4 ms·

> (Vyos is great but CLI based) The best firewalls/routers i've ever used have been Vyos (or Vyatta) based. Point & Click has it's charms, but its a crutch. W

> (Vyos is great but CLI based) The best firewalls/routers i've ever used have been Vyos (or Vyatta) based. Point & Click has it's charms, but its a crutch. With Vyos you can "replay" you entire configuration over a serial port, as well as make changes to it in a regular text editor. It does have a learning curve though :) I'm also on the UniFi line of things for now, but i really wish somebody would make a decent Vyos based appliance (low powered ARM device) like the Ubiquiti Edgerouters of old.

donmcronald 5y ago
> like the Ubiquiti Edgerouters of old. Wasn’t EdgeOS a fork of Vyatta?
- sofixa 5y ago
  Yep.
muppetman 5y ago
Yea, my home router is Vyos now (running under Proxmox virtualisation) and it's just 100% rock solid. Uptimes of 120 days until I reboot it etc. I used to use pfSense but migrated when I hit a pfSense CPU bug. I also find I get better performance (less CPU usage) running "Linux under Linux" instead of "FreeBSD under Linux" was I was with pfSense (it was virtulised too) Long live the CLI :)
- rb666 5y ago
  I've considered virtualizing my current hardware Opnsense router, mostly to save on electricity. But I fear the situation of needing to do maintenance or troubleshooting on the Proxmox host without internet. What fallback do you have?
  - Fnoord 5y ago
    Yeah, I'm in the same boat, but I doubt its gonna save much electricity, and whenever I patch ESXi (or Proxmox) the entire internet connection is down.
  - muppetman 5y ago
    I have a cluster of 3 Proxmox hosts, mostly to teach myself about clustering. I have two Vyos instances running VRRP between them. If the primary fails, the secondary sees the VRRP state change, runs a small script to bring up the PPPoE interface and we're away laughing. It syncs state, so people notice ~8-10 seconds of packet loss and everything just keeps going. It's quite nerdy though. And all it does is move the single point of the failure to the switch (required for the hosts to talk to each other for VRRP etc) Proxmox is so reliable in my experience though, but I don't tend to fiddle with it, just set and forget.
  - 8fingerlouie 5y ago
    This is my main issue with pfSense/OpnSense. Even the dedicated hardware appliances are quite power hungry compared to some of the rather capable Linux ARM boxes out there. For comparison, an 8 Gbps capable pfSense appliance (like the Netgate 4100) requires 40W-50W (max 60W), where the UniFi Dream Machine Pro, also capable of 8Gbps, has a maximum power consumption of 33W, which includes a 3.5" harddrive for UniFi Protect. Mine uses about 18W without the harddrive, and 22W with a WD Red. A difference of 25W over a year at current european electricity prices (€0.5/kWh) means a saving of 219 kWh (€109/year). Considering that electricity has been as high as €1.12/kWh this spring, it could be even higher. As for virtualization, while it's a great learning experience, it's probably more trouble than it's worth. I greatly prefer appliances for network.
- rktdno 5y ago
  I similarly am running openbsd as a home router under proxmox and it’s rock solid. I had more time on my hands when I set it up than I do now, but thankfully it’s without issue and just seems to always work so there isn’t really any maintenance other than point upgrades to openbsd when I remember.
- luckman212 5y ago
  What "pfSense CPU bug" are you talking about? Do you mean the Intel C2000 bug[0] that had nothing to do with pfSense and also affected dozens of other vendors, including Cisco among others? [0] https://www.anandtech.com/show/11110/semi-critical-intel-atom-c2000-flaw-discovered https://www.anandtech.com/show/11110/semi-critical-intel-ato...
btgeekboy 5y ago
Are you aware of any trustworthy, free VyOS builds? I'd be interested in trying it out at home, but I'm not interested in paying $6k/year or using an unstable nightly. I tried building it myself once but didn't have time to get it working locally.
- muppetman 5y ago
  You'd be amazed at how stable the 1.3 builds are.
  - RealStickman_ 5y ago
    Do you mean the 1.4 rolling builds? The 1.3 ones require a support contract.
    - usrlocal1023 5y ago
      You can get monthly snapshots free of charge which receive some testing compared to rolling builds. They currently have 1.3 RC builds https://vyos.net/get/snapshots/ https://vyos.net/get/snapshots/
      - RealStickman_ 5y ago
        I wasn't aware of that. Thank you
- donmcronald 5y ago
  Yeah. $6k/year is just waaaay too much to get into it.

