11 ms·

OPNsense: Open-source security platform

205 points by tambourine_man 3y ago

robcohen 3y ago
As an alternative, I've been watching VyOS with great interest and it seems like they are finally going to release their controller and LocalUI interface this year, which is exciting. It seems to have a similar architecture as a Ubiquiti controller. https://blog.vyos.io/ https://blog.vyos.io/
- fellowmartian 3y ago
  Yeah I’m waiting for a good open source Linux-based firewall, it’s way overdue. Linux has surpassed FreeBSD in terms of networking, at least for the home/SMB router use case. I’m talking about Cake, eBPF, etc. I’m currently running Mikrotik x86 on a NUC, but their hardware support on x86 isn’t great. I’d rather switch to Vyos, but I’m too lazy to learn their CLI. Semi-related: OpenWRT is also genuinely not bad on x86, but it’s slightly too simplified compared to say Mikrotik or VyOS. It also runs great in a VM.
  - n8henrie 3y ago
    Same! Have you looked into IPFire? That's the one I had my eyes on.
    - fellowmartian 3y ago
      I actually used to run it years back, but it unfortunately hasn't been updated very much since.
  - hnarn 3y ago
    > Linux has surpassed FreeBSD in terms of networking Can you elaborate on this?
    - fellowmartian 3y ago
      As I said above, it's stuff like Cake, which is an advanced QoS scheduler that helps eliminate bufferbloat (very relevant for home networks). Additionally, eBPF and XDP will soon be integrated into standard firewalls, which should speed them up dramatically, allowing for crazy high speed (or power efficient) routing on commodity hardware.
  - _ea1k 3y ago
    OpenWRT also runs great on ARM. Even the Raspberry Pi can work well for home use.
- donmcronald 3y ago
  I always wanted to try it, but $8k / year for the cheapest stable release license isn’t in my universe for affordability. > It seems to have a similar architecture as a Ubiquiti controller. That’s a hell of an insult to be tossing around for an unreleased product. Lmao.
  - robcohen 3y ago
    Why’s that? I actually like the api system for Ubiquiti gear.
    - donmcronald 3y ago
      The Ubiquiti controller is fine if you're managing one site, but beyond that it's pretty poorly designed IMO. By far the biggest problem is that they don't give enough consideration to recover-ability of offsite devices. If something causes a device to disconnect from the controller their solution is to SSH in and re-adopt it. That doesn't work once you're dealing with hundreds of devices across dozens of sites. A good example of where that becomes problematic is to look at the controller hostname override setting they have. You could change it to 'unifi.invalid' and it would happily push that change out to a thousand devices and leave them in a state where you'd need to be hands on with every device to recover. If you can do it on purpose, they can do it accidentally with a buggy update, so, IMHO, there's always a risk that an update could break things pretty badly. That's not a hypothetical either. They (purposely) pushed an update that did something like that when they started supporting HTTPS for the inform URL several years ago. The second issue I have with it is more of a design issue. Sites should be somewhat sharded and I should be able to update the controller version on a per-site basis. I think that does a lot to reduce the risk of an update breaking things. I also dislike the default settings and prompts for auto-updates. I like the scheduled updates and think they're great, but the push to "update everything daily at 3:00 AM" is too much. I have a controller with 100+ sites and need to schedule updates to ensure any breakage is fixable via manual intervention up to the point of physically visiting a site. Edit: To clarify this, I'm sure I've been prompted to enable 3:00 AM auto-updates on the newer controller versions and accidentally clicking "yes" would be a huge headache for me. The "rolling update" was also pretty trashy when I tried it. That was years ago, but I think it simply updated APs sequentially and happily continued if the previous one didn't come back up. How hard is it really to implement a rolling update that stops and waits for intervention if even one device doesn't come back online? And the UI. I can't even use it without setting my browser to 80% zoom and it gets worse every time they push out an update. Everything is stuck into tiny little scrollable boxes. I have multiple 27" monitors and get stuck scrolling around in a 1" x 2" box that can't display more than 2 or 3 lines of config. Why? And then TP-Link copied them with Omahda. It's almost funny. I wonder if they even realize they're copying off the dumbest kid in the class. Lol.
- synergy20 3y ago
  ubiquiti indeed ran vyos underneath then improved it over the years
  - robcohen 3y ago
    I think you mean Vyatta
getcrunk 3y ago
Pfense is practically no longer open source. OPNsense has come a long way and even has some features pfsense does not
- donmcronald 3y ago
  PfSense has some pretty bad problems relating to interfaces disappearing temporarily and services dying from it. I would go as far as saying 2.6.0 is unreliable. With PCEngines shutting down it’s almost impossible to find reliable, cost effective hardware. I hope pfSense gets back on track because their hardware seems ok.
  - imiric 3y ago
    I recently moved my main router from a Netgate device running pfSense to a Deciso device running OPNsense, and couldn't be happier with the change. The Deciso hardware is pricey, but you get what you pay for. Very well built, silent, and very powerful hardware. No issues whatsoever.
- nvy 3y ago
  The pfsense people are, frankly, fucking clowns. They bought the domain opnsense.com and used it to badmouth the opnsense project[0]. Do not give pfsense time, attention, or money. [0] https://opnsense.org/opnsense-com/ https://opnsense.org/opnsense-com/
  - alias_neo 3y ago
    I remember reading this nearer the time, but I never clicked through to see just what was on the site; having just looked at the cache, I'm appalled. That stuff goes beyond petty, to the point that whoever is behind that should not only NOT be doing business with the grown ups, they should be in a facility seriously re-evaluating their life choices. What a disgrace.
    - illiac786 3y ago
