9 ms·

I stuck with OPNsense when I upgraded but I virtualized everything which make everything so much easier. [1] You can just replace the router if you want or reve

I stuck with OPNsense when I upgraded but I virtualized everything which make everything so much easier. [1] You can just replace the router if you want or revert it if an update fails. No more digging up an USB to Serial adapter to connect to the the console on an ALIX board. [1] https://sschueller.github.io/posts/wiring-a-home-with-fiber/ https://sschueller.github.io/posts/wiring-a-home-with-fiber/

SamuelAdams 3y ago
Can you do more of a write up on the software side? How does proxmox get an internet connection for updates, if OpnSense is virtualized?
- sschueller 3y ago
  I will write another blog post about it eventually. Proxmox is connected to the network via additional external NIC at the moment.
  - scns 3y ago
    Please do a Show HN when you are done.
- vladvasiliu 3y ago
  Not OP, and I don't use proxmox, but in my case the host is just another client of the router. Of course, if the router is borken for whatever reason, the host won't get any updates. But if that's the case, upgrading the host is unlikely to be my top priority. If I really need to update the host with no router: I plug my iPhone via USB, and I'm off to the races.
Arnavion 3y ago
I switched away from OPNsense because it's insecure and its maintainers are incompetent. https://news.ycombinator.com/item?id=34839161 https://news.ycombinator.com/item?id=34839161 It's basically a Manjaro vs Arch situation. FreeBSD is fine, but these downstreams like pfSense / OPNsense with only a handful of maintainers just delay patches pointlessly. I'd much rather use upstream directly. (I switched to Debian instead of FreeBSD because, if I was going to have to set up networking from scratch, I'd much rather do it in an OS I'm more familiar with.)
- brazzledazzle 3y ago
  I wonder why the OPNsense maintainer took your question so personally. Asking for transparency with how an OS project deals with CVE-impacted packages doesn't seem particularly controversial to me.

SamuelAdams 3y ago

Can you do more of a write up on the software side? How does proxmox get an internet connection for updates, if OpnSense is virtualized?

sschueller 3y ago
I will write another blog post about it eventually. Proxmox is connected to the network via additional external NIC at the moment.
- scns 3y ago
  Please do a Show HN when you are done.
vladvasiliu 3y ago
Not OP, and I don't use proxmox, but in my case the host is just another client of the router. Of course, if the router is borken for whatever reason, the host won't get any updates. But if that's the case, upgrading the host is unlikely to be my top priority. If I really need to update the host with no router: I plug my iPhone via USB, and I'm off to the races.

Arnavion 3y ago

I switched away from OPNsense because it's insecure and its maintainers are incompetent. https://news.ycombinator.com/item?id=34839161 https://news.ycombinator.com/item?id=34839161 It's basically a Manjaro vs Arch situation. FreeBSD is fine, but these downstreams like pfSense / OPNsense with only a handful of maintainers just delay patches pointlessly. I'd much rather use upstream directly. (I switched to Debian instead of FreeBSD because, if I was going to have to set up networking from scratch, I'd much rather do it in an OS I'm more familiar with.)

brazzledazzle 3y ago
I wonder why the OPNsense maintainer took your question so personally. Asking for transparency with how an OS project deals with CVE-impacted packages doesn't seem particularly controversial to me.