt being a pfSense user these last few years.
- lostlogin 5y ago
  There is some bad bad shit in that kit. The APs are good and the switches too in my experience. However the UDM-P is a troubled device. It’s buggy, things break or stop working and it loses its config every so often. The form factor is very compelling and the concept is great. I’d pay more if the software quality were better.
  - 8fingerlouie 5y ago
    > However the UDM-P is a troubled device. It’s buggy, things break or stop working and it loses its config every so often. I've been running a UDM and UDMP for years, and have literally never run into any of those issues, despite having a somewhat complex network (for a home network anyway). It runs 24/7 and only needs reboots when a software update requires it. Multiple VLANs, road warrior VPN. I run a site to site VPN between my UDMP at home and UDM at my summerhouse, and that has been rock solid as well. In the latest EA version of the software, there is also some support for Wireguard (though UI's Teleport). I'm not sure if "raw" Wireguard is available (yet). Latest version also implements policy based routing.
    - lostlogin 5y ago
      I’m looking forward to using WireGuard on the device (I already use it, but from within the network). I’m in the latest stable version, as I updated after an outage last week where the controller was crashed. The variability in user satisfaction suggests some sort of hardware issue or bugginess that hits a small portion of users.
- vigilans 5y ago
  Ubiquiti is also morally questionable. They do not contribute their modifications to the Linux kernel as required by the GPL. Maybe that has changed but I'm not aware that it has.
  - imglorp 5y ago
    That, plus they try very hard to drive you to their cloud. It's not necessary, at least with older hardware, but their cloud has been breached and people should probably ask if they really need its convenience vs cost, privacy and security. I just ended up resetting my network (switch, sec gateway, controller, and AP) and it's a little tricky without their cloud. You need to do some SSH'ing. Caveats aside, the hardware is outstanding, the disk AP is solid as is the consumer grade cube one. It's a good prosumer and small business option despite the downsides.
  - frickinLasers 5y ago
    There's also that time they slipped telemetry reporting into their software and hoped no one would notice. https://www.theregister.com/2019/11/07/ubiquiti_networks_phone_home/ https://www.theregister.com/2019/11/07/ubiquiti_networks_pho...
8fingerlouie 5y ago
> (Vyos is great but CLI based) The best firewalls/routers i've ever used have been Vyos (or Vyatta) based. Point & Click has it's charms, but its a crutch. With Vyos you can "replay" you entire configuration over a serial port, as well as make changes to it in a regular text editor. It does have a learning curve though :) I'm also on the UniFi line of things for now, but i really wish somebody would make a decent Vyos based appliance (low powered ARM device) like the Ubiquiti Edgerouters of old.
- donmcronald 5y ago
  > like the Ubiquiti Edgerouters of old. Wasn’t EdgeOS a fork of Vyatta?
  - sofixa 5y ago
    Yep.
- muppetman 5y ago
  Yea, my home router is Vyos now (running under Proxmox virtualisation) and it's just 100% rock solid. Uptimes of 120 days until I reboot it etc. I used to use pfSense but migrated when I hit a pfSense CPU bug. I also find I get better performance (less CPU usage) running "Linux under Linux" instead of "FreeBSD under Linux" was I was with pfSense (it was virtulised too) Long live the CLI :)
  - rb666 5y ago
    I've considered virtualizing my current hardware Opnsense router, mostly to save on electricity. But I fear the situation of needing to do maintenance or troubleshooting on the Proxmox host without internet. What fallback do you have?
    - Fnoord 5y ago
      Yeah, I'm in the same boat, but I doubt its gonna save much electricity, and whenever I patch ESXi (or Proxmox) the entire internet connection is down.
m1gu3l 5y ago
> Until the attack on Wireguard's Jason A. Donenfeld. Then I realised - it's all true. They are bordering on insane in that organisation. I regret suggesting my old workmate purchase some of their hardware now. This sounds fun. do you know where I can read more? edit: think i found a good start https://www.reddit.com/r/networking/comments/m6zjie/wireguard_netgate_pfsense_drama/ https://www.reddit.com/r/networking/comments/m6zjie/wireguar...
- Arnavion 5y ago
