4 ms·

I’ve been using OpnSense/pfsense [0] for years and would highly recommend it. It has a great automatic update experience, config backups, builtin wireguard tunn

I’ve been using OpnSense/pfsense [0] for years and would highly recommend it. It has a great automatic update experience, config backups, builtin wireguard tunnels and advanced features like packet filtering options via suricata. When I am doing network management on my weekends, I’m so glad I’m not stuck in the Linux terminal learning about networking internals and can instead just go to a webui and configure my router. 0: https://opnsense.org/ https://opnsense.org/

globular-toast 6mo ago
Yep, this is the way. You will learn loads using Linux but this is not something you want to go wrong. I used a lower power Intel Atom mini PC with an additional NIC as a router for years. I tested it and found it could route around 300Mb/s which was plenty. But then I got gigabit internet. So I bought an Intel 4 port GigE card from eBay and now run OPNSense as a VM. If you get the right Intel card you can pass through ports to VM individually, which is nice for playing (don't know the exact details but look for cards with virtualisation support, mine is an 82575GB I think). To be fair, my setup still probably has too much to go wrong, due to the VM thing, but I just haven't got round to getting dedicated hardware, and it's worked fine for a couple of years now.
jasonjayr 6mo ago
I agree on principal, but I often find that the GUI abstractions don't always map to the linux tooling/terminology/concepts, which often ends with a head bashing against the wall thinking "this is linux, I know it can do it, and I can do it by hand, but what is this GUI trying to conceptualize?!?!" I was recently introduced to a Barracuda router, and bashed my head against the wall long enough to discover it had an ssh interface, and linux userland, and was able to solve my immediate problem by directly entering the commands to get it to [temporarily] do what I needed. (Of course, using the GUI to reapply settings wiped my manual configuration...) I've used pfsense, OpenWRT, Barracuda, Verizon's OEM router (Actiontec) and they all represent the same functionality wildly differently.
- ZenoArrow 6mo ago
  > I've used pfsense, OpenWRT, Barracuda, Verizon's OEM router (Actiontec) and they all represent the same functionality wildly differently. Worth noting that pfSense (and OPNsense) are not Linux-based, they're based on BSD, specifically FreeBSD. While it's possible to have standard router OS web UIs that are cross platform, the underlying technology is different, so it's not really a surprise that there will be differences in how the devices running these OSes are configured.
  - lstodd 6mo ago
    Not much different. FreeBSD's pf is a port of OpenBSD's pf, and nftables are heavily influenced by them. At this point I rather doubt the sanity of people still sticking to iptables tbh. So there is approximately one concept of "packet filter done right". UI madness is on UI authors.
    - radlad 6mo ago
      The primary reason I stick to iptables instead of nft is that I already learned iptables decades ago, and some software I interact with still defaults to iptables and/or does not have full support for nft. Why do you doubt the sanity of people sticking to iptables? What makes nft compelling?
      - 0xCMP 6mo ago
        My main reason is that nft applies configs atomically. It also has very good tracing/debugging features for figuring out how and why things aren't working as expected. That said, I think many distros are shipping `iptables` as the wrapper/compatibility layer over nft now anyways.
        znpy 6mo ago
        as somebody that's not a network engineer by day and has barely grokked iptables, could you recommend some resources for learning nftables ?
stavros 6mo ago
I'm at a stage where I don't want to be doing network management on my weekends. I have a Ubiquiti router that's pretty good, and for my router I'd like something like TrueNAS for my NAS, a distribution that completely turns the hardware into an appliance I can configure once and forget about. Is there something like that?
- VorpalWay 6mo ago
  Pfsense/opnsense would be one option (based on FreeBSD). For Linux there is OpenWRT, which you can either run as an alternative firmware on quite a few consumer routers/access points, or install on a PC or Pi or similar. Caveat: I have only used OpenWRT on a high end consumer router (GL.inet MT6000) out of those. That works well, anything else is based on reading about people using those options. For all of those, once you set it up you don't really need to do much except install updates a couple of times per year, or if you want to forward a new port or such.
  - stavros 6mo ago
    Nice, thanks! I had an OpenWRT router back in the day, but it had no Web interface. I'll try OPNsense, thanks.
    - ndsipa_pomu 6mo ago
      OpenWRT has the LuCI web interface you can add to it (often included in installs) which lets you do pretty much everything.
StillBored 6mo ago
I recently dumped opnsense because they took a stand against a few things I was trying to do (ex, webUI on wan port IIRC) which make sense at a high level. But I _HATE_ devices that think they know better than me. I was trying to configure it on a _LAN_ such that the identified WAN side was actually my local lan, and I spent an hour hacking it to work and was like "you know if they can't get this shit right i'm out". There are a lot of places in the technology world where someone who thinks they understand my use case makes a decision based on some narrow world view because they can't understand that not everyone trying to use their product is some idiot home user using it for their home network.
- deadlocked 6mo ago
  I've been a fan of opnSense for a few years now - I'm actually using it as the WAN device for our office, as well as a VPN concentrator in other contexts. Some recent changes are driving me up the wall though - their new UIs for configuring VPNs (IPSEC and OpenVPN) are far less intuitive than what they've termed the 'legacy' UI and I note that recent versions have introduced a firewall rule migration feature that I'm not touching with a 9-ft barge pole. These changes are making me wary about using opnSense in future, which is a pity because other than pfSense there isn't really a fully-featured, open-source firewall OS that comes close to matching it (and pfSense has its own issues). Linux is great and all - and I do use it for routing/firewall/VPN in places on our network - but there doesn't seem to be a dedicated network appliance distro that bundles in a comprehensive Web UI. Apart from OpenWRT and its ilk, but I'm not convinced that that's suitable for enterprise deployment.
Gud 6mo ago
FreeBSD is extremely straight forward to configure as a network gateway.

