Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OPNsense: Open-source security platform

opnsense.org

Post reply on HN
Print view View original

41–50 of 151 posts

Re: OPNsense: Open-source security platform

#41

Post by AndrewDavis »

LeSaucy wrote: post #4

OPNsense is the core router platform I default to for all my network infrastructure (work devops env, homelab, vpn to family members etc). Its feature packed and ROCK solid. I almost always run it in a virtual machine so i can live migrate it between hosts and have no downtime. The cluster / high availability works great and ensures no loss of connectivity during upgrades. OPNsense is a true hidden gem in the open so…

I'm curious if you have any suggestions re configuration management? At the moment i'm just point and click configuring but i'd really like to move towards using source control, edit some config file and push configuration to it.

Do you (or anyone else reading) have any suggestions?

Re: OPNsense: Open-source security platform

#42

Post by aborsy »

pigbearpig wrote: post #20
raincom wrote: post #11

What kind of hardware do you use to install OPNsense? Please don't suggest to buy some old Dell optiplex from ebay. Hardware that can beat any commercial vendor, is better.

I just got a Protectli Vault FW4B to run it on. I wanted something small and fanless. Didn't even realize Celeron's were still made. Been running it 2 years now with no problems. Even that hardware (8GB RAM / 32GB msata) is overkill for home network. Protectli was nice to buy from, but I do think there's a lot of similar options. https://protectli.com/product/fw4b/

OPNSense runs very well on their boxes. You can even have it with Core boot.

I think they should upgrade their NICs to 2.5G and 10G though. 1G is no longer future proof.

Re: OPNsense: Open-source security platform

#43

Post by donmcronald »

robcohen wrote: post #40
donmcronald wrote: post #33

Earlier quoted context omitted.

The Ubiquiti controller is fine if you're managing one site, but beyond that it's pretty poorly designed IMO. By far the biggest problem is that they don't give enough consideration to recover-ability of offsite devices. If something causes a device to disconnect from the controller their solution is to SSH in and re-adopt it. That doesn't work once you're dealing with hundreds of devices across dozens of sites. A go…

Those are all very valid points you raise. I’ve also faced the recoverability problem when something goes awry. I’ve also noticed their ISP line has difficulty being reachable via API when they lose internet connectivity, even if you are local to the network. That said, is there anything better? Mikrotik, while more configurable, is so much worse and feels straight out of the 90s design-wise. Beyond those options I’m…

> That said, is there anything better?

I haven’t found anything better for switches and APs. I use pfSense for firewalls.

Re: OPNsense: Open-source security platform

#44

Post by nvy »

syntaxing wrote: post #6

Recently transitioned from Ubiquit stuff to a OPNSense setup. It was such a good decision. The firewall rules make much more sense. Better functions than the dream machine series. You can also get a lot more for the same price. Ubiquti hardware is very under spec for the money you pay for. Highly recommend this guide to setup your own. It’s very dense and more verbose than you need so skip the irrelevant sections. [1…

I've been looking at this as well. I'm currently running my gigabit fiber connection through a GPON-ethernet media converter and from there over Cat 6 to a ubiquiti Edgerouter-X. It does okay with hardware offloading enabled for things like ipsec and NAT, but it's taxing the CPU and I'd like to move to something with a little more headroom.

Got any recommendations for something that can route beyond gigabit, when NATing and DPIing and other things?

Re: OPNsense: Open-source security platform

#45

Post by nvy »

getcrunk wrote: post #3

Pfense is practically no longer open source. OPNsense has come a long way and even has some features pfsense does not

The pfsense people are, frankly, fucking clowns. They bought the domain opnsense.com and used it to badmouth the opnsense project[0]. Do not give pfsense time, attention, or money.