      >whoever s behind that Well, you don’t have to wonder, the owner of the domain was revealed by court action to be Jamie Thompson, one of the two founder of Netgate, which sells the commercial version of pfSense. Surprise…
LeSaucy 3y ago
OPNsense is the core router platform I default to for all my network infrastructure (work devops env, homelab, vpn to family members etc). Its feature packed and ROCK solid. I almost always run it in a virtual machine so i can live migrate it between hosts and have no downtime. The cluster / high availability works great and ensures no loss of connectivity during upgrades. OPNsense is a true hidden gem in the open source world.
- syntaxing 3y ago
  I did a bare metal migration and it was pretty painless. Had to reinstall some packages, but it was as simple as just hitting the + on the package manager.
  - LeSaucy 3y ago
    Yes! The single file xml config export is super easy to move an install between systems (physical and virtual). There is even a plugin to manage the changes with git!
    - KennyBlanken 3y ago
      Every time I've given up on an OPNsense instance and re-installed it, importing a config backup, half the config didn't import. Maybe things are better these days.
- Scramblejams 3y ago
  Has there been a positive inflection in its quality recently? I tried it a while back but pretty quickly it got Unbound's config XML in a state which wouldn't allow the daemon to run. I had to get in and fix it up by hand to get it going again. Wasn't impressed with the quality it was showing me, switched to pfSense and haven't had any similar issues, so I haven't felt the need to look at OPNsense again.
- KennyBlanken 3y ago
  I used to find it rock solid, but around two years ago reliability tanked. I found myself regularly having issues with interfaces (a genuine Intel server-grade multi-port NIC) flip-flopping. About a year ago, I started having random issues with traffic no longer routing, out of the blue. Lately both issues seem to have gone away. Right now the software update function dies half the time I try to run a check, with a long sqlite query string / error being dumped to the console. This has been going on for at least the last couple of months worth of releases. About a year or two after install, reboots and power-offs stopped working. The system just hangs instead after printing out a message about USB, and I cannot figure out for the life of me what's wrong. It's a standard Dell SFF PC, nothing exotic, and had been working fine until a major release broke it. FreeBSD's documentation about ACPI is impenetrable, so I can't figure out what's going on. Startups and reboots used to be lightning quick, with maybe a minute or less between the bootloader kicking off loading the kernel and interfaces/routing/firewall up and it giving its happy chime. These days the system spins its wheels for ages doing...something, not sure what. I find the project pretty outdated and behind the times. The UI purposefully obtuse with terrible organization and field names and a lot of missing help text to keep their support/consulting biz strong. They're really far behind on features. There's no application blocking, monitoring/diag is rudimentary, it has extremely limited backup functions (Google Drive and that's it, I believe), and even the DNS blocklist functionality is extremely rudimentary, with only a fixed list of really trashy, unreliably lists available to pick from (one of the groups they pull lists from has demonstrated extensive issues with QA, routinely including things like certificate validation servers in their blacklists.) They've also gone out of their way to make the Adguard Home plugin annoying and confusing to get working if you want to configure it as a proxy to unbound, which is needed if you want DHCP hostname records to work (speaking of which, DHCP leases are needlessly obtuse to mange.) Their release process is wildly unsuitable for production network equipment. A 'major' release is immediately EOL'd as soon as the next major release comes out. Running 20.1 and need to stay on it because 20.2 breaks something or you want to wait for the dust to settle? Too bad. There's no security releases for older major revisions. And it wouldn't be so bad if each major release was followed by a number of "oops we fucked up...." point-point releases because their QA isn't very good. The devs are sticks in the mud, too - mostly "franco." They bitched and moaned up a storm for YEARS about wireguard being "insecure" despite no evidence to back their claims, citing that as the reason for refusing numerous requests for integration, and even refusing code contributions from the community for it. They eventually caved. The wireguard plugin is still pretty meh and difficult to navigate unless you know wireguard well. ARM support? Zero interest in even assisting community efforts, which have gotten impressively far with it, especially now that ARM support in FreeBSD got appreciably better in the last release or two. I suspect it's because they see it as a threat to their (grossly overpriced) hardware offerings. The list goes on. They forked pfSense (a good thing, the pfSense devs were being massive dicks) but seem to now be largely on "cruise control" and leveraging community goodwill.
gymbeaux 3y ago
I had an issue with OPNsense on a NUC with a USB Ethernet adapter where it would just like stop working. A reboot fixed it every time. I didn’t look much into the exact cause, I went back to DD-WRT because it’s what I know and it just works.
syntaxing 3y ago
Recently transitioned from Ubiquit stuff to a OPNSense setup. It was such a good decision. The firewall rules make much more sense. Better functions than the dream machine series. You can also get a lot more for the same price. Ubiquti hardware is very under spec for the money you pay for. Highly recommend this guide to setup your own. It’s very dense and more verbose than you need so skip the irrelevant sections. [1] https://homenetworkguy.com/how-to/set-up-a-fully-functioning-home-network-using-opnsense/ https://homenetworkguy.com/how-to/set-up-a-fully-functioning...
- philsnow 3y ago
  I’ve been thinking about swapping out my UDMP for opnsense, but keeping the ubiquiti APs, they’re the best I’ve ever known and I think they play reasonably well with non-ubiquiti stuff. Thanks for the link to the guide!
  - syntaxing 3y ago
    You can actually run the controller with a plugin too! Worked great, didn’t have any issues when I was still using my ubiquiti switches and AP.
- nvy 3y ago
