Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OPNsense: Open-source security platform

opnsense.org

Post reply on HN
Print view View original

91–100 of 151 posts

Re: OPNsense: Open-source security platform

#91

Post by syntaxing »

buro9 wrote: post #65
syntaxing wrote: post #6

Recently transitioned from Ubiquit stuff to a OPNSense setup. It was such a good decision. The firewall rules make much more sense. Better functions than the dream machine series. You can also get a lot more for the same price. Ubiquti hardware is very under spec for the money you pay for. Highly recommend this guide to setup your own. It’s very dense and more verbose than you need so skip the irrelevant sections. [1…

How does the link aggregation work? I get that OPNSense can do this, but do you need a switch with a capability to make sense of this? I'm considering moving from Unifi USG to OPNSense and have two Cat6a runs from one end of the house to the other (through the loft and it's not possible to add more runs without building/decorating work). Presently the two cables do WAN and LAN, but I've been curious about putting som…

You need a switch that can handle LAGG but I don’t think you need a particularly expensive or fancy switch. I run a TP-Link jetstream switch that supports LACP and was only $110 (same price as a 8 port lite ubiquti switch). It has 8 port PoE+ AND 2 port SFP. You have to run a omada controller (similar to a unifi controller) but you can buy a box (OC200) or just run a Docker image which is what I do. I find tbe TP-link APs much better performing at a reasonable price too. Ubiquti with their no free shipping and price increases has gone completely out of hand since the pandemic. Made me switch out all their hardware because of it. Ubiquti hardware was simply not worth their price and OPNsense + omada had blown my Ubiquti setup out of the water.

Re: OPNsense: Open-source security platform

#92

Post by buro9 »

abwizz wrote: post #89
buro9 wrote: post #65

Earlier quoted context omitted.

How does the link aggregation work? I get that OPNSense can do this, but do you need a switch with a capability to make sense of this? I'm considering moving from Unifi USG to OPNSense and have two Cat6a runs from one end of the house to the other (through the loft and it's not possible to add more runs without building/decorating work). Presently the two cables do WAN and LAN, but I've been curious about putting som…

if you want to have two links grouped together so that a single transfer uses both links together (2gbps) then the switch has to support it. default is for two separate transfers to each get one gbit, which is good enough for most applications. packet loss at summer temps is indicative of faulty hardware (maybe just the thermal paste or other parts of the heat management)

> packet loss at summer temps is indicative of faulty hardware (maybe just the thermal paste or other parts of the heat management)

there is no heat management in the Ubnt USG. no thermal paste on the hot network ports, no cooling design beyond passive cooling (little air holes in the side of the case) that doesn't work when it's laid flat (need to vertically mount to encourage airflow).

most of the hacks are people fitting fans in a case that isn't designed for it: i.e. https://old.reddit.com/r/Ubiquiti/comments/cr88fw/cooling_th...

if the USG is in a cupboard or somewhere with poor airflow, and it's the Summer, then it's packet loss city.

would agree that this is a faulty hardware, faulty by design.

Re: OPNsense: Open-source security platform

#93

Post by abwizz »

nvy wrote: post #44
syntaxing wrote: post #6

Recently transitioned from Ubiquit stuff to a OPNSense setup. It was such a good decision. The firewall rules make much more sense. Better functions than the dream machine series. You can also get a lot more for the same price. Ubiquti hardware is very under spec for the money you pay for. Highly recommend this guide to setup your own. It’s very dense and more verbose than you need so skip the irrelevant sections. [1…

I've been looking at this as well. I'm currently running my gigabit fiber connection through a GPON-ethernet media converter and from there over Cat 6 to a ubiquiti Edgerouter-X. It does okay with hardware offloading enabled for things like ipsec and NAT, but it's taxing the CPU and I'd like to move to something with a little more headroom. Got any recommendations for something that can route beyond gigabit, when NAT…

> Got any recommendations for something that can route beyond gigabit, when NATing and DPIing and other things?

goto recommendation for the last decade is a used small formfactor enterprise desktop or a laptop. the former allows for a pcie nic and more performance while the latter usually requires a usb-eth but has a builtin keyboard and screen for debugging.

just go for something x86, avoid the ultra low-end cpu's and your usually good for soho stuff.

