3 ms·

I migrated to OPNsense during the wireguard fiasco. It was an extremely boring migration, and I mean that as compliment. It's been quietly doing its job ever s

I migrated to OPNsense during the wireguard fiasco. It was an extremely boring migration, and I mean that as compliment. It's been quietly doing its job ever since, with a minimum of fuss.

geek_at 3y ago
I have thought about moving from pfsense to opnsense but in my test install I had a feeling it has fewer features (and messy UI). For example something I use pretty heavily is pfblocker that automatically geo-blocks ips from different countries that most attack my homelab (Russia, USA, china ,etc..) from accessing my homelab Is there something like this on opnsense?
- alias_neo 3y ago
  This is important for me too. From my searching, they have "GeoIP aliases" which is supposed to be their alternative to PfBlocker-NG; I have no idea if/how it functions as I haven't made the mode yet, but this is a deal breaker if it doesn't work the way I need.
  - BLKNSLVR 3y ago
    It works as far as I can tell. I use it, and the logs show that it blocks connections to and from IP addresses associated with the selected countries.
    - alias_neo 3y ago
      Excellent, thanks for the confirmation.
- LeoPanthera 3y ago
  OPNsense supports blocklists in Unbound: https://docs.opnsense.org/manual/unbound.html#blocklists https://docs.opnsense.org/manual/unbound.html#blocklists However what you're saying doesn't make any sense. All incoming connections, from anywhere, are blocked by default. That's true in both pfSense and OPNsense. Are you saying that you allow all incoming connections, but then block specific countries? Because that's mad, and given the existence of VPNs, pointless.
  - alias_neo 3y ago
    No, there is a feature in Pfsense with Pf-Blocker-NG where you can open a port to a service as usual, say a web-server, then use an alias for the source address to only allow incoming connections from, say, your own country. Useful for if you're roaming around and need access to that service from your laptop/mobile without a VPN, but also prevents attacks from countries you're unlikely to access it from.
- fostware 3y ago
  Aliases can consist of one or more countries (tick boxes) pulled from MaxMind's GeoIP DB. Doesn't use ASN-based sources unfortunately. Can be used in source and destination networks, IPv4&/IPv6 , just like pfSense.
- BLKNSLVR 3y ago
  I use it on OPNSense and it seems to work fine. There may be a Megamind (edit: MaxMind, not Megamind) account plugin setup out something to get it going, but if I worked it out, then you should be right. I use it to flat out block all incoming and outgoing connections to a certain small group of countries. More out of curiosity than necessity. It's also got a Crowdstrike interface for more dynamic blocking.
alias_neo 3y ago
Got any tips for the migration? I've been meaning to do it for a while, but I really need to limit down time or my wife and kids will bury me; preferably need to do it over an evening while they're all asleep. I only have the one piece of hardware so I need a record of the configs somehow to refer to as I do the migration. Perhaps also some sort of backup so I can restore it in a pinch if I can't get OPNSense set up quick enough.
- LeoPanthera 3y ago
  I'm afraid I did it the slow way, and just nuked the router and set up OPNSense from scratch. In older versions it was possible to import a PfSense backup - with a few glitches, but they're too different now. I think the slow way is the only way.
  - alias_neo 3y ago
    That's kind of what I was expecting; but do you have any tips? Did you just do it from memory? I was thinking I'll screenshot the major config screens and interface layouts, my BGP configs etc, then work from them.
    - Brian-Puccio 3y ago
      Yes, screenshot things. But also export your config because you will inevitably forget to screenshot a thing or seven and you can poke around the config export for that port number or IP address. Worst case scenario, you can spin up a VM of pfsense quickly and reimport the config if you have to.
      - alias_neo 3y ago
        I have off-box backups of my configs. Thanks for the VM idea; sometimes I forget to use VMs to do things "embedded" devices usually do for me; switches, routers, etc! There's going to be a point soon where I have two fiber providers (and thus two WAN links) for a little while, I'll try move the existing pfSense off of my Protectli box to a VM, keep everything up for the family while I configure OPNSense on the Protectli, then if I do it right, I can move everything over with minimal reconfiguration.
sschueller 3y ago
I did as well and started running it in a vm. It is so nice to just make a snapshot, update and revert if it breaks.