  HN thread: https://news.ycombinator.com/item?id=26475519 https://news.ycombinator.com/item?id=26475519 Events in chronological order: - zx2c4 points out the brokenness of the Netgate implementation and his efforts to fix it: https://lists.zx2c4.com/pipermail/wireguard/2021-March/006494.html https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649... - ... which ends up being published by Ars: https://arstechnica.com/gadgets/2021/03/in-kernel-wireguard-is-on-its-way-to-freebsd-and-the-pfsense-router/ https://arstechnica.com/gadgets/2021/03/in-kernel-wireguard-... - Netgate throws a fit, zx2c4 responds: https://lists.zx2c4.com/pipermail/wireguard/2021-March/006499.html https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649... - FreeBSD maintainer of the WireGuard implementation announces Netgate's implementation will be removed: https://lists.freebsd.org/pipermail/freebsd-hackers/2021-March/057082.html https://lists.freebsd.org/pipermail/freebsd-hackers/2021-Mar... - Netgate's damage control / copium response: https://www.netgate.com/blog/painful-lessons-learned-in-security-and-community https://www.netgate.com/blog/painful-lessons-learned-in-secu... - FreeBSD dev steps down from further involvement with WireGuard-in-FreeBSD: https://lists.freebsd.org/pipermail/freebsd-hackers/2021-March/057093.html https://lists.freebsd.org/pipermail/freebsd-hackers/2021-Mar...
  - aaaaaaaaata 5y ago
    > zx2c4 is Jason (Wireguard creator).
Arnavion 5y ago
I switched before the WireGuard fiasco, when they announced they were EOLing the CE line, but weasel-worded to avoid having to use the phrase "EOL". https://news.ycombinator.com/item?id=27775408 https://news.ycombinator.com/item?id=27775408 https://news.ycombinator.com/item?id=26479725 https://news.ycombinator.com/item?id=26479725
edge-records 5y ago
Just read the blog post from Netgate, sounds to me like they have decent values. Also them asking to keep safe disclosure procedures doesn't sound insane to me either. Beyond that it's a he said she said thing IMHO, and I don't have the time to get involved in any of that. Stuff happens between people, and them not managing to work it out doesn't per se mean they are evil or "insane". I'm an Open Source user of pfSense (so they don't get money from me) but I still had an extremely helpful experience recently, when I had a feature request. Once I filed it, it was implemented quickly, MUCH better support than I could ever expect from a paid commercial firewall. Also the product runs reliably and is very stable since years. So I won't look for alternatives any time soon.
- newsclues 5y ago
  Netgate pissed off the open source absolutists, who mostly don’t give netgate money. While I understand their complaints, I don’t understand the constant attacks and hate, as anyone who doesn’t want to support pfsense if there is a paid and a free oss version, is welcome to start a fork or work on other projects.
stock_toaster 5y ago
I switched to openwrt a few years ago, after a brief stint of using an edge router from ubiquity. vyos is nice, but openwrt is surprisingly solid too!
- sigio 5y ago
  Same here, always recommend openwrt when asked for home / office routers/firewalls.
lausbub 5y ago
I just found these tools that help with migration. They pretty print the configuration XMLs such that one can transfer the settings manually through the GUI step by step and finally verify with the second tool. https://github.com/TKCERT/pfFocus https://github.com/TKCERT/pfFocus https://github.com/AndyX90/OPNReport https://github.com/AndyX90/OPNReport https://www.reddit.com/r/OPNsenseFirewall/comments/masujb/tips_for_migrating_from_pfsense_to_opnsense/ https://www.reddit.com/r/OPNsenseFirewall/comments/masujb/ti...
- exmadscientist 5y ago
  But don't use these if your configuration is simple enough that you can manually recreate it, on the completely-impossibly-rare chance that pfSense has managed to subtly bork itself and you're switching to OPNsense to get a more reliable device....
  - deleted 5y ago
    [deleted]
  - 8fingerlouie 5y ago
    I highly recommend implementing the firewall rules form scratch. Firewall rules tend to aquire "cruft", especially in domestic settings, where you add rules to "fix something", and there is rarely any review of existing rules. Personally i keep a spreadsheet of the firewall rules i need, including inter VLAN communication, with source/destination ip/port as well as a link to any article describing why this port needs to be open (like Sonos across VLANs, etc). It sounds cumbersome, but it doesn't change frequently, and reimplementing it in a new firewall takes 30-60 minutes.
q1w2 5y ago
Their hardware has not been reliable. We've purchased 4 devices from them for our medium sized business - and 2 of them failed completely within 5 years. Maybe both failures were anomalies, but these were the only two commercial grade devices we've had that failed in that same period.
- 1MachineElf 5y ago
  I'm not sure what these devices are based on, but there was a time when a lot of the Netgate lineup was using Intel C2000-series Avoton CPUs. Down the road it was discovered all of those were susceptible to a hardware big known at AVR54. Could it be why your devices failed? More info here: https://www.servethehome.com/intel-atom-c2000-series-bug-quiet/ https://www.servethehome.com/intel-atom-c2000-series-bug-qui...
  - q1w2 5y ago
    SG-8860 and a SG-4860 - which use the Intel "Rangeley" Atom C2758, and Intel “Rangeley” Atom C2558, respectively. Not sure if they were impacted by the bug.

