Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OPNsense: Open-source security platform

opnsense.org

Post reply on HN
Print view View original

121–130 of 151 posts

Re: OPNsense: Open-source security platform

#121

Post by fellowmartian »

n8henrie wrote: post #96
fellowmartian wrote: post #10

Earlier quoted context omitted.

Yeah I’m waiting for a good open source Linux-based firewall, it’s way overdue. Linux has surpassed FreeBSD in terms of networking, at least for the home/SMB router use case. I’m talking about Cake, eBPF, etc. I’m currently running Mikrotik x86 on a NUC, but their hardware support on x86 isn’t great. I’d rather switch to Vyos, but I’m too lazy to learn their CLI. Semi-related: OpenWRT is also genuinely not bad on x86…

Same! Have you looked into IPFire? That's the one I had my eyes on.

I actually used to run it years back, but it unfortunately hasn't been updated very much since.

Re: OPNsense: Open-source security platform

#123

Post by stonogo »

ccmcarey wrote: post #74
stonogo wrote: post #67

Earlier quoted context omitted.

It's perfectly viable in the UK. The Optiplex 7050 is available for under a hundred pounds and the PSU tops out at 65W. It idles under eight watts. This is comparable with any other router capable of handling gigabit traffic. I think the misunderstanding is the assumption about form factor. The 7050 series is available in a case the size of a paperback book.

Where do you see those being available for under 100gbp!?

Available in plenty of second hand computer vendors: https://www.ebay.co.uk/itm/225601831181

Re: OPNsense: Open-source security platform

#124

Post by stonogo »

alias_neo wrote: post #72
stonogo wrote: post #67

Earlier quoted context omitted.

It's perfectly viable in the UK. The Optiplex 7050 is available for under a hundred pounds and the PSU tops out at 65W. It idles under eight watts. This is comparable with any other router capable of handling gigabit traffic. I think the misunderstanding is the assumption about form factor. The 7050 series is available in a case the size of a paperback book.

I'm willing to accept your point if you or they, can confirm that they are in fact talking about an optiplex that idles at 8W, which I doubt, for 43 dollars. Despite DELLs willingness to slap the same series number on everything from an ATX tower to a "paperback book", they are far from the same thing. I'm willing to accept I may be wrong, so let's see.

Here you go. https://i.dell.com/sites/csdocuments/Shared-Content_data-She...

First page, the one on the right. I don't see why you'd doubt an 8-watt idle, since it's basically a laptop processor and chipset. Please note that these models are available with both 35W and 65W TDP processors; I'm talking about the (generally cheaper) 35W models, of course.

Re: OPNsense: Open-source security platform

#125

Post by VTimofeenko »

voxadam wrote: post #100
n8henrie wrote: post #95

Earlier quoted context omitted.

NixOS is a Linux distro based on the nix package manager. There is a freebsd package for nix, I am 90% sure. NixOS on FreeBSD seems nonsensical, like saying Ubuntu on FreeBSD.

That's what I was thinking. The only reason that I thought Nix on FreeBSD as even remotely possessive is that, as I remember things, it's possible to run the Nix package manager on non-Nix systems.

You can run nix-the-package-manager on FreeBSD, so you can build stuff. However I think it would take a lot of novel and elegant boilerplate to have nix manage network config on a BSD system.

NixOS is a Linux distribution managed by nix-the-package-manager.

Re: OPNsense: Open-source security platform

#126

Post by kjs3 »

vogon_laureate wrote: post #118
alias_neo wrote: post #46

Earlier quoted context omitted.

I switched to pfSense from EdgeRouter a few years back, and find the firewall rules make _less_ sense. The reason is likely that I understand IPTables pretty well, where as the approach used in pfSense seems "abstract" in comparison. I'd certainly recommend grabbing something like a Protectli box (if power draw is a concern) or building a small server with NICs to install OPNSense on over the Ubiquiti stuff. For me,…

I'm the other way, I find IPTables less intuitive and featureful than PF. The way Netfilter/IPTables works under the hood seems much more over-complicated[1] than it needs to be (which is how I feel about a lot of Linux system stuff these days). The architecture of PF[2] (and thus how the rules get processed) just makes more sense to me. pfSense/OPNsense is just a stripped-down FreeBSD under the hood. If there are th…

I use exactly the same thing after I got tired of pfSense: straight OpenBSD, PF, unbound, and a couple of other native obsd things (starting to play with OpenBGPD for AS level filtering) on NUC-alikes (currently liking Protectli and Seeed). No pretty web interface, but the documentation is so good it was pretty trivial to set up. This has worked really well for several years now.

Note: like vogon said above, it's easy to overcomplicate things like this. If you go this route, start with the most basic configuration that works, and only go looking for 'tuning' or 'optimizing' if you run into a specific issue and can measure before-and-after improvements. Obsd does a very good job of working correctly out of the box, and if you follow the advice of some 'popular' PF tuning sites, you'll end up with tons of stuff you probably don't need, probably will interact in weird ways and will get you laughed at when you go looking for help. KISS.