globular-toast 6mo ago

Yep, this is the way. You will learn loads using Linux but this is not something you want to go wrong. I used a lower power Intel Atom mini PC with an additional NIC as a router for years. I tested it and found it could route around 300Mb/s which was plenty. But then I got gigabit internet. So I bought an Intel 4 port GigE card from eBay and now run OPNSense as a VM. If you get the right Intel card you can pass through ports to VM individually, which is nice for playing (don't know the exact details but look for cards with virtualisation support, mine is an 82575GB I think). To be fair, my setup still probably has too much to go wrong, due to the VM thing, but I just haven't got round to getting dedicated hardware, and it's worked fine for a couple of years now.

jasonjayr 6mo ago

I agree on principal, but I often find that the GUI abstractions don't always map to the linux tooling/terminology/concepts, which often ends with a head bashing against the wall thinking "this is linux, I know it can do it, and I can do it by hand, but what is this GUI trying to conceptualize?!?!" I was recently introduced to a Barracuda router, and bashed my head against the wall long enough to discover it had an ssh interface, and linux userland, and was able to solve my immediate problem by directly entering the commands to get it to [temporarily] do what I needed. (Of course, using the GUI to reapply settings wiped my manual configuration...) I've used pfsense, OpenWRT, Barracuda, Verizon's OEM router (Actiontec) and they all represent the same functionality wildly differently.

ZenoArrow 6mo ago
> I've used pfsense, OpenWRT, Barracuda, Verizon's OEM router (Actiontec) and they all represent the same functionality wildly differently. Worth noting that pfSense (and OPNsense) are not Linux-based, they're based on BSD, specifically FreeBSD. While it's possible to have standard router OS web UIs that are cross platform, the underlying technology is different, so it's not really a surprise that there will be differences in how the devices running these OSes are configured.
- lstodd 6mo ago
  Not much different. FreeBSD's pf is a port of OpenBSD's pf, and nftables are heavily influenced by them. At this point I rather doubt the sanity of people still sticking to iptables tbh. So there is approximately one concept of "packet filter done right". UI madness is on UI authors.
  - radlad 6mo ago
    The primary reason I stick to iptables instead of nft is that I already learned iptables decades ago, and some software I interact with still defaults to iptables and/or does not have full support for nft. Why do you doubt the sanity of people sticking to iptables? What makes nft compelling?
    - 0xCMP 6mo ago
      My main reason is that nft applies configs atomically. It also has very good tracing/debugging features for figuring out how and why things aren't working as expected. That said, I think many distros are shipping `iptables` as the wrapper/compatibility layer over nft now anyways.
      - znpy 6mo ago
        as somebody that's not a network engineer by day and has barely grokked iptables, could you recommend some resources for learning nftables ?

stavros 6mo ago

I'm at a stage where I don't want to be doing network management on my weekends. I have a Ubiquiti router that's pretty good, and for my router I'd like something like TrueNAS for my NAS, a distribution that completely turns the hardware into an appliance I can configure once and forget about. Is there something like that?

VorpalWay 6mo ago
Pfsense/opnsense would be one option (based on FreeBSD). For Linux there is OpenWRT, which you can either run as an alternative firmware on quite a few consumer routers/access points, or install on a PC or Pi or similar. Caveat: I have only used OpenWRT on a high end consumer router (GL.inet MT6000) out of those. That works well, anything else is based on reading about people using those options. For all of those, once you set it up you don't really need to do much except install updates a couple of times per year, or if you want to forward a new port or such.
- stavros 6mo ago
  Nice, thanks! I had an OpenWRT router back in the day, but it had no Web interface. I'll try OPNsense, thanks.
  - ndsipa_pomu 6mo ago
    OpenWRT has the LuCI web interface you can add to it (often included in installs) which lets you do pretty much everything.

StillBored 6mo ago

I recently dumped opnsense because they took a stand against a few things I was trying to do (ex, webUI on wan port IIRC) which make sense at a high level. But I _HATE_ devices that think they know better than me. I was trying to configure it on a _LAN_ such that the identified WAN side was actually my local lan, and I spent an hour hacking it to work and was like "you know if they can't get this shit right i'm out". There are a lot of places in the technology world where someone who thinks they understand my use case makes a decision based on some narrow world view because they can't understand that not everyone trying to use their product is some idiot home user using it for their home network.

deadlocked 6mo ago
I've been a fan of opnSense for a few years now - I'm actually using it as the WAN device for our office, as well as a VPN concentrator in other contexts. Some recent changes are driving me up the wall though - their new UIs for configuring VPNs (IPSEC and OpenVPN) are far less intuitive than what they've termed the 'legacy' UI and I note that recent versions have introduced a firewall rule migration feature that I'm not touching with a 9-ft barge pole. These changes are making me wary about using opnSense in future, which is a pity because other than pfSense there isn't really a fully-featured, open-source firewall OS that comes close to matching it (and pfSense has its own issues). Linux is great and all - and I do use it for routing/firewall/VPN in places on our network - but there doesn't seem to be a dedicated network appliance distro that bundles in a comprehensive Web UI. Apart from OpenWRT and its ilk, but I'm not convinced that that's suitable for enterprise deployment.

Gud 6mo ago

FreeBSD is extremely straight forward to configure as a network gateway.