3 ms·

I'm the other way, I find IPTables less intuitive and featureful than PF. The way Netfilter/IPTables works under the hood seems much more over-complicated[1] th

I'm the other way, I find IPTables less intuitive and featureful than PF. The way Netfilter/IPTables works under the hood seems much more over-complicated[1] than it needs to be (which is how I feel about a lot of Linux system stuff these days). The architecture of PF[2] (and thus how the rules get processed) just makes more sense to me. pfSense/OPNsense is just a stripped-down FreeBSD under the hood. If there are things that you want it to do that you can't with the base install, you can look into installing FreeBSD packages.[3][4] I personally just use vanilla OpenBSD for most edge router/firewall tasks and then if I need mesh wifi or some modern gear that is not well supported, I just delegate the BSD box to run a strong PF firewall (which is what pfSense uses) in front of it all. Ubiquiti mesh wifi and RTSP stream play really nicely with it. It's so easy to overcomplicate a routing setup which is probably why these off-the-shelf solutions are so popular, but I agree, I prefer to have less of a magic box approach to routing/firewalls whenever possible. [1]: https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilte... [2]: https://mailing.openbsd.misc.narkive.com/jtIB9W3w/pf-packet-flow-diagram:i.2.1.full https://mailing.openbsd.misc.narkive.com/jtIB9W3w/pf-packet-... [3]: https://docs.netgate.com/pfsense/en/latest/recipes/freebsd-pkg-repo.html https://docs.netgate.com/pfsense/en/latest/recipes/freebsd-p... [4]: https://forum.opnsense.org/index.php?topic=21739.0 https://forum.opnsense.org/index.php?topic=21739.0

kjs3 3y ago
I use exactly the same thing after I got tired of pfSense: straight OpenBSD, PF, unbound, and a couple of other native obsd things (starting to play with OpenBGPD for AS level filtering) on NUC-alikes (currently liking Protectli and Seeed). No pretty web interface, but the documentation is so good it was pretty trivial to set up. This has worked really well for several years now. Note: like vogon said above, it's easy to overcomplicate things like this. If you go this route, start with the most basic configuration that works, and only go looking for 'tuning' or 'optimizing' if you run into a specific issue and can measure before-and-after improvements. Obsd does a very good job of working correctly out of the box, and if you follow the advice of some 'popular' PF tuning sites, you'll end up with tons of stuff you probably don't need, probably will interact in weird ways and will get you laughed at when you go looking for help. KISS. One caveat: Don't expect to go to the obsd mailing lists or IRC channels for beginner support.
alias_neo 3y ago
I definitely believe PF/Netfilter is the way forward, I just don't have the experience with it yet. I'd love to build a BSD based router/firewall in a declarative manner/source controlled configuration on top of a vanilla OS, I just don't have the time (specifically network downtime for the home, family) to play with it. I like graphs and charts, but otherwise not a massive fine of GUIs that hide functionality and complexity, would rather know/understand exactly what's going on at the CLI. Thanks for the links, no time like the present to learn more!

kjs3 3y ago

I use exactly the same thing after I got tired of pfSense: straight OpenBSD, PF, unbound, and a couple of other native obsd things (starting to play with OpenBGPD for AS level filtering) on NUC-alikes (currently liking Protectli and Seeed). No pretty web interface, but the documentation is so good it was pretty trivial to set up. This has worked really well for several years now. Note: like vogon said above, it's easy to overcomplicate things like this. If you go this route, start with the most basic configuration that works, and only go looking for 'tuning' or 'optimizing' if you run into a specific issue and can measure before-and-after improvements. Obsd does a very good job of working correctly out of the box, and if you follow the advice of some 'popular' PF tuning sites, you'll end up with tons of stuff you probably don't need, probably will interact in weird ways and will get you laughed at when you go looking for help. KISS. One caveat: Don't expect to go to the obsd mailing lists or IRC channels for beginner support.

alias_neo 3y ago

I definitely believe PF/Netfilter is the way forward, I just don't have the experience with it yet. I'd love to build a BSD based router/firewall in a declarative manner/source controlled configuration on top of a vanilla OS, I just don't have the time (specifically network downtime for the home, family) to play with it. I like graphs and charts, but otherwise not a massive fine of GUIs that hide functionality and complexity, would rather know/understand exactly what's going on at the CLI. Thanks for the links, no time like the present to learn more!