  I've been looking at this as well. I'm currently running my gigabit fiber connection through a GPON-ethernet media converter and from there over Cat 6 to a ubiquiti Edgerouter-X. It does okay with hardware offloading enabled for things like ipsec and NAT, but it's taxing the CPU and I'd like to move to something with a little more headroom. Got any recommendations for something that can route beyond gigabit, when NATing and DPIing and other things?
  - abwizz 3y ago
    > Got any recommendations for something that can route beyond gigabit, when NATing and DPIing and other things? goto recommendation for the last decade is a used small formfactor enterprise desktop or a laptop. the former allows for a pcie nic and more performance while the latter usually requires a usb-eth but has a builtin keyboard and screen for debugging. just go for something x86, avoid the ultra low-end cpu's and your usually good for soho stuff.
geerlingguy 3y ago
I've just set up my first OPNsense box (using one of the 4-port 2.5 gig AliExpress tiny PCs recommended by ServeTheHome) and like it a lot. A few rough edges in the UI, but I got the basic routing functionality running within minutes, and got Wireguard going with the help of a guide from Home Network Guy pretty soon after. Since then I've bought a second box and will be setting it up soon, too!
- getcrunk 3y ago
  Do those boxes ever get bios updates? It’s something tech influencers should mention more often
  - alias_neo 3y ago
    I got a Protectli one; bit overpriced but they provide instructions to compile Coreboot. They don't just give you a fish, they teach you to fish, then it's in your hands.
  - ap-andersson 3y ago
    I personally use a router box from teklager.se and they use open source schematics and bios which are actually updated. Without having done a comparison I am assuming they are a more expensive option though. It has been small, silent and stable since I bought it pre-installed with OPNSense though, so I am happy with it.
  - numpad0 3y ago
    Why would you want BIOS updates? It’s not like firmware degrades over time. Frequency of zero day RCE fixes should not be taken as indication of better security.
    - abwizz 3y ago
      all software has bugs, most of them get found over time. no updates, means you are sure to collect known deficiencies. > Frequency of zero day RCE fixes should not be taken as indication of better security. true, but lacking an alternative metric, it's at least helpful to gauge the willingness to not ignore problems.
eminence32 3y ago
I've heard enough good things about OPNsense that I would probably pick it these days for a new installation. But I've been using pfSense happily for enough years that I'm not sure it's worth the hassle to switch, especially since I'm using Netgate hardware. Has anyone attempted to run OPNsense on Netgate hardware?
- abwizz 3y ago
  > Has anyone attempted to run OPNsense on Netgate hardware? some tried, but no one is left to tell </s>
raincom 3y ago
What kind of hardware do you use to install OPNsense? Please don't suggest to buy some old Dell optiplex from ebay. Hardware that can beat any commercial vendor, is better.
- fellowmartian 3y ago
  There’s this class of devices: https://www.servethehome.com/cheap-intel-pentium-n6005-4x-2-5gbe-fanless-firewall-and-router-review/ https://www.servethehome.com/cheap-intel-pentium-n6005-4x-2-... I have one of them, they’re great. I haven’t checked hardware support on FreeBSD as I run Linux so please do your own research.
- nick0garvey 3y ago
  You say "don't suggest to buy some old Dell Optiplex from eBay" but I did exactly this. I spent $43.97 (which included shipping) for the Optiplex, added a 2 port NIC for $16.37, and it's been running my house great since then.
  - hotpotamus 3y ago
    The main issue I see with that option is space and power, the micro-form factor (NUC-sized) clone systems that people are discussing in here are quite nice for that. Functionally an old Dell tower should be fine.
    - vladvasiliu 3y ago
      Sure, but those tend to be much more expensive, so depending on the actual cost of electricity in your area, it may take a long time for you to break even. However, if you want to have a really small appliance-like pc, then yeah, the NUC-sized ones are much better.
      - KennyBlanken 3y ago
        The low-power AMD based systems everyone recommended a couple years ago were indeed great, until the ebay resellers realized what was going on and started slapping "opnsense pfsense AES-NI" etc on their listings and doubled their prices. The systems went from selling at $40-50 to over $100. Also, the AMD processor in those systems is getting extremely long in the tooth.
vanillax 3y ago
I run OPNsense pretty much stock + unbound + adguard home. Does anyone have a security hardening guide? I feel like I must be missing a few key things to make it self-hosted ready?
- senectus1 3y ago
  As you can imagine its pretty "Hard" by default... but you should make sure you didn't turn dumb things on like WebUI/SSH acces from WAN etc.. this is a good thread on the subject https://forum.opnsense.org/index.php?topic=22117.0 https://forum.opnsense.org/index.php?topic=22117.0
shmerl 3y ago
They should switch to dhcpd from dhcp6c to avoid issues with IPv6 address not being assigned to the router itself.
- feldrim 3y ago
  It looks like the maintain a dhcp6c [0] already. Do they not use it? Edit: I checked the source and they are already utilizing it [1]. 0. https://github.com/opnsense/dhcp6c https://github.com/opnsense/dhcp6c 1. https://github.com/search?q=repo%3Aopnsense%2Fcore+dhcp6&type=code https://github.com/search?q=repo%3Aopnsense%2Fcore+dhcp6&typ...
  - shmerl 3y ago
    I think dhcp6c is the problem? FreeBSD provides a better option, but they aren't using it.
    - illiac786 3y ago
      They are planning to switch to a new dhcp client, don’t remember which ones. This was as of two months ago.
      - shmerl 3y ago
        Ah, nice. Did they give any ETA?
        illiac786 3y ago
        Unfortunately not.
cyounkins 3y ago
How well does OPNsense deal with bufferbloat in a home networking situation? It appears to implement fq_codel for traffic shaping, but not the newer cake algorithm. Test: https://www.waveform.com/tools/bufferbloat https://www.waveform.com/tools/bufferbloat
- doubleg72 3y ago
  Probably depends how you tune it, just like pfsense
- circularfoyers 3y ago
