But, anyone considering a firewall should also consider OPNsense. OPNsense is based on FreeBSD 11 [0] (pfSense 2.3.3 is based on 10.3), while offering many of the same features as pfSense.
Since you seem to have some idea of what you're talking about: how would you compare the BSD-based firewall distros to the Linux-based firewall distros? Personally, I'm partial to VyOS, simply because I have the most experience with it. (Or rather, its fork, EdgeOS)
By zer0t3ch 9 years ago
I've got a few dozen businesses with PFSense with LTE backup, and at this point I'm looking for alternatives. I've considered IPFire, and I've looked at VyOS, Untangle, and OPNSense, but I just recently realized I completely overlooked OpenWRT, which I already happen to have many positive experiences with.
Long term I'm thinking I'll move things over to ARM/MIPS based routers running OpenWRT, and where needed I'll use x86_64 boxes with OpenWRT (eg: Tor Relay at home) as when things break on OpenWRT, its a lot less bad than on BSD.
In particular, I've had issues with BSD taking forever to boot (waited 4hrs at 3am once), deciding it needed an Intel NIC firmware when it had no Intel NICs, thus causing an outage while I drove down there with a WNR2000v3 running OpenWRT, and LTE backup interface handling being poor, whereby the cellular connection will go out (and we'll send a command to the SOAP API on the modem to reconnect), but PFSense needs to cycle the interface for some reason when it already has an internal IP from the modem. Combine that with having to walk customers through any one of these scenarios every few months over the phone, and its a joyous situation.
By trome 9 years ago
> whereby the cellular connection will go out (and we'll send a command to the SOAP API on the modem to reconnect), but PFSense needs to cycle the interface for some reason when it already has an internal IP from the modem.
Sounds like you're using a USB based modem that runs its own software stack. We tried that, and it went terribly. Issues similar to the one you mentioned.
Life is much, much better if you buy a mini-PCIe module and use Linux utilities to manage it. We've had zero problems since dumping our USB modems (Huawei junk) and buying proper cards (also Huawei, but surprisingly not junk).
OpenWrt is nice, but the packages are limited. Also their release cycle is glacial, so we frequently end up building from trunk because we need some fixes which aren't in the current stable release (15.05.1 is almost a year old!).
By kogepathic 9 years ago
Eh, the ZTE MF96's will go a few months between reboots, and its hard to get anywhere near their price point with mini-PCIe, automating management of them would likely make more sense IMO.
Wrt OpenWRT being aged, not too worried there, I'm still running Debian Jessie over here :P
By trome 9 years ago
> Wrt OpenWRT being aged, not too worried there, I'm still running Debian Jessie over here
Yeah but it's a problem. Debian Jessie still gets security updates regularly. OpenWrt doesn't. The only way to upgrade the kernel and core packages is to reflash with a newer image. An annual release cycle is an issue for embedded devices you want to keep secure.
By kogepathic 9 years ago
Have you considered using Mikrotik?
I've heard about them for years, but just started using them in the last 12-18 months. So far, I've been very happy with the performance and features for the cost.
By edwhitesell 9 years ago
I own a few Omnitiks, and they are a total PITA to work with, so no, definitely not going with Mikrotik.
By trome 9 years ago
If you need openVPN don't run Mikrotik. I love routerOS but openVPN over TCP is no good.
By deagle50 9 years ago
FWIW I think that depends on the client. I use OpenVPN over TCP with Linux and Windows clients for managing a remote customer location with no issues.
However, Android doesn't work at all. I suspect it's a configuration issue, but the lack of meaningful logs makes it damn near impossible to troubleshoot.
If you happen to run an all Mikrotik routing environment, the SSTP tunneling works well. I have a customer with hundreds of Mikrotiks out in the field, each with an SSTP connection back to a cloud-based Mikrotik installation for remote management/monitoring.
SSTP supposedly works with Windows clients too, though I've never tried it.
By edwhitesell 9 years ago
> how would you compare the BSD-based firewall distros to the Linux-based firewall distros
In terms of being a firewall, there's no difference. Both will open and block ports as needed.
Where BSD excels over Linux is in the traffic shaping/manipulation capabilities. pf lets you simulate just about any kind of link you want (e.g. want to simulate a satellite connection with accurate latency? or want to simulate a 2G connection with high latency and high packet loss?)
So, as a static firewall, Linux/iptables is fine.
If you want to do any kind of link simulation or complex traffic shaping, BSD is far better.
By kogepathic 9 years ago
Could you explain a bit more? I often do this on Linux using "tc" (traffic control) to simulate all types of links. What tools does BSD have that are superior?
By 293984j29384 9 years ago
It's been 5+ years since I did this testing. It's possible that the Linux ecosystem has caught up to BSD in this time.
I was using pf to simulate links with specific attributes (e.g. latency, packet loss).
Reading the documentation of tc, it seems like it would accomplish what I was doing. However the documentation I found for tc was quite old (mentioning kernels 2.2 and 2.4).
By kogepathic 9 years ago
Pfsense is focused on offering a GUI with fantastic capabilities. Vyos became a command line only distro at one point.
By godzillabrennus 9 years ago
> Vyos became a command line only distro at one point
Is there something wrong with that?
I'm not trying to be an ass, just curious.
By zer0t3ch 9 years ago
Still no DPDK support....
By xmichael99 9 years ago
Can I ask if you're affiliated with OpnSense? I had a really negative experience with it for its first couple of releases and embraced pfSense instead. In my personal sample set of two, OpnSense was focused on new and pretty instead of reliable and tested, and that's not what my edge router should be running.
By ComputerGuru 9 years ago
Is there any good resource/guided path for migration from pfSense to OPNsense.
I'm running a few pfSense boxes and have been meaning to replace them as pfSense is slow at providing the major FreeBSD updates, however the web-ui is great for allowing local administrators to manage and do some operations without extensive *NIX-knowledge.
By hultner 9 years ago
Lots of good fixes there. I've found pfsense rock solid and excellent to use, over more than half a decade, both:
- for a 250+ device network balancing loads across two consumer broadband connections, and
- as my home router and firewall, running in a virtual machine on a somewhat ageing HP Microserver N54L.
By flipbrad 9 years ago
and if you don't need a GUI, you can always install OpenBSD -- no extras required. it includes a useful OSPF and BGP daemon, BFD in the next release (I believe), and a version of pf that isn't a few years old :)
By kogepathic 9 years ago
By zer0t3ch 9 years ago
By trome 9 years ago
By kogepathic 9 years ago
By trome 9 years ago
By kogepathic 9 years ago
By edwhitesell 9 years ago
By trome 9 years ago
By deagle50 9 years ago
By edwhitesell 9 years ago
By kogepathic 9 years ago
By 293984j29384 9 years ago
By kogepathic 9 years ago
By godzillabrennus 9 years ago
By zer0t3ch 9 years ago
By xmichael99 9 years ago
By ComputerGuru 9 years ago
By hultner 9 years ago
By flipbrad 9 years ago
By pyvpx 9 years ago
By shiftoutbox 9 years ago