I used to run several pfsense routers, tried various forks including opnsense and they were fine but ate quite a bit of memory and didn't have great driver support. If you are like me and just need a router solution for a homelab or small office I would recommend the x86 variant of openwrt. It uses a trickle of memory and CPU and will route anything you ask it too with or without a ton of filters and sniffers. I've never looked back.
OPNsense: Open-source security platform
61–70 of 151 posts
Re: OPNsense: Open-source security platform
#62If you want to take it even further a fully virtualized Opnsense with Proxmox is amazing. Your router can float between cluster nodes and each VLAN becomes a virtual interface in the hypervisor. What still blows my mind is how I can migrate the instance to a second server and bring the original server down for maintenance without my users noticing a thing.
Got any documentation on how a setup like this might be implemented? I'm curious how the interfaces float between nodes to keep the network up. Is it relying mostly on switches for the physical connectivity, including upstream?
I set this up recently but with libvirt instead of proxmox. Used openvswitch and configured it with netplan.
Re: OPNsense: Open-source security platform
#63I've just set up my first OPNsense box (using one of the 4-port 2.5 gig AliExpress tiny PCs recommended by ServeTheHome) and like it a lot. A few rough edges in the UI, but I got the basic routing functionality running within minutes, and got Wireguard going with the help of a guide from Home Network Guy pretty soon after. Since then I've bought a second box and will be setting it up soon, too!
Do those boxes ever get bios updates? It’s something tech influencers should mention more often
I personally use a router box from teklager.se and they use open source schematics and bios which are actually updated. Without having done a comparison I am assuming they are a more expensive option though. It has been small, silent and stable since I bought it pre-installed with OPNSense though, so I am happy with it.
Re: OPNsense: Open-source security platform
#64They should switch to dhcpd from dhcp6c to avoid issues with IPv6 address not being assigned to the router itself.
It looks like the maintain a dhcp6c [0] already. Do they not use it? Edit: I checked the source and they are already utilizing it [1]. 0. https://github.com/opnsense/dhcp6c 1. https://github.com/search?q=repo%3Aopnsense%2Fcore+dhcp6&typ...
I think dhcp6c is the problem? FreeBSD provides a better option, but they aren't using it.
Re: OPNsense: Open-source security platform
#65Recently transitioned from Ubiquit stuff to a OPNSense setup. It was such a good decision. The firewall rules make much more sense. Better functions than the dream machine series. You can also get a lot more for the same price. Ubiquti hardware is very under spec for the money you pay for. Highly recommend this guide to setup your own. It’s very dense and more verbose than you need so skip the irrelevant sections. [1…
How does the link aggregation work?
I get that OPNSense can do this, but do you need a switch with a capability to make sense of this?
I'm considering moving from Unifi USG to OPNSense and have two Cat6a runs from one end of the house to the other (through the loft and it's not possible to add more runs without building/decorating work). Presently the two cables do WAN and LAN, but I've been curious about putting something closer to the modem and to somehow use both cables for the LAN.
LAGG looks like it can do this and isn't something I knew about for the home.
Would I need a special switch on the other end? I've currently got Ubiquiti switches but as I'm already looking at binning the USG I'm fairly open to reconsidering a lot of the network.
PS: The reason to abandon the USG is heat issues. Packet loss when the ambient room temperature exceeds 30'c, and serious packet loss when the room temp is 35'c. This is no longer rare, and the USG is only rated to ambient temp of 40'c and there are many Reddit threads of people ripping the case apart and fitting fans. I'd rather just have stable internet with better hardware.
Re: OPNsense: Open-source security platform
#66Earlier quoted context omitted.
Got any documentation on how a setup like this might be implemented? I'm curious how the interfaces float between nodes to keep the network up. Is it relying mostly on switches for the physical connectivity, including upstream?
I set this up recently but with libvirt instead of proxmox. Used openvswitch and configured it with netplan.
I'm not super experienced with networking. Does this require BGP for the router to move between hosts?
If my PON is connected into one of the nodes, how do I allow the router to roam if a node fails? Will look into openvswitch.
Not really ever done virtualized networking so it doesn't immediately click for me.
Re: OPNsense: Open-source security platform
#67Earlier quoted context omitted.
You say "don't suggest to buy some old Dell Optiplex from eBay" but I did exactly this. I spent $43.97 (which included shipping) for the Optiplex, added a 2 port NIC for $16.37, and it's been running my house great since then.
This really isn't viable in somewhere like the UK. At our current electricity prices, if that machine ran at 100W, you'd be spending the equivalent of what you paid for it EVERY month in electricity. I've always seen Americans, who typically have more space and cheaper energy and fuel suggest people grab 1U servers for $40 etc, and respond just like you did when people ask them _not_ to. My car also does 50mpg, and I…
It's perfectly viable in the UK. The Optiplex 7050 is available for under a hundred pounds and the PSU tops out at 65W. It idles under eight watts. This is comparable with any other router capable of handling gigabit traffic.
I think the misunderstanding is the assumption about form factor. The 7050 series is available in a case the size of a paperback book.
Re: OPNsense: Open-source security platform
#68As an alternative, I've been watching VyOS with great interest and it seems like they are finally going to release their controller and LocalUI interface this year, which is exciting. It seems to have a similar architecture as a Ubiquiti controller. https://blog.vyos.io/
I always wanted to try it, but $8k / year for the cheapest stable release license isn’t in my universe for affordability. > It seems to have a similar architecture as a Ubiquiti controller. That’s a hell of an insult to be tossing around for an unreleased product. Lmao.
It’s pretty easy to build the stable version.
https://docs.vyos.io/en/equuleus/contributing/build-vyos.htm...
Re: OPNsense: Open-source security platform
#69Pfense is practically no longer open source. OPNsense has come a long way and even has some features pfsense does not
PfSense has some pretty bad problems relating to interfaces disappearing temporarily and services dying from it. I would go as far as saying 2.6.0 is unreliable. With PCEngines shutting down it’s almost impossible to find reliable, cost effective hardware. I hope pfSense gets back on track because their hardware seems ok.
I recently moved my main router from a Netgate device running pfSense to a Deciso device running OPNsense, and couldn't be happier with the change. The Deciso hardware is pricey, but you get what you pay for. Very well built, silent, and very powerful hardware. No issues whatsoever.
Re: OPNsense: Open-source security platform
#70Where's the OPsense NixOS mashup at? Or is it not necessary with a sufficient NixOS config?