  This and the debacle with Wireguard are the two top reasons that have kept me on OpenWRT.
  - WirelessGigabit 3y ago
    Any suggestions for a WiFi 6 mesh running OpenWRT?
  - chaxor 3y ago
    Debacle with wireguard? Opnsense has wireguard easily available. Also, it's just base wireguard, so you don't have to go through any extra steps of trying to understand / trust other additions on top of it, which is very nice IMO.
    - circularfoyers 3y ago
      I'm referring to the kernel implementation of it, unless you weren't. But I think you likely are, considering it is now in the mainline FreeBSD kernel. But this took more than 2 years after it was mainlined into the Linux kernel[1], and the delay was largely was because of what happened regarding it's initial implementation[2]. That's the debacle I'm talking about. [1]: https://www.phoronix.com/news/FreeBSD-WireGuard-Lands-2022 https://www.phoronix.com/news/FreeBSD-WireGuard-Lands-2022 [2]: https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice...
digitallyfree 3y ago
If you want to take it even further a fully virtualized Opnsense with Proxmox is amazing. Your router can float between cluster nodes and each VLAN becomes a virtual interface in the hypervisor. What still blows my mind is how I can migrate the instance to a second server and bring the original server down for maintenance without my users noticing a thing.
- alias_neo 3y ago
  Got any documentation on how a setup like this might be implemented? I'm curious how the interfaces float between nodes to keep the network up. Is it relying mostly on switches for the physical connectivity, including upstream?
  - sureglymop 3y ago
    I set this up recently but with libvirt instead of proxmox. Used openvswitch and configured it with netplan.
    - alias_neo 3y ago
      I'm not super experienced with networking. Does this require BGP for the router to move between hosts? If my PON is connected into one of the nodes, how do I allow the router to roam if a node fails? Will look into openvswitch. Not really ever done virtualized networking so it doesn't immediately click for me.
      - CptKriechstrom 3y ago
        Put your PON on a separate VLAN on the switch
        alias_neo 3y ago
        Ok, It's slowly coming together. So I assume I'd then put the virtual WANs of each cluster node on the same VLAN and whichever is currently hosting the router would chat with the PON to give me a WAN link.
surfsvammel 3y ago
Been running OPNsense for about four years now, without much hiccups. It’s been more or less a set and forget system to me. I’ve been running on a small Protectli box and mainly using it for normal firewall stuff, Snort and as a Wireguard server.
cosmiccatnap 3y ago
I used to run several pfsense routers, tried various forks including opnsense and they were fine but ate quite a bit of memory and didn't have great driver support. If you are like me and just need a router solution for a homelab or small office I would recommend the x86 variant of openwrt. It uses a trickle of memory and CPU and will route anything you ask it too with or without a ton of filters and sniffers. I've never looked back.
predictabl3 3y ago
Where's the OPsense NixOS mashup at? Or is it not necessary with a sufficient NixOS config?
- voxadam 3y ago
  Does NixOS work on a FreeBSD kernel? I'm apologize if this is a dumb question; I haven't had a chance to explore Nix as of yet (it's on the list).
  - n8henrie 3y ago
    NixOS is a Linux distro based on the nix package manager. There is a freebsd package for nix, I am 90% sure. NixOS on FreeBSD seems nonsensical, like saying Ubuntu on FreeBSD.
    - voxadam 3y ago
      That's what I was thinking. The only reason that I thought Nix on FreeBSD as even remotely possessive is that, as I remember things, it's possible to run the Nix package manager on non-Nix systems.
      - VTimofeenko 3y ago
        You can run nix-the-package-manager on FreeBSD, so you can build stuff. However I think it would take a lot of novel and elegant boilerplate to have nix manage network config on a BSD system. NixOS is a Linux distribution managed by nix-the-package-manager.
macrolime 3y ago
That autoscroll on the opnsense website was extremely annoying.
lloydatkinson 3y ago
I always get confused between OPNsense and pfSense - one is the open source fork the other is the original.
- Havoc 3y ago
  Pfsense is the “original” and the more commercial minded. They’re very close though. You can follow Pfsense guides on opnaense basically
  - simondotau 3y ago
    Pfsense is, in turn, a fork of m0n0wall. It's also important to note that pretty much all of the functionality of all aforementioned firewalls is part of FreeBSD or from packages installed behind the scenes. The configuration UX is the most visible differentiator but they also have different strategies when it comes to pushing updates and testing/validation. But the actual heavy lifting of these router/firewall systems is done by code that ships with FreeBSD.
blue_cookeh 3y ago
Can wholeheartedly recommend OPNsense as an opensource firewall of choice. I run it at home, and we use it on a couple of Dell R210ii servers (4c/8GB RAM/dedicated Intel NIC) to run LAN gaming events ramping up to 1,200 active devices. Migrated from pfsense because OPNsense actually had a usable API, so we can do things like add people into the Captive Portal programatically from our event check-in system.
BLKNSLVR 3y ago
The great thing about running OPNSense in a VM on a regular x86 box is it's transferability. I'm currently upgrading my box to add an NVMe M2 SSD, so I'm moving the VM to a spare box, doing the upgrade, then moving it back. The VM itself knows nothing, no reinstall and reconfigure, minimal downtime. Easy af. Was using pfSense for a few years until a couple of years ago, upgraded to OPNSense. The plan is to keep OPNSense for much longer than a handful hardware cycles.
joshspankit 3y ago
Surprised no one has mentioned Untangle yet. $50/yr is not free like many of the other options, but it’s got a decent UI and strong featureset.
tatersolid 3y ago
This site is the worst mobile web experience I’ve ever had. It automatically scrolls itself both up and down while you are in the middle of the page reading. I am actually interested in OPNsense but I can’t actually find out if it meets my needs or if I can contribute because the website sucks so much.
atlas_hugged 3y ago
Is there any good open source solution for wifi?