[0] https://opnsense.org/opnsense-com/

Re: OPNsense: Open-source security platform

#46

Post by alias_neo »

syntaxing wrote: post #6

Recently transitioned from Ubiquit stuff to a OPNSense setup. It was such a good decision. The firewall rules make much more sense. Better functions than the dream machine series. You can also get a lot more for the same price. Ubiquti hardware is very under spec for the money you pay for. Highly recommend this guide to setup your own. It’s very dense and more verbose than you need so skip the irrelevant sections. [1…

I switched to pfSense from EdgeRouter a few years back, and find the firewall rules make _less_ sense. The reason is likely that I understand IPTables pretty well, where as the approach used in pfSense seems "abstract" in comparison.

I'd certainly recommend grabbing something like a Protectli box (if power draw is a concern) or building a small server with NICs to install OPNSense on over the Ubiquiti stuff.

For me, the router graveyard was getting out of hand, buying everything from mid-range to high-end consumer routers only to have them left behind software-security wise within 3 years, I needed something open.

The promise of the EdgeRouter range was the hardware offload and Debian based OS, but Ubiquiti has fallen out of favour with me in that space, their software has gotten worse rather than better over time.

I went with Protectli because of the ability to use Coreboot meaning I could get as much of the stack Open Source as possible. Unfortunately, at the time I set it up, OPNSense didn't work for my requirements and I had to use pfSense; pfSense is now too falling out of favour, but I don't have the time to swap over a fairly large home network without pissing off the family.

Re: OPNsense: Open-source security platform

#47

Post by nvy »

geerlingguy wrote: post #7

I've just set up my first OPNsense box (using one of the 4-port 2.5 gig AliExpress tiny PCs recommended by ServeTheHome) and like it a lot. A few rough edges in the UI, but I got the basic routing functionality running within minutes, and got Wireguard going with the help of a guide from Home Network Guy pretty soon after. Since then I've bought a second box and will be setting it up soon, too!

Could you link to the box that STH recommends? I find navigating their site to be a bit of a chore.

Re: OPNsense: Open-source security platform

#48

Post by alias_neo »

nvy wrote: post #45
getcrunk wrote: post #3

Pfense is practically no longer open source. OPNsense has come a long way and even has some features pfsense does not

The pfsense people are, frankly, fucking clowns. They bought the domain opnsense.com and used it to badmouth the opnsense project[0]. Do not give pfsense time, attention, or money. [0] https://opnsense.org/opnsense-com/

I remember reading this nearer the time, but I never clicked through to see just what was on the site; having just looked at the cache, I'm appalled. That stuff goes beyond petty, to the point that whoever is behind that should not only NOT be doing business with the grown ups, they should be in a facility seriously re-evaluating their life choices. What a disgrace.

Re: OPNsense: Open-source security platform

#49

Post by alias_neo »

digitallyfree wrote: post #36

If you want to take it even further a fully virtualized Opnsense with Proxmox is amazing. Your router can float between cluster nodes and each VLAN becomes a virtual interface in the hypervisor. What still blows my mind is how I can migrate the instance to a second server and bring the original server down for maintenance without my users noticing a thing.

Got any documentation on how a setup like this might be implemented? I'm curious how the interfaces float between nodes to keep the network up.

Is it relying mostly on switches for the physical connectivity, including upstream?

Re: OPNsense: Open-source security platform

#50

Post by alias_neo »

getcrunk wrote: post #32
geerlingguy wrote: post #7

I've just set up my first OPNsense box (using one of the 4-port 2.5 gig AliExpress tiny PCs recommended by ServeTheHome) and like it a lot. A few rough edges in the UI, but I got the basic routing functionality running within minutes, and got Wireguard going with the help of a guide from Home Network Guy pretty soon after. Since then I've bought a second box and will be setting it up soon, too!

Do those boxes ever get bios updates? It’s something tech influencers should mention more often

I got a Protectli one; bit overpriced but they provide instructions to compile Coreboot.

They don't just give you a fish, they teach you to fish, then it's in your hands.

Post reply on HN