Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

In-kernel WireGuard is on its way to FreeBSD and the pfSense router

arstechnica.com

Post reply on HN
Print view View original

161–167 of 167 posts

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#161

Post by justaj »

tptacek wrote: post #67
axaxs wrote: post #61

Earlier quoted context omitted.

Yeah, same. Even if all of the above is true, it reads like an elaborate insult. And that's fine if that what the author set out to do for some reason. Pretending it wasn't after the fact isn't being honest, in my opinion. A more professional and neutral announcement could just talk about code that needs to be refactored due to some incompleteness and vulnerabilities.

It's not an elaborate insult. To a much greater extent than in other security protocols, implementation security is a goal of WireGuard. The protocol itself was designed to support secure kernel implementations; for instance, it's designed in such a way as to not require on-demand dynamic memory allocation. It's part of the premise of the security model of WireGuard that it has secure kernel implementations. If you'r…

If the criticism is about the code instead of the person, it should never be interpreted as an insult. Proper developers have learned to split their ideas from their ego, and as such are able to receive harsh yet justified criticism concerning their code without being offended.

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#162

Post by croutonwagon »

justaj wrote: post #160
jaytaylor wrote: post #14

Earlier quoted context omitted.

The dramas [0] between PFSense, OPNsense, and IPFire [1] always seems to come up. I ended up going with PFSense and it works fine. It's open enough that you can always dive in to figure out what's going on. Perhaps philosophically suboptimal, but for all practical purposes it's worked great for my home! [0] https://www.reddit.com/r/homelab/comments/dg2wme/opnsense_vs... [1] https://www.ipfire.org/

Oh god I hate this so much about Reddit: > Why fuck netgate? > [deleted] > Exactly this. Well said. As a sidenote, can anyone recommend me a service which lets me see the contents of now deleted Reddit comments?

Pushshift is the service.

There’s a bunch of sites using their api. Like removeddit.com and ceddit.com where you can just edit the url and it will query pushshift

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#163

Post by croutonwagon »

kbenson wrote: post #156
frankharv wrote: post #82

Earlier quoted context omitted.

Well instead of pfSense no longer fulfilling your needs than maybe its time to beam up to the mothership. FreeBSD can do everything pfSense does without a web interface.

pfSense provided a real easy of use, at least back in the day. Given that the whole config synced over to a backup/HA failover system and updates to one could easily be confirmed synced to the other, there was a real ease of use in using pfSense (at least I thought so about a decade ago when I was using it). Spend enough time configuring HA firewalls and you start wishing you had something to take care of alerting ab…

I moved over to opnsense yesterday. Just built my config in a vm. Exported. Installed the firewall and imported and setup the interfaces.

It should do all of that and seems to have a few nice features to boot. As well as a much steadier release cycle. And a security audit feature built in to tell you if the updates available will patch vulns. Which I found neat

Example, the version i built is on 21.1: https://imgur.com/a/2X2UBJQ

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#164

Post by justaj »

croutonwagon wrote: post #162
justaj wrote: post #160

Earlier quoted context omitted.

Oh god I hate this so much about Reddit: > Why fuck netgate? > [deleted] > Exactly this. Well said. As a sidenote, can anyone recommend me a service which lets me see the contents of now deleted Reddit comments?

Pushshift is the service. There’s a bunch of sites using their api. Like removeddit.com and ceddit.com where you can just edit the url and it will query pushshift

Thanks, it looks like Ceddit no longer works though.

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#165

Post by kbenson »

croutonwagon wrote: post #163
kbenson wrote: post #156

Earlier quoted context omitted.

pfSense provided a real easy of use, at least back in the day. Given that the whole config synced over to a backup/HA failover system and updates to one could easily be confirmed synced to the other, there was a real ease of use in using pfSense (at least I thought so about a decade ago when I was using it). Spend enough time configuring HA firewalls and you start wishing you had something to take care of alerting ab…

I moved over to opnsense yesterday. Just built my config in a vm. Exported. Installed the firewall and imported and setup the interfaces. It should do all of that and seems to have a few nice features to boot. As well as a much steadier release cycle. And a security audit feature built in to tell you if the updates available will patch vulns. Which I found neat Example, the version i built is on 21.1: https://imgur.c…

Nice, and thanks for the heads up on your experience. I was actually just looking into comparisons of them today, because I wanted to know what the major differences were, if any. I came across this[1], which while not extremely recent, it within the last year.