As an alternative, I've been watching VyOS with great interest and it seems like they are finally going to release their controller and LocalUI interface this year, which is exciting. It seems to have a similar architecture as a Ubiquiti controller. https://blog.vyos.io/ https://blog.vyos.io/

fellowmartian 3y ago
Yeah I’m waiting for a good open source Linux-based firewall, it’s way overdue. Linux has surpassed FreeBSD in terms of networking, at least for the home/SMB router use case. I’m talking about Cake, eBPF, etc. I’m currently running Mikrotik x86 on a NUC, but their hardware support on x86 isn’t great. I’d rather switch to Vyos, but I’m too lazy to learn their CLI. Semi-related: OpenWRT is also genuinely not bad on x86, but it’s slightly too simplified compared to say Mikrotik or VyOS. It also runs great in a VM.
- n8henrie 3y ago
  Same! Have you looked into IPFire? That's the one I had my eyes on.
  - fellowmartian 3y ago
    I actually used to run it years back, but it unfortunately hasn't been updated very much since.
- hnarn 3y ago
  > Linux has surpassed FreeBSD in terms of networking Can you elaborate on this?
  - fellowmartian 3y ago
    As I said above, it's stuff like Cake, which is an advanced QoS scheduler that helps eliminate bufferbloat (very relevant for home networks). Additionally, eBPF and XDP will soon be integrated into standard firewalls, which should speed them up dramatically, allowing for crazy high speed (or power efficient) routing on commodity hardware.
- _ea1k 3y ago
  OpenWRT also runs great on ARM. Even the Raspberry Pi can work well for home use.
donmcronald 3y ago
I always wanted to try it, but $8k / year for the cheapest stable release license isn’t in my universe for affordability. > It seems to have a similar architecture as a Ubiquiti controller. That’s a hell of an insult to be tossing around for an unreleased product. Lmao.
- robcohen 3y ago
  Why’s that? I actually like the api system for Ubiquiti gear.
  - donmcronald 3y ago
    The Ubiquiti controller is fine if you're managing one site, but beyond that it's pretty poorly designed IMO. By far the biggest problem is that they don't give enough consideration to recover-ability of offsite devices. If something causes a device to disconnect from the controller their solution is to SSH in and re-adopt it. That doesn't work once you're dealing with hundreds of devices across dozens of sites. A good example of where that becomes problematic is to look at the controller hostname override setting they have. You could change it to 'unifi.invalid' and it would happily push that change out to a thousand devices and leave them in a state where you'd need to be hands on with every device to recover. If you can do it on purpose, they can do it accidentally with a buggy update, so, IMHO, there's always a risk that an update could break things pretty badly. That's not a hypothetical either. They (purposely) pushed an update that did something like that when they started supporting HTTPS for the inform URL several years ago. The second issue I have with it is more of a design issue. Sites should be somewhat sharded and I should be able to update the controller version on a per-site basis. I think that does a lot to reduce the risk of an update breaking things. I also dislike the default settings and prompts for auto-updates. I like the scheduled updates and think they're great, but the push to "update everything daily at 3:00 AM" is too much. I have a controller with 100+ sites and need to schedule updates to ensure any breakage is fixable via manual intervention up to the point of physically visiting a site. Edit: To clarify this, I'm sure I've been prompted to enable 3:00 AM auto-updates on the newer controller versions and accidentally clicking "yes" would be a huge headache for me. The "rolling update" was also pretty trashy when I tried it. That was years ago, but I think it simply updated APs sequentially and happily continued if the previous one didn't come back up. How hard is it really to implement a rolling update that stops and waits for intervention if even one device doesn't come back online? And the UI. I can't even use it without setting my browser to 80% zoom and it gets worse every time they push out an update. Everything is stuck into tiny little scrollable boxes. I have multiple 27" monitors and get stuck scrolling around in a 1" x 2" box that can't display more than 2 or 3 lines of config. Why? And then TP-Link copied them with Omahda. It's almost funny. I wonder if they even realize they're copying off the dumbest kid in the class. Lol.
synergy20 3y ago
ubiquiti indeed ran vyos underneath then improved it over the years
- robcohen 3y ago
  I think you mean Vyatta

getcrunk 3y ago

Pfense is practically no longer open source. OPNsense has come a long way and even has some features pfsense does not

donmcronald 3y ago
PfSense has some pretty bad problems relating to interfaces disappearing temporarily and services dying from it. I would go as far as saying 2.6.0 is unreliable. With PCEngines shutting down it’s almost impossible to find reliable, cost effective hardware. I hope pfSense gets back on track because their hardware seems ok.
- imiric 3y ago
  I recently moved my main router from a Netgate device running pfSense to a Deciso device running OPNsense, and couldn't be happier with the change. The Deciso hardware is pricey, but you get what you pay for. Very well built, silent, and very powerful hardware. No issues whatsoever.
nvy 3y ago
The pfsense people are, frankly, fucking clowns. They bought the domain opnsense.com and used it to badmouth the opnsense project[0]. Do not give pfsense time, attention, or money. [0] https://opnsense.org/opnsense-com/ https://opnsense.org/opnsense-com/
- alias_neo 3y ago
  I remember reading this nearer the time, but I never clicked through to see just what was on the site; having just looked at the cache, I'm appalled. That stuff goes beyond petty, to the point that whoever is behind that should not only NOT be doing business with the grown ups, they should be in a facility seriously re-evaluating their life choices. What a disgrace.
  - illiac786 3y ago
    >whoever s behind that Well, you don’t have to wonder, the owner of the domain was revealed by court action to be Jamie Thompson, one of the two founder of Netgate, which sells the commercial version of pfSense. Surprise…