robbiet480 5y ago

I recently switched to Ubiquiti’s Unifi line and am extremely happy, mostly for moral reasons, compared to how I felt being a pfSense user these last few years.

lostlogin 5y ago
There is some bad bad shit in that kit. The APs are good and the switches too in my experience. However the UDM-P is a troubled device. It’s buggy, things break or stop working and it loses its config every so often. The form factor is very compelling and the concept is great. I’d pay more if the software quality were better.
- 8fingerlouie 5y ago
  > However the UDM-P is a troubled device. It’s buggy, things break or stop working and it loses its config every so often. I've been running a UDM and UDMP for years, and have literally never run into any of those issues, despite having a somewhat complex network (for a home network anyway). It runs 24/7 and only needs reboots when a software update requires it. Multiple VLANs, road warrior VPN. I run a site to site VPN between my UDMP at home and UDM at my summerhouse, and that has been rock solid as well. In the latest EA version of the software, there is also some support for Wireguard (though UI's Teleport). I'm not sure if "raw" Wireguard is available (yet). Latest version also implements policy based routing.
  - lostlogin 5y ago
    I’m looking forward to using WireGuard on the device (I already use it, but from within the network). I’m in the latest stable version, as I updated after an outage last week where the controller was crashed. The variability in user satisfaction suggests some sort of hardware issue or bugginess that hits a small portion of users.
vigilans 5y ago
Ubiquiti is also morally questionable. They do not contribute their modifications to the Linux kernel as required by the GPL. Maybe that has changed but I'm not aware that it has.
- imglorp 5y ago
  That, plus they try very hard to drive you to their cloud. It's not necessary, at least with older hardware, but their cloud has been breached and people should probably ask if they really need its convenience vs cost, privacy and security. I just ended up resetting my network (switch, sec gateway, controller, and AP) and it's a little tricky without their cloud. You need to do some SSH'ing. Caveats aside, the hardware is outstanding, the disk AP is solid as is the consumer grade cube one. It's a good prosumer and small business option despite the downsides.
- frickinLasers 5y ago
  There's also that time they slipped telemetry reporting into their software and hoped no one would notice. https://www.theregister.com/2019/11/07/ubiquiti_networks_phone_home/ https://www.theregister.com/2019/11/07/ubiquiti_networks_pho...

8fingerlouie 5y ago

> (Vyos is great but CLI based) The best firewalls/routers i've ever used have been Vyos (or Vyatta) based. Point & Click has it's charms, but its a crutch. With Vyos you can "replay" you entire configuration over a serial port, as well as make changes to it in a regular text editor. It does have a learning curve though :) I'm also on the UniFi line of things for now, but i really wish somebody would make a decent Vyos based appliance (low powered ARM device) like the Ubiquiti Edgerouters of old.

donmcronald 5y ago
> like the Ubiquiti Edgerouters of old. Wasn’t EdgeOS a fork of Vyatta?
- sofixa 5y ago
  Yep.
muppetman 5y ago
Yea, my home router is Vyos now (running under Proxmox virtualisation) and it's just 100% rock solid. Uptimes of 120 days until I reboot it etc. I used to use pfSense but migrated when I hit a pfSense CPU bug. I also find I get better performance (less CPU usage) running "Linux under Linux" instead of "FreeBSD under Linux" was I was with pfSense (it was virtulised too) Long live the CLI :)
- rb666 5y ago
  I've considered virtualizing my current hardware Opnsense router, mostly to save on electricity. But I fear the situation of needing to do maintenance or troubleshooting on the Proxmox host without internet. What fallback do you have?
  - Fnoord 5y ago
    Yeah, I'm in the same boat, but I doubt its gonna save much electricity, and whenever I patch ESXi (or Proxmox) the entire internet connection is down.

m1gu3l 5y ago

> Until the attack on Wireguard's Jason A. Donenfeld. Then I realised - it's all true. They are bordering on insane in that organisation. I regret suggesting my old workmate purchase some of their hardware now. This sounds fun. do you know where I can read more? edit: think i found a good start https://www.reddit.com/r/networking/comments/m6zjie/wireguard_netgate_pfsense_drama/ https://www.reddit.com/r/networking/comments/m6zjie/wireguar...