Everything looks pretty good for opnsense IMO based on that. The only thing that gave me pause was the note about (unsubstantiated) reports of VLAN problems in opnsense that have supposedly been broken for a while. We make heavy use of VLANs, so that would be problematic, but it could be fixed by now or never have been the longstanding problem reported for all I know, I haven't gotten to that point because I'm not planning on anything in the immediate term that requires it.

1: https://teklager.se/en/pfsense-vs-opnsense/

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#166

Post by croutonwagon »

kbenson wrote: post #165
croutonwagon wrote: post #163

Earlier quoted context omitted.

I moved over to opnsense yesterday. Just built my config in a vm. Exported. Installed the firewall and imported and setup the interfaces. It should do all of that and seems to have a few nice features to boot. As well as a much steadier release cycle. And a security audit feature built in to tell you if the updates available will patch vulns. Which I found neat Example, the version i built is on 21.1: https://imgur.c…

Nice, and thanks for the heads up on your experience. I was actually just looking into comparisons of them today, because I wanted to know what the major differences were, if any. I came across this[1], which while not extremely recent, it within the last year. Everything looks pretty good for opnsense IMO based on that. The only thing that gave me pause was the note about (unsubstantiated) reports of VLAN problems i…

I haven’t had any problems so far with them. (I run about 5 vlans at home).

Keep in mind I’m using intel nics (igb driver), promiscuous mode on. They seem the same as others.

The major things I’ve had to muck with.

1) NUT seems bugged. I can’t get it talking via usb as a stand-alone at all. Though I can see the APC UPS via usbconfig. Even when I just pointed it at my nut server I’m seem TTY broadcasts on the ssh session that its dropping snd reconnecting.

2) vpn configs carried over but assumptions made in PFsense had to be input in opnsense. Such as outbound nat on my full tunnel (I run manual nat). And firewall rules have to be put in, generally with the vpn cidr scope at the source address.

3) suricata is definately less....chatty than my snort config on pfsense. Again assumptions in pfsense have to be put in manually (such as specifying your external IP to $HOME in advanced). Also the new policies filters/rules doesn’t seem well documented though it’s brand new as of 21. I’m thinking et pro has less false positives than my old snort options. I’m also still in IDS mode, haven’t started dropping. Their appid implementation seems broken though.

4) php73 seems to freak out here and there. Webui can be crashy, especially big operations like hitting download for suricata rule sets.

5) traffic shaper is definately a little different. Though for me less complex and better. But I haven’t really dug in. I have seem to drops on a specific rtsp stream cross vlan. Hoping sharing rules can fix it.

Overall I like it. It’s a nice improvement despite the bugs.

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#167

Post by nullnix »

generalizations wrote: post #77
tw04 wrote: post #72

Earlier quoted context omitted.

There's not a good way for me to respond to that without going off-topic. The following is assuming that wasn't a rhetorical question, if it was rhetorical I guess we may just agree to disagree: Until he issues a public apology for his actions, I'll refer to him as Kip. Changing your name to run from the google searches is completely understandable, and I support second chances, but you need to show a bit of remorse…

I don't really think that the 'online mob' has the right to hold someone's past actions over their head, and expect some public appeasement before it relents.

The actions of... pouring ammonia in his tenants' beds, throwing their stuff onto the street in trash bags, cutting holes in their apartments' floors while they were inside, cutting through floor joists under their apartments and physically attacking the building supervisor when he complained, fleeing the country to avoid arrest and sticking his own mother with a half-million-dollar bail forfeit as a result...

... no, no, there's no reason to hold actions like that over someone's head. It's entirely praiseworthy and I'm sure it's really easy to cooperate with such an upstanding character.

Post reply on HN