LeSaucy 3y ago

OPNsense is the core router platform I default to for all my network infrastructure (work devops env, homelab, vpn to family members etc). Its feature packed and ROCK solid. I almost always run it in a virtual machine so i can live migrate it between hosts and have no downtime. The cluster / high availability works great and ensures no loss of connectivity during upgrades. OPNsense is a true hidden gem in the open source world.

syntaxing 3y ago
I did a bare metal migration and it was pretty painless. Had to reinstall some packages, but it was as simple as just hitting the + on the package manager.
- LeSaucy 3y ago
  Yes! The single file xml config export is super easy to move an install between systems (physical and virtual). There is even a plugin to manage the changes with git!
  - KennyBlanken 3y ago
    Every time I've given up on an OPNsense instance and re-installed it, importing a config backup, half the config didn't import. Maybe things are better these days.
Scramblejams 3y ago
Has there been a positive inflection in its quality recently? I tried it a while back but pretty quickly it got Unbound's config XML in a state which wouldn't allow the daemon to run. I had to get in and fix it up by hand to get it going again. Wasn't impressed with the quality it was showing me, switched to pfSense and haven't had any similar issues, so I haven't felt the need to look at OPNsense again.
KennyBlanken 3y ago
I used to find it rock solid, but around two years ago reliability tanked. I found myself regularly having issues with interfaces (a genuine Intel server-grade multi-port NIC) flip-flopping. About a year ago, I started having random issues with traffic no longer routing, out of the blue. Lately both issues seem to have gone away. Right now the software update function dies half the time I try to run a check, with a long sqlite query string / error being dumped to the console. This has been going on for at least the last couple of months worth of releases. About a year or two after install, reboots and power-offs stopped working. The system just hangs instead after printing out a message about USB, and I cannot figure out for the life of me what's wrong. It's a standard Dell SFF PC, nothing exotic, and had been working fine until a major release broke it. FreeBSD's documentation about ACPI is impenetrable, so I can't figure out what's going on. Startups and reboots used to be lightning quick, with maybe a minute or less between the bootloader kicking off loading the kernel and interfaces/routing/firewall up and it giving its happy chime. These days the system spins its wheels for ages doing...something, not sure what. I find the project pretty outdated and behind the times. The UI purposefully obtuse with terrible organization and field names and a lot of missing help text to keep their support/consulting biz strong. They're really far behind on features. There's no application blocking, monitoring/diag is rudimentary, it has extremely limited backup functions (Google Drive and that's it, I believe), and even the DNS blocklist functionality is extremely rudimentary, with only a fixed list of really trashy, unreliably lists available to pick from (one of the groups they pull lists from has demonstrated extensive issues with QA, routinely including things like certificate validation servers in their blacklists.) They've also gone out of their way to make the Adguard Home plugin annoying and confusing to get working if you want to configure it as a proxy to unbound, which is needed if you want DHCP hostname records to work (speaking of which, DHCP leases are needlessly obtuse to mange.) Their release process is wildly unsuitable for production network equipment. A 'major' release is immediately EOL'd as soon as the next major release comes out. Running 20.1 and need to stay on it because 20.2 breaks something or you want to wait for the dust to settle? Too bad. There's no security releases for older major revisions. And it wouldn't be so bad if each major release was followed by a number of "oops we fucked up...." point-point releases because their QA isn't very good. The devs are sticks in the mud, too - mostly "franco." They bitched and moaned up a storm for YEARS about wireguard being "insecure" despite no evidence to back their claims, citing that as the reason for refusing numerous requests for integration, and even refusing code contributions from the community for it. They eventually caved. The wireguard plugin is still pretty meh and difficult to navigate unless you know wireguard well. ARM support? Zero interest in even assisting community efforts, which have gotten impressively far with it, especially now that ARM support in FreeBSD got appreciably better in the last release or two. I suspect it's because they see it as a threat to their (grossly overpriced) hardware offerings. The list goes on. They forked pfSense (a good thing, the pfSense devs were being massive dicks) but seem to now be largely on "cruise control" and leveraging community goodwill.

gymbeaux 3y ago

I had an issue with OPNsense on a NUC with a USB Ethernet adapter where it would just like stop working. A reboot fixed it every time. I didn’t look much into the exact cause, I went back to DD-WRT because it’s what I know and it just works.

syntaxing 3y ago

Recently transitioned from Ubiquit stuff to a OPNSense setup. It was such a good decision. The firewall rules make much more sense. Better functions than the dream machine series. You can also get a lot more for the same price. Ubiquti hardware is very under spec for the money you pay for. Highly recommend this guide to setup your own. It’s very dense and more verbose than you need so skip the irrelevant sections. [1] https://homenetworkguy.com/how-to/set-up-a-fully-functioning-home-network-using-opnsense/ https://homenetworkguy.com/how-to/set-up-a-fully-functioning...

philsnow 3y ago
I’ve been thinking about swapping out my UDMP for opnsense, but keeping the ubiquiti APs, they’re the best I’ve ever known and I think they play reasonably well with non-ubiquiti stuff. Thanks for the link to the guide!
- syntaxing 3y ago
  You can actually run the controller with a plugin too! Worked great, didn’t have any issues when I was still using my ubiquiti switches and AP.
nvy 3y ago
I've been looking at this as well. I'm currently running my gigabit fiber connection through a GPON-ethernet media converter and from there over Cat 6 to a ubiquiti Edgerouter-X. It does okay with hardware offloading enabled for things like ipsec and NAT, but it's taxing the CPU and I'd like to move to something with a little more headroom. Got any recommendations for something that can route beyond gigabit, when NATing and DPIing and other things?
- abwizz 3y ago
  > Got any recommendations for something that can route beyond gigabit, when NATing and DPIing and other things? goto recommendation for the last decade is a used small formfactor enterprise desktop or a laptop. the former allows for a pcie nic and more performance while the latter usually requires a usb-eth but has a builtin keyboard and screen for debugging. just go for something x86, avoid the ultra low-end cpu's and your usually good for soho stuff.