One caveat: Don't expect to go to the obsd mailing lists or IRC channels for beginner support.

Re: OPNsense: Open-source security platform

#127

Post by kjs3 »

syntaxing wrote: post #91
buro9 wrote: post #65

Earlier quoted context omitted.

How does the link aggregation work? I get that OPNSense can do this, but do you need a switch with a capability to make sense of this? I'm considering moving from Unifi USG to OPNSense and have two Cat6a runs from one end of the house to the other (through the loft and it's not possible to add more runs without building/decorating work). Presently the two cables do WAN and LAN, but I've been curious about putting som…

You need a switch that can handle LAGG but I don’t think you need a particularly expensive or fancy switch. I run a TP-Link jetstream switch that supports LACP and was only $110 (same price as a 8 port lite ubiquti switch). It has 8 port PoE+ AND 2 port SFP. You have to run a omada controller (similar to a unifi controller) but you can buy a box (OC200) or just run a Docker image which is what I do. I find tbe TP-lin…

Alternatively, you can pick up a used switch from Cisco, Dell, etc. that have excellent support for LAGG and other useful things for significantly less than the TP-Link (as long as you don't need 10G). I think the last 2960Gs I picked up were less than US$30/pc. Down side is 1) they use more power, 2) bigger switches (24- or 48-ports) are much louder, and 3) not going to see any new OS updates for most of them. So you have lots of options.

Re: OPNsense: Open-source security platform

#128

Post by btobolaski »

syntaxing wrote: post #114
nvy wrote: post #44

Earlier quoted context omitted.

I've been looking at this as well. I'm currently running my gigabit fiber connection through a GPON-ethernet media converter and from there over Cat 6 to a ubiquiti Edgerouter-X. It does okay with hardware offloading enabled for things like ipsec and NAT, but it's taxing the CPU and I'd like to move to something with a little more headroom. Got any recommendations for something that can route beyond gigabit, when NAT…

You should checkout the new R862 mini pcs. You can get 3X 2.5 NIC and 2 SFP port with 10G support. The homenetworkguy did a great review on it. But overall, 10G works but only with nothing turned on. With IPS/IDS and proper MTU, you can get about 3 Gbps. But all this for sub $400 in a computer about the size of your hand is insane to me.

I think you mean R86S, I wasn’t able to find something relevant by R862. They’re pretty interesting. I am sort of looking to replace my R210ii and this fits the bill but downgrading cpu performance (for a great deal of efficiency gain) kind of feels bad.

Re: OPNsense: Open-source security platform

#129

Post by alias_neo »

stonogo wrote: post #124
alias_neo wrote: post #72

Earlier quoted context omitted.

I'm willing to accept your point if you or they, can confirm that they are in fact talking about an optiplex that idles at 8W, which I doubt, for 43 dollars. Despite DELLs willingness to slap the same series number on everything from an ATX tower to a "paperback book", they are far from the same thing. I'm willing to accept I may be wrong, so let's see.

Here you go. https://i.dell.com/sites/csdocuments/Shared-Content_data-She... First page, the one on the right. I don't see why you'd doubt an 8-watt idle, since it's basically a laptop processor and chipset. Please note that these models are available with both 35W and 65W TDP processors; I'm talking about the (generally cheaper) 35W models, of course.

I hear you. But we're crossing wires here.

I doubt the original poster is talking about the small "book" sides micro form factor at ~$40.

I expect that one to cost at least double, if not more (a quick eBay search outs the micro form factor at closer to a £200 average), and the tower form factor, with it's 240W PSU is likely to be drawing much more than ~8W in a typical configuration.

My point stands; if you want to spend £35 on an x86 machine, youll pay in electricity costs, spend ~£200+ and overall youll likely save money overall if it lasts a decent period.

Re: OPNsense: Open-source security platform

#130

Post by syntaxing »

btobolaski wrote: post #128
syntaxing wrote: post #114

Earlier quoted context omitted.

You should checkout the new R862 mini pcs. You can get 3X 2.5 NIC and 2 SFP port with 10G support. The homenetworkguy did a great review on it. But overall, 10G works but only with nothing turned on. With IPS/IDS and proper MTU, you can get about 3 Gbps. But all this for sub $400 in a computer about the size of your hand is insane to me.

I think you mean R86S, I wasn’t able to find something relevant by R862. They’re pretty interesting. I am sort of looking to replace my R210ii and this fits the bill but downgrading cpu performance (for a great deal of efficiency gain) kind of feels bad.

Aha yeah, I’m on mobile so it was a typo. I currently run a fanless mini pc with N100 and 4X 2.5G which has been great. If you don’t need SFP and can live with LAGG + 2.5G, you can probably get pretty similar real world speeds compared to a 10G SFP line.
Post reply on HN