Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OPNsense: Open-source security platform

opnsense.org

Post reply on HN
Print view View original

141–150 of 151 posts

Re: OPNsense: Open-source security platform

#141

Post by ZeroSolstice »

_ea1k wrote: post #111
ZeroSolstice wrote: post #88

Earlier quoted context omitted.

> About a year or two after install, reboots and power-offs stopped working. The system just hangs instead after printing out a message about USB, and I cannot figure out for the life of me what's wrong. My initial read here would be that this is where serial port / console redirection is happening. There should be settings in the BiOS you can look at however I don't know how limited PC's are in their options / funct…

tbh, at this point, I'd argue that not supporting arm is a bad business move. There are decent ARM router boards out there. They could likely do well selling one of them as a supported solution.

You could be right but thats a big gap between "could likely do well selling..." and actually having a market and reliable customers.

What if thats not their business model? What if it requires hiring or finding a dedicated ARM developer? What about security? If a zero day comes out now what you have (3) different architectures to support and test. Even if they offered it as a supported solution would most of the people complaining fund the work through support. Probably not, because they expect the software to just "work" for them, for free.

I looked through the forum on one of the first ARM[1] posts and as expected (2) pages in and it becomes a tech support thread for people who want to try the latest but be handed the answers. For a project where they document[2] the development workflow, architecture, and environment its a bit difficult to understand the complaints when its opensource. Clone the repo and get to work.

[1] https://forum.opnsense.org/index.php?topic=12186.0 [2] https://opnsense.org/developers-invitation/

Re: OPNsense: Open-source security platform

#142

Post by ThatMedicIsASpy »

illiac786 wrote: post #135
ThatMedicIsASpy wrote: post #83

Earlier quoted context omitted.

I recently switched to RouterOS. The learning curve was a bit high to me. I'm still tinkering with it but I got my main things working - vlans, default internet access out via vpn, one port (internet accessible server) routed without vpn. I learned a lot in the last 3 weeks it also helped me understand networking a lot more. Sure I had to do a lot of trial and error or figure out why things don't work but in the end…

May I ask which VPN you are using? I have tried several and they are always blocked somewhere. I tried: Mullvad, IVPN, ProtonVPN. So far the only one which is never blocked is cloudflare’s WARP but I suspect it’s because it’s newish (the VPN functionality of WARP is at least, originally it was mostly about DNS). But it has severe performance problems when running on a router as far as I can tell, I suspect it has to…

I use mullvad with the specific one being de-dus-wg-001 (Germany Düsseldorf Wireguard 001) most of the time.

Sounds like an issue that could be solved by routing specific traffic/domains not over the VPN?

Re: OPNsense: Open-source security platform

#143

Post by illiac786 »

ThatMedicIsASpy wrote: post #142
illiac786 wrote: post #135

Earlier quoted context omitted.

May I ask which VPN you are using? I have tried several and they are always blocked somewhere. I tried: Mullvad, IVPN, ProtonVPN. So far the only one which is never blocked is cloudflare’s WARP but I suspect it’s because it’s newish (the VPN functionality of WARP is at least, originally it was mostly about DNS). But it has severe performance problems when running on a router as far as I can tell, I suspect it has to…

I use mullvad with the specific one being de-dus-wg-001 (Germany Düsseldorf Wireguard 001) most of the time. Sounds like an issue that could be solved by routing specific traffic/domains not over the VPN?

That's possible??

Re: OPNsense: Open-source security platform

#144

Post by shmerl »

illiac786 wrote: post #140
shmerl wrote: post #64

Earlier quoted context omitted.

I think dhcp6c is the problem? FreeBSD provides a better option, but they aren't using it.

They are planning to switch to a new dhcp client, don’t remember which ones. This was as of two months ago.

Ah, nice. Did they give any ETA?

Re: OPNsense: Open-source security platform

#146

Post by alias_neo »

dipole wrote: post #131
alias_neo wrote: post #49

Earlier quoted context omitted.

Got any documentation on how a setup like this might be implemented? I'm curious how the interfaces float between nodes to keep the network up. Is it relying mostly on switches for the physical connectivity, including upstream?

I use managed switches for this, L2 units are fine if you let opnsense do all the inter-VLAN routing. All network devices go into the switches which are connected to the servers. As CptKriechstrom mentioned my PON or modem is connected to a switch and is tagged into a VLAN, which enters opnsense through that specific virtual interface.

I use (EdgeMAX) managed switches, so that shouldn't be an issue, I understand the concept now of what I'd need to do but I'm going to have to find a tutorial or something as I wouldn't know how exactly to set that up.

Re: OPNsense: Open-source security platform

#147

Post by apple4ever »

kjs3 wrote: post #127
syntaxing wrote: post #91

Earlier quoted context omitted.

You need a switch that can handle LAGG but I don’t think you need a particularly expensive or fancy switch. I run a TP-Link jetstream switch that supports LACP and was only $110 (same price as a 8 port lite ubiquti switch). It has 8 port PoE+ AND 2 port SFP. You have to run a omada controller (similar to a unifi controller) but you can buy a box (OC200) or just run a Docker image which is what I do. I find tbe TP-lin…

Alternatively, you can pick up a used switch from Cisco, Dell, etc. that have excellent support for LAGG and other useful things for significantly less than the TP-Link (as long as you don't need 10G). I think the last 2960Gs I picked up were less than US$30/pc. Down side is 1) they use more power, 2) bigger switches (24- or 48-ports) are much louder, and 3) not going to see any new OS updates for most of them. So yo…

Old Brocade switches are the sweet spot. Cheap and OS is still updatable!

Re: OPNsense: Open-source security platform

#148

Post by kjs3 »

apple4ever wrote: post #147
kjs3 wrote: post #127

Earlier quoted context omitted.

Alternatively, you can pick up a used switch from Cisco, Dell, etc. that have excellent support for LAGG and other useful things for significantly less than the TP-Link (as long as you don't need 10G). I think the last 2960Gs I picked up were less than US$30/pc. Down side is 1) they use more power, 2) bigger switches (24- or 48-ports) are much louder, and 3) not going to see any new OS updates for most of them. So yo…

Old Brocade switches are the sweet spot. Cheap and OS is still updatable!

I shall check those out; thanks for the tip. I will say I checked and it looks like my elderly Dell switches have gotten an update in the 2020s, so perhaps it's just Cisco who said "nope...we're done with IOS 12".

Re: OPNsense: Open-source security platform

#149

Post by nprateem »

illiac786 wrote: post #137
nprateem wrote: post #109

Earlier quoted context omitted.

They also like to tell you why you're wrong for wanting wireguard (so it's for your own good they don't support it) instead of letting you make up your own mind. No thanks.

On that front unfortunately OPNsense is the same. But there’s a plugin at least.

No, opnsense has guides for using wireguard in various setups. See their road warrior tutorials for example.

Re: OPNsense: Open-source security platform

#150

Post by senectus1 »

vanillax wrote: post #12

I run OPNsense pretty much stock + unbound + adguard home. Does anyone have a security hardening guide? I feel like I must be missing a few key things to make it self-hosted ready?

As you can imagine its pretty "Hard" by default...

but you should make sure you didn't turn dumb things on like WebUI/SSH acces from WAN etc..

this is a good thread on the subject https://forum.opnsense.org/index.php?topic=22117.0

Post reply on HN