donmcronald 5y ago

> like the Ubiquiti Edgerouters of old. Wasn’t EdgeOS a fork of Vyatta?

sofixa 5y ago
Yep.

muppetman 5y ago

Yea, my home router is Vyos now (running under Proxmox virtualisation) and it's just 100% rock solid. Uptimes of 120 days until I reboot it etc. I used to use pfSense but migrated when I hit a pfSense CPU bug. I also find I get better performance (less CPU usage) running "Linux under Linux" instead of "FreeBSD under Linux" was I was with pfSense (it was virtulised too) Long live the CLI :)

rb666 5y ago
I've considered virtualizing my current hardware Opnsense router, mostly to save on electricity. But I fear the situation of needing to do maintenance or troubleshooting on the Proxmox host without internet. What fallback do you have?
- Fnoord 5y ago
  Yeah, I'm in the same boat, but I doubt its gonna save much electricity, and whenever I patch ESXi (or Proxmox) the entire internet connection is down.
- muppetman 5y ago
  I have a cluster of 3 Proxmox hosts, mostly to teach myself about clustering. I have two Vyos instances running VRRP between them. If the primary fails, the secondary sees the VRRP state change, runs a small script to bring up the PPPoE interface and we're away laughing. It syncs state, so people notice ~8-10 seconds of packet loss and everything just keeps going. It's quite nerdy though. And all it does is move the single point of the failure to the switch (required for the hosts to talk to each other for VRRP etc) Proxmox is so reliable in my experience though, but I don't tend to fiddle with it, just set and forget.
- 8fingerlouie 5y ago
  This is my main issue with pfSense/OpnSense. Even the dedicated hardware appliances are quite power hungry compared to some of the rather capable Linux ARM boxes out there. For comparison, an 8 Gbps capable pfSense appliance (like the Netgate 4100) requires 40W-50W (max 60W), where the UniFi Dream Machine Pro, also capable of 8Gbps, has a maximum power consumption of 33W, which includes a 3.5" harddrive for UniFi Protect. Mine uses about 18W without the harddrive, and 22W with a WD Red. A difference of 25W over a year at current european electricity prices (€0.5/kWh) means a saving of 219 kWh (€109/year). Considering that electricity has been as high as €1.12/kWh this spring, it could be even higher. As for virtualization, while it's a great learning experience, it's probably more trouble than it's worth. I greatly prefer appliances for network.
rktdno 5y ago
I similarly am running openbsd as a home router under proxmox and it’s rock solid. I had more time on my hands when I set it up than I do now, but thankfully it’s without issue and just seems to always work so there isn’t really any maintenance other than point upgrades to openbsd when I remember.
luckman212 5y ago
What "pfSense CPU bug" are you talking about? Do you mean the Intel C2000 bug[0] that had nothing to do with pfSense and also affected dozens of other vendors, including Cisco among others? [0] https://www.anandtech.com/show/11110/semi-critical-intel-atom-c2000-flaw-discovered https://www.anandtech.com/show/11110/semi-critical-intel-ato...

btgeekboy 5y ago

Are you aware of any trustworthy, free VyOS builds? I'd be interested in trying it out at home, but I'm not interested in paying $6k/year or using an unstable nightly. I tried building it myself once but didn't have time to get it working locally.

muppetman 5y ago
You'd be amazed at how stable the 1.3 builds are.
- RealStickman_ 5y ago
  Do you mean the 1.4 rolling builds? The 1.3 ones require a support contract.
  - usrlocal1023 5y ago
    You can get monthly snapshots free of charge which receive some testing compared to rolling builds. They currently have 1.3 RC builds https://vyos.net/get/snapshots/ https://vyos.net/get/snapshots/
    - RealStickman_ 5y ago
      I wasn't aware of that. Thank you
donmcronald 5y ago
Yeah. $6k/year is just waaaay too much to get into it.