Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OPNsense: Open-source security platform

opnsense.org

Post reply on HN
Print view View original

101–110 of 151 posts

Re: OPNsense: Open-source security platform

#101

Post by buro9 »

syntaxing wrote: post #91
buro9 wrote: post #65

Earlier quoted context omitted.

How does the link aggregation work? I get that OPNSense can do this, but do you need a switch with a capability to make sense of this? I'm considering moving from Unifi USG to OPNSense and have two Cat6a runs from one end of the house to the other (through the loft and it's not possible to add more runs without building/decorating work). Presently the two cables do WAN and LAN, but I've been curious about putting som…

You need a switch that can handle LAGG but I don’t think you need a particularly expensive or fancy switch. I run a TP-Link jetstream switch that supports LACP and was only $110 (same price as a 8 port lite ubiquti switch). It has 8 port PoE+ AND 2 port SFP. You have to run a omada controller (similar to a unifi controller) but you can buy a box (OC200) or just run a Docker image which is what I do. I find tbe TP-lin…

Thanks.

That was enough for me to find https://help.ui.com/hc/en-us/articles/360007279753-UniFi-Net... and know that I can mix OPNSense and my existing Unifi switches just fine as as it's all LACP.

Re: OPNsense: Open-source security platform

#102

Post by abwizz »

alias_neo wrote: post #72
stonogo wrote: post #67

Earlier quoted context omitted.

It's perfectly viable in the UK. The Optiplex 7050 is available for under a hundred pounds and the PSU tops out at 65W. It idles under eight watts. This is comparable with any other router capable of handling gigabit traffic. I think the misunderstanding is the assumption about form factor. The 7050 series is available in a case the size of a paperback book.

I'm willing to accept your point if you or they, can confirm that they are in fact talking about an optiplex that idles at 8W, which I doubt, for 43 dollars. Despite DELLs willingness to slap the same series number on everything from an ATX tower to a "paperback book", they are far from the same thing. I'm willing to accept I may be wrong, so let's see.

power consumption is a strong point. there are a lot of old desktops that idle >10W but there also are some (not as old typically) that go below.

if you want to be sure, use an old (skylake and above) laptop and give it a usb3-eth plug. my latitude e7470 idles at around 3W (powertop)

Re: OPNsense: Open-source security platform

#103

Post by spants »

raincom wrote: post #11

What kind of hardware do you use to install OPNsense? Please don't suggest to buy some old Dell optiplex from ebay. Hardware that can beat any commercial vendor, is better.

I use an old mac mini which has onboard gigabit ethernet (lan side) and an apple thunderbolt to gigabit ethernet dongle for wan. I am using 900/300 fibre and it has been rock solid. No need to buy expensive stuff for this task.

Re: OPNsense: Open-source security platform

#104

Post by hnarn »

fellowmartian wrote: post #10
robcohen wrote: post #2

As an alternative, I've been watching VyOS with great interest and it seems like they are finally going to release their controller and LocalUI interface this year, which is exciting. It seems to have a similar architecture as a Ubiquiti controller. https://blog.vyos.io/

Yeah I’m waiting for a good open source Linux-based firewall, it’s way overdue. Linux has surpassed FreeBSD in terms of networking, at least for the home/SMB router use case. I’m talking about Cake, eBPF, etc. I’m currently running Mikrotik x86 on a NUC, but their hardware support on x86 isn’t great. I’d rather switch to Vyos, but I’m too lazy to learn their CLI. Semi-related: OpenWRT is also genuinely not bad on x86…

> Linux has surpassed FreeBSD in terms of networking

Can you elaborate on this?

Re: OPNsense: Open-source security platform

#105

Post by ianai »

tiew9Vii wrote: post #51
raincom wrote: post #11

What kind of hardware do you use to install OPNsense? Please don't suggest to buy some old Dell optiplex from ebay. Hardware that can beat any commercial vendor, is better.

Look at the CWWK n100 mini pc’s https://cwwk.net/collections/frontpage/products/intel-12th-g... . A big thread on serve the home https://forums.servethehome.com/index.php?threads/cwwk-topto... Alternatively the Protectli’s https://protectli.com/vault-4-port/ . Protectli gets you support and coreboot, next day Amazon shipping but more expensive and older hardware. These are great devices for running Opensense bare met…

Can you coreboot the cwwk?

Re: OPNsense: Open-source security platform

#106

Post by koyote »

cyounkins wrote: post #21

How well does OPNsense deal with bufferbloat in a home networking situation? It appears to implement fq_codel for traffic shaping, but not the newer cake algorithm. Test: https://www.waveform.com/tools/bufferbloat

Huh, TIL about bufferbloat.

I run OPNsense (very happy with it) and had a B, so I followed this guide (https://docs.ibracorp.io/opnsense/) and I now have A+.

Do you have any information on fq_codel vs cake?

Re: OPNsense: Open-source security platform

#108

Post by simondotau »

Havoc wrote: post #79
lloydatkinson wrote: post #73

I always get confused between OPNsense and pfSense - one is the open source fork the other is the original.

Pfsense is the “original” and the more commercial minded. They’re very close though. You can follow Pfsense guides on opnaense basically

Pfsense is, in turn, a fork of m0n0wall. It's also important to note that pretty much all of the functionality of all aforementioned firewalls is part of FreeBSD or from packages installed behind the scenes. The configuration UX is the most visible differentiator but they also have different strategies when it comes to pushing updates and testing/validation.

But the actual heavy lifting of these router/firewall systems is done by code that ships with FreeBSD.

Re: OPNsense: Open-source security platform

#109

Post by nprateem »

getcrunk wrote: post #3

Pfense is practically no longer open source. OPNsense has come a long way and even has some features pfsense does not

They also like to tell you why you're wrong for wanting wireguard (so it's for your own good they don't support it) instead of letting you make up your own mind. No thanks.

Re: OPNsense: Open-source security platform

#110

Post by vladvasiliu »

alias_neo wrote: post #52
nick0garvey wrote: post #17

Earlier quoted context omitted.

You say "don't suggest to buy some old Dell Optiplex from eBay" but I did exactly this. I spent $43.97 (which included shipping) for the Optiplex, added a 2 port NIC for $16.37, and it's been running my house great since then.

This really isn't viable in somewhere like the UK. At our current electricity prices, if that machine ran at 100W, you'd be spending the equivalent of what you paid for it EVERY month in electricity. I've always seen Americans, who typically have more space and cheaper energy and fuel suggest people grab 1U servers for $40 etc, and respond just like you did when people ask them _not_ to. My car also does 50mpg, and I…

It probably doesn't run at 100W, although I'd be quite curious to know whether someone actually measured the consumption, since I have the HP version of this.

The reason why I don't expect it to draw as much is because I have an 8-core xeon with 2x10k RPM + 4*7200 RPM drives, a dedicated raid card, integrated BMC, and it reports ~100W power draw when booting up. When sitting around doing nothing but with the drives spinning, it reports a draw of about 80W.

edit: The BMC alone draws 11W, judging by the reported power consumption when the server is off, but plugged in.

Post reply on HN