I migrated to OPNsense during the wireguard fiasco. It was an extremely boring migration, and I mean that as compliment. It's been quietly doing its job ever since, with a minimum of fuss.

geek_at 3y ago

I have thought about moving from pfsense to opnsense but in my test install I had a feeling it has fewer features (and messy UI). For example something I use pretty heavily is pfblocker that automatically geo-blocks ips from different countries that most attack my homelab (Russia, USA, china ,etc..) from accessing my homelab Is there something like this on opnsense?

alias_neo 3y ago
This is important for me too. From my searching, they have "GeoIP aliases" which is supposed to be their alternative to PfBlocker-NG; I have no idea if/how it functions as I haven't made the mode yet, but this is a deal breaker if it doesn't work the way I need.
- BLKNSLVR 3y ago
  It works as far as I can tell. I use it, and the logs show that it blocks connections to and from IP addresses associated with the selected countries.
  - alias_neo 3y ago
    Excellent, thanks for the confirmation.
LeoPanthera 3y ago
OPNsense supports blocklists in Unbound: https://docs.opnsense.org/manual/unbound.html#blocklists https://docs.opnsense.org/manual/unbound.html#blocklists However what you're saying doesn't make any sense. All incoming connections, from anywhere, are blocked by default. That's true in both pfSense and OPNsense. Are you saying that you allow all incoming connections, but then block specific countries? Because that's mad, and given the existence of VPNs, pointless.
- alias_neo 3y ago
  No, there is a feature in Pfsense with Pf-Blocker-NG where you can open a port to a service as usual, say a web-server, then use an alias for the source address to only allow incoming connections from, say, your own country. Useful for if you're roaming around and need access to that service from your laptop/mobile without a VPN, but also prevents attacks from countries you're unlikely to access it from.
fostware 3y ago
Aliases can consist of one or more countries (tick boxes) pulled from MaxMind's GeoIP DB. Doesn't use ASN-based sources unfortunately. Can be used in source and destination networks, IPv4&/IPv6 , just like pfSense.
BLKNSLVR 3y ago
I use it on OPNSense and it seems to work fine. There may be a Megamind (edit: MaxMind, not Megamind) account plugin setup out something to get it going, but if I worked it out, then you should be right. I use it to flat out block all incoming and outgoing connections to a certain small group of countries. More out of curiosity than necessity. It's also got a Crowdstrike interface for more dynamic blocking.

alias_neo 3y ago

Got any tips for the migration? I've been meaning to do it for a while, but I really need to limit down time or my wife and kids will bury me; preferably need to do it over an evening while they're all asleep. I only have the one piece of hardware so I need a record of the configs somehow to refer to as I do the migration. Perhaps also some sort of backup so I can restore it in a pinch if I can't get OPNSense set up quick enough.

LeoPanthera 3y ago
I'm afraid I did it the slow way, and just nuked the router and set up OPNSense from scratch. In older versions it was possible to import a PfSense backup - with a few glitches, but they're too different now. I think the slow way is the only way.
- alias_neo 3y ago
  That's kind of what I was expecting; but do you have any tips? Did you just do it from memory? I was thinking I'll screenshot the major config screens and interface layouts, my BGP configs etc, then work from them.
  - Brian-Puccio 3y ago
    Yes, screenshot things. But also export your config because you will inevitably forget to screenshot a thing or seven and you can poke around the config export for that port number or IP address. Worst case scenario, you can spin up a VM of pfsense quickly and reimport the config if you have to.
    - alias_neo 3y ago
      I have off-box backups of my configs. Thanks for the VM idea; sometimes I forget to use VMs to do things "embedded" devices usually do for me; switches, routers, etc! There's going to be a point soon where I have two fiber providers (and thus two WAN links) for a little while, I'll try move the existing pfSense off of my Protectli box to a VM, keep everything up for the family while I configure OPNSense on the Protectli, then if I do it right, I can move everything over with minimal reconfiguration.

sschueller 3y ago

I did as well and started running it in a vm. It is so nice to just make a snapshot, update and revert if it breaks.