3 ms·

not just die, it allows you to run scheduled updates without interrupting service. I can update our gateways during the day without folks complaining. It's bee

not just die, it allows you to run scheduled updates without interrupting service. I can update our gateways during the day without folks complaining. It's been a feature of pfsense for many years (the smart kids have moved onto opensense now though)

justsomehnguy 3y ago
> the smart kids have moved onto opensense now though Sadly OPNsense is just another highly opinionated mess, just like pfSense now. The are things what are done better in OPNsense but overall the UI is worse than atrocious. I'm trying to use it for more than 3 years, but as soon as I need something more than a very basic ruleset - things go south.
- kjs3 3y ago
  Agreed. Personally, what {pf,open}sense add aren't worth not just running pf/pfsync/carp on straight OpenBSD. Yes...no flashy GUI, but it's all well documented.
  - justsomehnguy 3y ago
    Well, the thing is what I like what they have WebGUI, especially if I'm not the only one who would use it. But it's almost amusing on how they both overcomplicate the things, instead of (at least) giving me a checkmark to stop being 'user-friendly'. The lack of necessities (eg pre-populated RFC1918 networks in the aliases, or extreamly common things, like AD ports list) or a 'session' view which defaults to seven states in OPNsense is just an icing on the top. ADD: forgot, those stupid CSS animations in OPN. Not only they are stupid and slow, I'm almost never access the WebGUI directly, so I'm forced to watch every frame to be sent on the net. It's like they are never ever dogfooding their own products, except their local, small labs. ADD2: I hated ISA Server with a passion, for it being an overcomplicated mess. But 20 years later I would gave my month supply of pumpkin latte to just have an easy way to work with network groups and high level network abstractions.
    - kjs3 3y ago
      Well, yeah...you made my point. I'll take a well documented, easy to work with and reason about, easy to debug, text configuration over a crappy GUI any day of the week.
      - gonzo 3y ago
        You and me both, but we’re not the audience for pfSense.
      - woleium 3y ago
        incidentally why I like proxmox. it's the best of both worlds.
gonzo 3y ago
And Netgate contributes a ton to pf (and other subsystems) on FreeBSD. https://github.com/freebsd/freebsd-src/commits/main/sys/netpfil/pf https://github.com/freebsd/freebsd-src/commits/main/sys/netp... Does OPNsense?
- inferiorhuman 3y ago
  Netgate has a history of being a bad actor. Not just with the botched Wireguard release, but generally being dicks to the opnsense crew. e.g. https://old.reddit.com/r/homelab/comments/ssk8zj/til_in_2017_pfsense_netgate_had_to_hand_over/ https://old.reddit.com/r/homelab/comments/ssk8zj/til_in_2017...
  - woleium 3y ago
    Yep, that is what caused the opensense fork

justsomehnguy 3y ago

> the smart kids have moved onto opensense now though Sadly OPNsense is just another highly opinionated mess, just like pfSense now. The are things what are done better in OPNsense but overall the UI is worse than atrocious. I'm trying to use it for more than 3 years, but as soon as I need something more than a very basic ruleset - things go south.

kjs3 3y ago
Agreed. Personally, what {pf,open}sense add aren't worth not just running pf/pfsync/carp on straight OpenBSD. Yes...no flashy GUI, but it's all well documented.
- justsomehnguy 3y ago
  Well, the thing is what I like what they have WebGUI, especially if I'm not the only one who would use it. But it's almost amusing on how they both overcomplicate the things, instead of (at least) giving me a checkmark to stop being 'user-friendly'. The lack of necessities (eg pre-populated RFC1918 networks in the aliases, or extreamly common things, like AD ports list) or a 'session' view which defaults to seven states in OPNsense is just an icing on the top. ADD: forgot, those stupid CSS animations in OPN. Not only they are stupid and slow, I'm almost never access the WebGUI directly, so I'm forced to watch every frame to be sent on the net. It's like they are never ever dogfooding their own products, except their local, small labs. ADD2: I hated ISA Server with a passion, for it being an overcomplicated mess. But 20 years later I would gave my month supply of pumpkin latte to just have an easy way to work with network groups and high level network abstractions.
  - kjs3 3y ago
    Well, yeah...you made my point. I'll take a well documented, easy to work with and reason about, easy to debug, text configuration over a crappy GUI any day of the week.
    - gonzo 3y ago
      You and me both, but we’re not the audience for pfSense.
    - woleium 3y ago
      incidentally why I like proxmox. it's the best of both worlds.

gonzo 3y ago

And Netgate contributes a ton to pf (and other subsystems) on FreeBSD. https://github.com/freebsd/freebsd-src/commits/main/sys/netpfil/pf https://github.com/freebsd/freebsd-src/commits/main/sys/netp... Does OPNsense?

inferiorhuman 3y ago
Netgate has a history of being a bad actor. Not just with the botched Wireguard release, but generally being dicks to the opnsense crew. e.g. https://old.reddit.com/r/homelab/comments/ssk8zj/til_in_2017_pfsense_netgate_had_to_hand_over/ https://old.reddit.com/r/homelab/comments/ssk8zj/til_in_2017...
- woleium 3y ago
  Yep, that is what caused the opensense fork