Re: OPNsense: Open-source security platform

#94

Post by abwizz »

kurito wrote: post #90
getcrunk wrote: post #3

Pfense is practically no longer open source. OPNsense has come a long way and even has some features pfsense does not

When trying to choose between the two, it struck me how unacceptable the behaviour of people on the pfsense project are on platforms like reddit; this was enough to tip the scales permanently. Toxicity and arrogance were prevalent, along with actively trying to squash discussions about non-Netgate hardware (the pfsense brand), while touting the project as open source.

> Toxicity and arrogance were prevalent

not to dispute your points but i rekon this goes along dealing with semi-noobs and prosumers that don't necessarily bring any business but demand attention for the better part of two decades.

Re: OPNsense: Open-source security platform

#95

Post by n8henrie »

voxadam wrote: post #84
predictabl3 wrote: post #70

Where's the OPsense NixOS mashup at? Or is it not necessary with a sufficient NixOS config?

Does NixOS work on a FreeBSD kernel? I'm apologize if this is a dumb question; I haven't had a chance to explore Nix as of yet (it's on the list).

NixOS is a Linux distro based on the nix package manager. There is a freebsd package for nix, I am 90% sure. NixOS on FreeBSD seems nonsensical, like saying Ubuntu on FreeBSD.

Re: OPNsense: Open-source security platform

#96

Post by n8henrie »

fellowmartian wrote: post #10
robcohen wrote: post #2

As an alternative, I've been watching VyOS with great interest and it seems like they are finally going to release their controller and LocalUI interface this year, which is exciting. It seems to have a similar architecture as a Ubiquiti controller. https://blog.vyos.io/

Yeah I’m waiting for a good open source Linux-based firewall, it’s way overdue. Linux has surpassed FreeBSD in terms of networking, at least for the home/SMB router use case. I’m talking about Cake, eBPF, etc. I’m currently running Mikrotik x86 on a NUC, but their hardware support on x86 isn’t great. I’d rather switch to Vyos, but I’m too lazy to learn their CLI. Semi-related: OpenWRT is also genuinely not bad on x86…

Same! Have you looked into IPFire? That's the one I had my eyes on.

Re: OPNsense: Open-source security platform

#97

Post by abwizz »

numpad0 wrote: post #77
getcrunk wrote: post #32

Earlier quoted context omitted.

Do those boxes ever get bios updates? It’s something tech influencers should mention more often

Why would you want BIOS updates? It’s not like firmware degrades over time. Frequency of zero day RCE fixes should not be taken as indication of better security.

all software has bugs, most of them get found over time.

no updates, means you are sure to collect known deficiencies.

> Frequency of zero day RCE fixes should not be taken as indication of better security.

true, but lacking an alternative metric, it's at least helpful to gauge the willingness to not ignore problems.

Re: OPNsense: Open-source security platform

#98

Post by abwizz »

eminence32 wrote: post #9

I've heard enough good things about OPNsense that I would probably pick it these days for a new installation. But I've been using pfSense happily for enough years that I'm not sure it's worth the hassle to switch, especially since I'm using Netgate hardware. Has anyone attempted to run OPNsense on Netgate hardware?

> Has anyone attempted to run OPNsense on Netgate hardware?

some tried, but no one is left to tell

Re: OPNsense: Open-source security platform

#99

Post by spants »

cyounkins wrote: post #21

How well does OPNsense deal with bufferbloat in a home networking situation? It appears to implement fq_codel for traffic shaping, but not the newer cake algorithm. Test: https://www.waveform.com/tools/bufferbloat

https://www.waveform.com/tools/bufferbloat?test-id=5115e016-... No problem with bufferbloat using flowqueue-CoDel.

Also no problems with wireguard... Using it to vpn in and also out for some routes to mullvad.

Re: OPNsense: Open-source security platform

#100

Post by voxadam »

n8henrie wrote: post #95
voxadam wrote: post #84

Earlier quoted context omitted.

Does NixOS work on a FreeBSD kernel? I'm apologize if this is a dumb question; I haven't had a chance to explore Nix as of yet (it's on the list).

NixOS is a Linux distro based on the nix package manager. There is a freebsd package for nix, I am 90% sure. NixOS on FreeBSD seems nonsensical, like saying Ubuntu on FreeBSD.

That's what I was thinking. The only reason that I thought Nix on FreeBSD as even remotely possessive is that, as I remember things, it's possible to run the Nix package manager on non-Nix systems.
Post reply on HN