Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OPNsense: Open-source security platform

opnsense.org

Post reply on HN
Print view View original

111–120 of 151 posts

Re: OPNsense: Open-source security platform

#111

Post by _ea1k »

ZeroSolstice wrote: post #88
KennyBlanken wrote: post #25

Earlier quoted context omitted.

I used to find it rock solid, but around two years ago reliability tanked. I found myself regularly having issues with interfaces (a genuine Intel server-grade multi-port NIC) flip-flopping. About a year ago, I started having random issues with traffic no longer routing, out of the blue. Lately both issues seem to have gone away. Right now the software update function dies half the time I try to run a check, with a l…

> About a year or two after install, reboots and power-offs stopped working. The system just hangs instead after printing out a message about USB, and I cannot figure out for the life of me what's wrong. My initial read here would be that this is where serial port / console redirection is happening. There should be settings in the BiOS you can look at however I don't know how limited PC's are in their options / funct…

tbh, at this point, I'd argue that not supporting arm is a bad business move. There are decent ARM router boards out there.

They could likely do well selling one of them as a supported solution.

Re: OPNsense: Open-source security platform

#112

Post by _ea1k »

fellowmartian wrote: post #10
robcohen wrote: post #2

As an alternative, I've been watching VyOS with great interest and it seems like they are finally going to release their controller and LocalUI interface this year, which is exciting. It seems to have a similar architecture as a Ubiquiti controller. https://blog.vyos.io/

Yeah I’m waiting for a good open source Linux-based firewall, it’s way overdue. Linux has surpassed FreeBSD in terms of networking, at least for the home/SMB router use case. I’m talking about Cake, eBPF, etc. I’m currently running Mikrotik x86 on a NUC, but their hardware support on x86 isn’t great. I’d rather switch to Vyos, but I’m too lazy to learn their CLI. Semi-related: OpenWRT is also genuinely not bad on x86…

OpenWRT also runs great on ARM. Even the Raspberry Pi can work well for home use.

Re: OPNsense: Open-source security platform

#113

Post by tatersolid »

This site is the worst mobile web experience I’ve ever had. It automatically scrolls itself both up and down while you are in the middle of the page reading.

I am actually interested in OPNsense but I can’t actually find out if it meets my needs or if I can contribute because the website sucks so much.

Re: OPNsense: Open-source security platform

#114

Post by syntaxing »

nvy wrote: post #44
syntaxing wrote: post #6

Recently transitioned from Ubiquit stuff to a OPNSense setup. It was such a good decision. The firewall rules make much more sense. Better functions than the dream machine series. You can also get a lot more for the same price. Ubiquti hardware is very under spec for the money you pay for. Highly recommend this guide to setup your own. It’s very dense and more verbose than you need so skip the irrelevant sections. [1…

I've been looking at this as well. I'm currently running my gigabit fiber connection through a GPON-ethernet media converter and from there over Cat 6 to a ubiquiti Edgerouter-X. It does okay with hardware offloading enabled for things like ipsec and NAT, but it's taxing the CPU and I'd like to move to something with a little more headroom. Got any recommendations for something that can route beyond gigabit, when NAT…

You should checkout the new R862 mini pcs. You can get 3X 2.5 NIC and 2 SFP port with 10G support. The homenetworkguy did a great review on it. But overall, 10G works but only with nothing turned on. With IPS/IDS and proper MTU, you can get about 3 Gbps. But all this for sub $400 in a computer about the size of your hand is insane to me.

Re: OPNsense: Open-source security platform

#115

Post by chaxor »

circularfoyers wrote: post #37
cyounkins wrote: post #21

How well does OPNsense deal with bufferbloat in a home networking situation? It appears to implement fq_codel for traffic shaping, but not the newer cake algorithm. Test: https://www.waveform.com/tools/bufferbloat

This and the debacle with Wireguard are the two top reasons that have kept me on OpenWRT.

Debacle with wireguard? Opnsense has wireguard easily available. Also, it's just base wireguard, so you don't have to go through any extra steps of trying to understand / trust other additions on top of it, which is very nice IMO.

Re: OPNsense: Open-source security platform

#116

Post by syntaxing »

philsnow wrote: post #28
syntaxing wrote: post #6

Recently transitioned from Ubiquit stuff to a OPNSense setup. It was such a good decision. The firewall rules make much more sense. Better functions than the dream machine series. You can also get a lot more for the same price. Ubiquti hardware is very under spec for the money you pay for. Highly recommend this guide to setup your own. It’s very dense and more verbose than you need so skip the irrelevant sections. [1…

I’ve been thinking about swapping out my UDMP for opnsense, but keeping the ubiquiti APs, they’re the best I’ve ever known and I think they play reasonably well with non-ubiquiti stuff. Thanks for the link to the guide!

