Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OPNsense: Open-source security platform

opnsense.org

Post reply on HN
Print view View original

51–60 of 151 posts

Re: OPNsense: Open-source security platform

#51

Post by tiew9Vii »

raincom wrote: post #11

What kind of hardware do you use to install OPNsense? Please don't suggest to buy some old Dell optiplex from ebay. Hardware that can beat any commercial vendor, is better.

Look at the CWWK n100 mini pc’s https://cwwk.net/collections/frontpage/products/intel-12th-g... .

A big thread on serve the home https://forums.servethehome.com/index.php?threads/cwwk-topto...

Alternatively the Protectli’s https://protectli.com/vault-4-port/ . Protectli gets you support and coreboot, next day Amazon shipping but more expensive and older hardware.

These are great devices for running Opensense bare metal or virtualised in Proxmox. I use Proxmox on a protectli so can run unifi controller and ad guard home in lxc containers with Opensense in a VM. I’d buy a cwwk if buying again, I just didn’t know about them at the time.

Re: OPNsense: Open-source security platform

#52

Post by alias_neo »

nick0garvey wrote: post #17
raincom wrote: post #11

What kind of hardware do you use to install OPNsense? Please don't suggest to buy some old Dell optiplex from ebay. Hardware that can beat any commercial vendor, is better.

You say "don't suggest to buy some old Dell Optiplex from eBay" but I did exactly this. I spent $43.97 (which included shipping) for the Optiplex, added a 2 port NIC for $16.37, and it's been running my house great since then.

This really isn't viable in somewhere like the UK.

At our current electricity prices, if that machine ran at 100W, you'd be spending the equivalent of what you paid for it EVERY month in electricity.

I've always seen Americans, who typically have more space and cheaper energy and fuel suggest people grab 1U servers for $40 etc, and respond just like you did when people ask them _not_ to.

My car also does 50mpg, and I still pay more pay mile for fuel.

In Europe, we need to spend more to buy efficient tech because the running costs require it.

Re: OPNsense: Open-source security platform

#53

Post by squarefoot »

aborsy wrote: post #42
pigbearpig wrote: post #20

Earlier quoted context omitted.

I just got a Protectli Vault FW4B to run it on. I wanted something small and fanless. Didn't even realize Celeron's were still made. Been running it 2 years now with no problems. Even that hardware (8GB RAM / 32GB msata) is overkill for home network. Protectli was nice to buy from, but I do think there's a lot of similar options. https://protectli.com/product/fw4b/

OPNSense runs very well on their boxes. You can even have it with Core boot. I think they should upgrade their NICs to 2.5G and 10G though. 1G is no longer future proof.

Most of the boxes sold here support 2.5G. No mention of Coreboot, unfortunately, but could be worth asking if they can install it as they already offer OpnSense or other firewall software installation as a service.

https://www.ipu-system.de/

Re: OPNsense: Open-source security platform

#54

Post by redrove »

raincom wrote: post #11

What kind of hardware do you use to install OPNsense? Please don't suggest to buy some old Dell optiplex from ebay. Hardware that can beat any commercial vendor, is better.

I own a DEC3840 [1] appliance and I'm happy with it so far. I was also on the search for a proper commercial vendor after running it in a VM for years.

[1] https://shop.opnsense.com/product/dec3840-opnsense-rack-secu...

Re: OPNsense: Open-source security platform

#55

Post by alias_neo »

pigbearpig wrote: post #20
raincom wrote: post #11

What kind of hardware do you use to install OPNsense? Please don't suggest to buy some old Dell optiplex from ebay. Hardware that can beat any commercial vendor, is better.

I just got a Protectli Vault FW4B to run it on. I wanted something small and fanless. Didn't even realize Celeron's were still made. Been running it 2 years now with no problems. Even that hardware (8GB RAM / 32GB msata) is overkill for home network. Protectli was nice to buy from, but I do think there's a lot of similar options. https://protectli.com/product/fw4b/

I also run one of these but the 6 port version.

The jest part about Protectli is the Coreboot and they provide instructions to compile your own, so it even feels open.

That said, fully configured with RAM and storage mine cost roughly £600.

Given electricity prices in the UK, and my requirement for an as-open-as-possible software stack, it was well worth it. If it outlasts the EdgeRouter it replaced (7yrs before power circuitry died) I'll be very happy.

That said, my main concern, as a reply to you pointed out, is that I'll want more than Gigabit in that time; my street is getting 10Gb/10Gb in the next couple of years.

Re: OPNsense: Open-source security platform

#57

Post by alias_neo »

squarefoot wrote: post #53
aborsy wrote: post #42

Earlier quoted context omitted.

OPNSense runs very well on their boxes. You can even have it with Core boot. I think they should upgrade their NICs to 2.5G and 10G though. 1G is no longer future proof.

Most of the boxes sold here support 2.5G. No mention of Coreboot, unfortunately, but could be worth asking if they can install it as they already offer OpnSense or other firewall software installation as a service. https://www.ipu-system.de/

Installing it isn't really enough, you want updates. Protectli provide instructions to compile it yourself, so even if they stopped providing binary releases, you could DIY it; well worth the premium for the security conscious in my opinion.

Re: OPNsense: Open-source security platform

#58

Post by rsolva »

AndrewDavis wrote: post #41
LeSaucy wrote: post #4

OPNsense is the core router platform I default to for all my network infrastructure (work devops env, homelab, vpn to family members etc). Its feature packed and ROCK solid. I almost always run it in a virtual machine so i can live migrate it between hosts and have no downtime. The cluster / high availability works great and ensures no loss of connectivity during upgrades. OPNsense is a true hidden gem in the open so…

I'm curious if you have any suggestions re configuration management? At the moment i'm just point and click configuring but i'd really like to move towards using source control, edit some config file and push configuration to it. Do you (or anyone else reading) have any suggestions?

There is a git plugin that pushes and commits every change automatically. But be carefully where you push it as the config file can contain sensitive stuff! I have my own Gitea behind the firewall.

Re: OPNsense: Open-source security platform

#59

Post by feldrim »

shmerl wrote: post #31

They should switch to dhcpd from dhcp6c to avoid issues with IPv6 address not being assigned to the router itself.

It looks like the maintain a dhcp6c [0] already. Do they not use it?

Edit: I checked the source and they are already utilizing it [1].

0. https://github.com/opnsense/dhcp6c

1. https://github.com/search?q=repo%3Aopnsense%2Fcore+dhcp6&typ...

Re: OPNsense: Open-source security platform

#60

Post by sschueller »

raincom wrote: post #11

What kind of hardware do you use to install OPNsense? Please don't suggest to buy some old Dell optiplex from ebay. Hardware that can beat any commercial vendor, is better.

I went with an AMD Ryzen 7 5800X and I run OPNsense virtualized for a 25gbit uplink with 10gbit hosts. No traffic inspection or anything fancy however. [1]

[1] https://sschueller.github.io/posts/wiring-a-home-with-fiber/...

Post reply on HN