geerlingguy 3y ago

I've just set up my first OPNsense box (using one of the 4-port 2.5 gig AliExpress tiny PCs recommended by ServeTheHome) and like it a lot. A few rough edges in the UI, but I got the basic routing functionality running within minutes, and got Wireguard going with the help of a guide from Home Network Guy pretty soon after. Since then I've bought a second box and will be setting it up soon, too!

getcrunk 3y ago
Do those boxes ever get bios updates? It’s something tech influencers should mention more often
- alias_neo 3y ago
  I got a Protectli one; bit overpriced but they provide instructions to compile Coreboot. They don't just give you a fish, they teach you to fish, then it's in your hands.
- ap-andersson 3y ago
  I personally use a router box from teklager.se and they use open source schematics and bios which are actually updated. Without having done a comparison I am assuming they are a more expensive option though. It has been small, silent and stable since I bought it pre-installed with OPNSense though, so I am happy with it.
- numpad0 3y ago
  Why would you want BIOS updates? It’s not like firmware degrades over time. Frequency of zero day RCE fixes should not be taken as indication of better security.
  - abwizz 3y ago
    all software has bugs, most of them get found over time. no updates, means you are sure to collect known deficiencies. > Frequency of zero day RCE fixes should not be taken as indication of better security. true, but lacking an alternative metric, it's at least helpful to gauge the willingness to not ignore problems.

eminence32 3y ago

I've heard enough good things about OPNsense that I would probably pick it these days for a new installation. But I've been using pfSense happily for enough years that I'm not sure it's worth the hassle to switch, especially since I'm using Netgate hardware. Has anyone attempted to run OPNsense on Netgate hardware?

abwizz 3y ago
> Has anyone attempted to run OPNsense on Netgate hardware? some tried, but no one is left to tell </s>

raincom 3y ago

What kind of hardware do you use to install OPNsense? Please don't suggest to buy some old Dell optiplex from ebay. Hardware that can beat any commercial vendor, is better.

fellowmartian 3y ago
There’s this class of devices: https://www.servethehome.com/cheap-intel-pentium-n6005-4x-2-5gbe-fanless-firewall-and-router-review/ https://www.servethehome.com/cheap-intel-pentium-n6005-4x-2-... I have one of them, they’re great. I haven’t checked hardware support on FreeBSD as I run Linux so please do your own research.
nick0garvey 3y ago
You say "don't suggest to buy some old Dell Optiplex from eBay" but I did exactly this. I spent $43.97 (which included shipping) for the Optiplex, added a 2 port NIC for $16.37, and it's been running my house great since then.
- hotpotamus 3y ago
  The main issue I see with that option is space and power, the micro-form factor (NUC-sized) clone systems that people are discussing in here are quite nice for that. Functionally an old Dell tower should be fine.
  - vladvasiliu 3y ago
    Sure, but those tend to be much more expensive, so depending on the actual cost of electricity in your area, it may take a long time for you to break even. However, if you want to have a really small appliance-like pc, then yeah, the NUC-sized ones are much better.
    - KennyBlanken 3y ago
      The low-power AMD based systems everyone recommended a couple years ago were indeed great, until the ebay resellers realized what was going on and started slapping "opnsense pfsense AES-NI" etc on their listings and doubled their prices. The systems went from selling at $40-50 to over $100. Also, the AMD processor in those systems is getting extremely long in the tooth.

vanillax 3y ago

I run OPNsense pretty much stock + unbound + adguard home. Does anyone have a security hardening guide? I feel like I must be missing a few key things to make it self-hosted ready?

senectus1 3y ago
As you can imagine its pretty "Hard" by default... but you should make sure you didn't turn dumb things on like WebUI/SSH acces from WAN etc.. this is a good thread on the subject https://forum.opnsense.org/index.php?topic=22117.0 https://forum.opnsense.org/index.php?topic=22117.0

shmerl 3y ago

They should switch to dhcpd from dhcp6c to avoid issues with IPv6 address not being assigned to the router itself.

feldrim 3y ago
It looks like the maintain a dhcp6c [0] already. Do they not use it? Edit: I checked the source and they are already utilizing it [1]. 0. https://github.com/opnsense/dhcp6c https://github.com/opnsense/dhcp6c 1. https://github.com/search?q=repo%3Aopnsense%2Fcore+dhcp6&type=code https://github.com/search?q=repo%3Aopnsense%2Fcore+dhcp6&typ...
- shmerl 3y ago
  I think dhcp6c is the problem? FreeBSD provides a better option, but they aren't using it.
  - illiac786 3y ago
    They are planning to switch to a new dhcp client, don’t remember which ones. This was as of two months ago.
    - shmerl 3y ago
      Ah, nice. Did they give any ETA?
      - illiac786 3y ago
        Unfortunately not.