You can actually run the controller with a plugin too! Worked great, didn’t have any issues when I was still using my ubiquiti switches and AP.

Re: OPNsense: Open-source security platform

#117

Post by unethical_ban »

raincom wrote: post #11

What kind of hardware do you use to install OPNsense? Please don't suggest to buy some old Dell optiplex from ebay. Hardware that can beat any commercial vendor, is better.

Some thing like this is what I have: https://www.amazon.com/QOTOM-celeron-Processor-Fanless-pfSen...

I had one availability blip a few months ago, don't know what it was but a full hardware reboot fixed it.

I have it running proxmox, with a debian pivpn/pihole + op lnsense VMs. I believe I have 12 gb ram in it.

Re: OPNsense: Open-source security platform

#118

Post by vogon_laureate »

alias_neo wrote: post #46
syntaxing wrote: post #6

Recently transitioned from Ubiquit stuff to a OPNSense setup. It was such a good decision. The firewall rules make much more sense. Better functions than the dream machine series. You can also get a lot more for the same price. Ubiquti hardware is very under spec for the money you pay for. Highly recommend this guide to setup your own. It’s very dense and more verbose than you need so skip the irrelevant sections. [1…

I switched to pfSense from EdgeRouter a few years back, and find the firewall rules make _less_ sense. The reason is likely that I understand IPTables pretty well, where as the approach used in pfSense seems "abstract" in comparison. I'd certainly recommend grabbing something like a Protectli box (if power draw is a concern) or building a small server with NICs to install OPNSense on over the Ubiquiti stuff. For me,…

I'm the other way, I find IPTables less intuitive and featureful than PF. The way Netfilter/IPTables works under the hood seems much more over-complicated[1] than it needs to be (which is how I feel about a lot of Linux system stuff these days). The architecture of PF[2] (and thus how the rules get processed) just makes more sense to me.

pfSense/OPNsense is just a stripped-down FreeBSD under the hood. If there are things that you want it to do that you can't with the base install, you can look into installing FreeBSD packages.[3][4] I personally just use vanilla OpenBSD for most edge router/firewall tasks and then if I need mesh wifi or some modern gear that is not well supported, I just delegate the BSD box to run a strong PF firewall (which is what pfSense uses) in front of it all. Ubiquiti mesh wifi and RTSP stream play really nicely with it.

It's so easy to overcomplicate a routing setup which is probably why these off-the-shelf solutions are so popular, but I agree, I prefer to have less of a magic box approach to routing/firewalls whenever possible.

[1]: https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilte... [2]: https://mailing.openbsd.misc.narkive.com/jtIB9W3w/pf-packet-... [3]: https://docs.netgate.com/pfsense/en/latest/recipes/freebsd-p... [4]: https://forum.opnsense.org/index.php?topic=21739.0

Re: OPNsense: Open-source security platform

#119

Post by SeriousM »

random021 wrote: post #68
donmcronald wrote: post #16

Earlier quoted context omitted.

I always wanted to try it, but $8k / year for the cheapest stable release license isn’t in my universe for affordability. > It seems to have a similar architecture as a Ubiquiti controller. That’s a hell of an insult to be tossing around for an unreleased product. Lmao.

It’s pretty easy to build the stable version. https://docs.vyos.io/en/equuleus/contributing/build-vyos.htm...

The documentation about the build process is awesome, thanks!

And btw: > Everyone can build an LTS release image from the stable branch too. For 1.2.x, the branch is named “crux”. The image built from the branch is equivalent to the latest official LTS image.

Re: OPNsense: Open-source security platform

#120

Post by fellowmartian »

hnarn wrote: post #104
fellowmartian wrote: post #10

Earlier quoted context omitted.

Yeah I’m waiting for a good open source Linux-based firewall, it’s way overdue. Linux has surpassed FreeBSD in terms of networking, at least for the home/SMB router use case. I’m talking about Cake, eBPF, etc. I’m currently running Mikrotik x86 on a NUC, but their hardware support on x86 isn’t great. I’d rather switch to Vyos, but I’m too lazy to learn their CLI. Semi-related: OpenWRT is also genuinely not bad on x86…

> Linux has surpassed FreeBSD in terms of networking Can you elaborate on this?

As I said above, it's stuff like Cake, which is an advanced QoS scheduler that helps eliminate bufferbloat (very relevant for home networks). Additionally, eBPF and XDP will soon be integrated into standard firewalls, which should speed them up dramatically, allowing for crazy high speed (or power efficient) routing on commodity hardware.
Post reply on HN