Arnavion 5y ago
HN thread: https://news.ycombinator.com/item?id=26475519 https://news.ycombinator.com/item?id=26475519 Events in chronological order: - zx2c4 points out the brokenness of the Netgate implementation and his efforts to fix it: https://lists.zx2c4.com/pipermail/wireguard/2021-March/006494.html https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649... - ... which ends up being published by Ars: https://arstechnica.com/gadgets/2021/03/in-kernel-wireguard-is-on-its-way-to-freebsd-and-the-pfsense-router/ https://arstechnica.com/gadgets/2021/03/in-kernel-wireguard-... - Netgate throws a fit, zx2c4 responds: https://lists.zx2c4.com/pipermail/wireguard/2021-March/006499.html https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649... - FreeBSD maintainer of the WireGuard implementation announces Netgate's implementation will be removed: https://lists.freebsd.org/pipermail/freebsd-hackers/2021-March/057082.html https://lists.freebsd.org/pipermail/freebsd-hackers/2021-Mar... - Netgate's damage control / copium response: https://www.netgate.com/blog/painful-lessons-learned-in-security-and-community https://www.netgate.com/blog/painful-lessons-learned-in-secu... - FreeBSD dev steps down from further involvement with WireGuard-in-FreeBSD: https://lists.freebsd.org/pipermail/freebsd-hackers/2021-March/057093.html https://lists.freebsd.org/pipermail/freebsd-hackers/2021-Mar...
- aaaaaaaaata 5y ago
  > zx2c4 is Jason (Wireguard creator).

Arnavion 5y ago

I switched before the WireGuard fiasco, when they announced they were EOLing the CE line, but weasel-worded to avoid having to use the phrase "EOL". https://news.ycombinator.com/item?id=27775408 https://news.ycombinator.com/item?id=27775408 https://news.ycombinator.com/item?id=26479725 https://news.ycombinator.com/item?id=26479725

edge-records 5y ago

Just read the blog post from Netgate, sounds to me like they have decent values. Also them asking to keep safe disclosure procedures doesn't sound insane to me either. Beyond that it's a he said she said thing IMHO, and I don't have the time to get involved in any of that. Stuff happens between people, and them not managing to work it out doesn't per se mean they are evil or "insane". I'm an Open Source user of pfSense (so they don't get money from me) but I still had an extremely helpful experience recently, when I had a feature request. Once I filed it, it was implemented quickly, MUCH better support than I could ever expect from a paid commercial firewall. Also the product runs reliably and is very stable since years. So I won't look for alternatives any time soon.

newsclues 5y ago
Netgate pissed off the open source absolutists, who mostly don’t give netgate money. While I understand their complaints, I don’t understand the constant attacks and hate, as anyone who doesn’t want to support pfsense if there is a paid and a free oss version, is welcome to start a fork or work on other projects.

stock_toaster 5y ago

I switched to openwrt a few years ago, after a brief stint of using an edge router from ubiquity. vyos is nice, but openwrt is surprisingly solid too!

sigio 5y ago
Same here, always recommend openwrt when asked for home / office routers/firewalls.

lausbub 5y ago

I just found these tools that help with migration. They pretty print the configuration XMLs such that one can transfer the settings manually through the GUI step by step and finally verify with the second tool. https://github.com/TKCERT/pfFocus https://github.com/TKCERT/pfFocus https://github.com/AndyX90/OPNReport https://github.com/AndyX90/OPNReport https://www.reddit.com/r/OPNsenseFirewall/comments/masujb/tips_for_migrating_from_pfsense_to_opnsense/ https://www.reddit.com/r/OPNsenseFirewall/comments/masujb/ti...

exmadscientist 5y ago
But don't use these if your configuration is simple enough that you can manually recreate it, on the completely-impossibly-rare chance that pfSense has managed to subtly bork itself and you're switching to OPNsense to get a more reliable device....
- deleted 5y ago
  [deleted]
- 8fingerlouie 5y ago
  I highly recommend implementing the firewall rules form scratch. Firewall rules tend to aquire "cruft", especially in domestic settings, where you add rules to "fix something", and there is rarely any review of existing rules. Personally i keep a spreadsheet of the firewall rules i need, including inter VLAN communication, with source/destination ip/port as well as a link to any article describing why this port needs to be open (like Sonos across VLANs, etc). It sounds cumbersome, but it doesn't change frequently, and reimplementing it in a new firewall takes 30-60 minutes.

q1w2 5y ago

Their hardware has not been reliable. We've purchased 4 devices from them for our medium sized business - and 2 of them failed completely within 5 years. Maybe both failures were anomalies, but these were the only two commercial grade devices we've had that failed in that same period.

1MachineElf 5y ago
I'm not sure what these devices are based on, but there was a time when a lot of the Netgate lineup was using Intel C2000-series Avoton CPUs. Down the road it was discovered all of those were susceptible to a hardware big known at AVR54. Could it be why your devices failed? More info here: https://www.servethehome.com/intel-atom-c2000-series-bug-quiet/ https://www.servethehome.com/intel-atom-c2000-series-bug-qui...
- q1w2 5y ago
  SG-8860 and a SG-4860 - which use the Intel "Rangeley" Atom C2758, and Intel “Rangeley” Atom C2558, respectively. Not sure if they were impacted by the bug.