cyounkins 3y ago

How well does OPNsense deal with bufferbloat in a home networking situation? It appears to implement fq_codel for traffic shaping, but not the newer cake algorithm. Test: https://www.waveform.com/tools/bufferbloat https://www.waveform.com/tools/bufferbloat

doubleg72 3y ago
Probably depends how you tune it, just like pfsense
circularfoyers 3y ago
This and the debacle with Wireguard are the two top reasons that have kept me on OpenWRT.
- WirelessGigabit 3y ago
  Any suggestions for a WiFi 6 mesh running OpenWRT?
- chaxor 3y ago
  Debacle with wireguard? Opnsense has wireguard easily available. Also, it's just base wireguard, so you don't have to go through any extra steps of trying to understand / trust other additions on top of it, which is very nice IMO.
  - circularfoyers 3y ago
    I'm referring to the kernel implementation of it, unless you weren't. But I think you likely are, considering it is now in the mainline FreeBSD kernel. But this took more than 2 years after it was mainlined into the Linux kernel[1], and the delay was largely was because of what happened regarding it's initial implementation[2]. That's the debacle I'm talking about. [1]: https://www.phoronix.com/news/FreeBSD-WireGuard-Lands-2022 https://www.phoronix.com/news/FreeBSD-WireGuard-Lands-2022 [2]: https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice...

digitallyfree 3y ago

If you want to take it even further a fully virtualized Opnsense with Proxmox is amazing. Your router can float between cluster nodes and each VLAN becomes a virtual interface in the hypervisor. What still blows my mind is how I can migrate the instance to a second server and bring the original server down for maintenance without my users noticing a thing.

alias_neo 3y ago
Got any documentation on how a setup like this might be implemented? I'm curious how the interfaces float between nodes to keep the network up. Is it relying mostly on switches for the physical connectivity, including upstream?
- sureglymop 3y ago
  I set this up recently but with libvirt instead of proxmox. Used openvswitch and configured it with netplan.
  - alias_neo 3y ago
    I'm not super experienced with networking. Does this require BGP for the router to move between hosts? If my PON is connected into one of the nodes, how do I allow the router to roam if a node fails? Will look into openvswitch. Not really ever done virtualized networking so it doesn't immediately click for me.
    - CptKriechstrom 3y ago
      Put your PON on a separate VLAN on the switch
      - alias_neo 3y ago
        Ok, It's slowly coming together. So I assume I'd then put the virtual WANs of each cluster node on the same VLAN and whichever is currently hosting the router would chat with the PON to give me a WAN link.

surfsvammel 3y ago

Been running OPNsense for about four years now, without much hiccups. It’s been more or less a set and forget system to me. I’ve been running on a small Protectli box and mainly using it for normal firewall stuff, Snort and as a Wireguard server.

cosmiccatnap 3y ago

I used to run several pfsense routers, tried various forks including opnsense and they were fine but ate quite a bit of memory and didn't have great driver support. If you are like me and just need a router solution for a homelab or small office I would recommend the x86 variant of openwrt. It uses a trickle of memory and CPU and will route anything you ask it too with or without a ton of filters and sniffers. I've never looked back.

predictabl3 3y ago

Where's the OPsense NixOS mashup at? Or is it not necessary with a sufficient NixOS config?

voxadam 3y ago
Does NixOS work on a FreeBSD kernel? I'm apologize if this is a dumb question; I haven't had a chance to explore Nix as of yet (it's on the list).
- n8henrie 3y ago
  NixOS is a Linux distro based on the nix package manager. There is a freebsd package for nix, I am 90% sure. NixOS on FreeBSD seems nonsensical, like saying Ubuntu on FreeBSD.
  - voxadam 3y ago
    That's what I was thinking. The only reason that I thought Nix on FreeBSD as even remotely possessive is that, as I remember things, it's possible to run the Nix package manager on non-Nix systems.
    - VTimofeenko 3y ago
      You can run nix-the-package-manager on FreeBSD, so you can build stuff. However I think it would take a lot of novel and elegant boilerplate to have nix manage network config on a BSD system. NixOS is a Linux distribution managed by nix-the-package-manager.

macrolime 3y ago

That autoscroll on the opnsense website was extremely annoying.

lloydatkinson 3y ago

I always get confused between OPNsense and pfSense - one is the open source fork the other is the original.

Havoc 3y ago
Pfsense is the “original” and the more commercial minded. They’re very close though. You can follow Pfsense guides on opnaense basically
- simondotau 3y ago
  Pfsense is, in turn, a fork of m0n0wall. It's also important to note that pretty much all of the functionality of all aforementioned firewalls is part of FreeBSD or from packages installed behind the scenes. The configuration UX is the most visible differentiator but they also have different strategies when it comes to pushing updates and testing/validation. But the actual heavy lifting of these router/firewall systems is done by code that ships with FreeBSD.

blue_cookeh 3y ago

Can wholeheartedly recommend OPNsense as an opensource firewall of choice. I run it at home, and we use it on a couple of Dell R210ii servers (4c/8GB RAM/dedicated Intel NIC) to run LAN gaming events ramping up to 1,200 active devices. Migrated from pfsense because OPNsense actually had a usable API, so we can do things like add people into the Captive Portal programatically from our event check-in system.

BLKNSLVR 3y ago

The great thing about running OPNSense in a VM on a regular x86 box is it's transferability. I'm currently upgrading my box to add an NVMe M2 SSD, so I'm moving the VM to a spare box, doing the upgrade, then moving it back. The VM itself knows nothing, no reinstall and reconfigure, minimal downtime. Easy af. Was using pfSense for a few years until a couple of years ago, upgraded to OPNSense. The plan is to keep OPNSense for much longer than a handful hardware cycles.

joshspankit 3y ago

Surprised no one has mentioned Untangle yet. $50/yr is not free like many of the other options, but it’s got a decent UI and strong featureset.

tatersolid 3y ago

This site is the worst mobile web experience I’ve ever had. It automatically scrolls itself both up and down while you are in the middle of the page reading. I am actually interested in OPNsense but I can’t actually find out if it meets my needs or if I can contribute because the website sucks so much.

atlas_hugged 3y ago

Is there any good open source solution for wifi?