Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Addressing Changes to PfSense Plus Home+Lab

netgate.com

Post reply on HN
Print view View original

21–30 of 63 posts

Re: Addressing Changes to PfSense Plus Home+Lab

#21

Post by LeoPanthera »

geek_at wrote: post #16
LeoPanthera wrote: post #10

I migrated to OPNsense during the wireguard fiasco. It was an extremely boring migration, and I mean that as compliment. It's been quietly doing its job ever since, with a minimum of fuss.

I have thought about moving from pfsense to opnsense but in my test install I had a feeling it has fewer features (and messy UI). For example something I use pretty heavily is pfblocker that automatically geo-blocks ips from different countries that most attack my homelab (Russia, USA, china ,etc..) from accessing my homelab Is there something like this on opnsense?

OPNsense supports blocklists in Unbound: https://docs.opnsense.org/manual/unbound.html#blocklists

However what you're saying doesn't make any sense. All incoming connections, from anywhere, are blocked by default. That's true in both pfSense and OPNsense.

Are you saying that you allow all incoming connections, but then block specific countries? Because that's mad, and given the existence of VPNs, pointless.

Re: Addressing Changes to PfSense Plus Home+Lab

#22

Post by onetimeuse92304 »

kortilla wrote: post #14
onetimeuse92304 wrote: post #12

Earlier quoted context omitted.

Also, what we forget is that if we are not paying, somebody else is paying. And somebody else is very likely not aligned with our interests. There is this conventional wisdom that a lawyer is not really your lawyer until it is you who is paying them. I think it has much broader application and you want to be paying for technology. It is naive to think you can accept services of say Facebook, not pay a dime for it and…

This is not the right mental model because: - software is copyable for free - contributing to open source doesn’t make the developers your agents like paying a lawyer does

It is good mental model because whoever is producing the software is human.

It does not matter if there is zero cost to copying the software.

What matters is that somebody put an effort into doing something and now they are seeing lots of people using it for free. It is in human nature to try to benefit from it and most people have a mental model that they deserve to be compensated for doing something beneficial to another.

Most people are not seeing incremental cost of adding another user (effectively zero or non zero), what they are seeing is total cost of producing the software divided by the number of users. Then they see that some users are paying and some users are not.

Re: Addressing Changes to PfSense Plus Home+Lab

#23

Post by hfjfjjhkgh »

kortilla wrote: post #14
onetimeuse92304 wrote: post #12

Earlier quoted context omitted.

Also, what we forget is that if we are not paying, somebody else is paying. And somebody else is very likely not aligned with our interests. There is this conventional wisdom that a lawyer is not really your lawyer until it is you who is paying them. I think it has much broader application and you want to be paying for technology. It is naive to think you can accept services of say Facebook, not pay a dime for it and…

This is not the right mental model because: - software is copyable for free - contributing to open source doesn’t make the developers your agents like paying a lawyer does

Being copyable for free is one thing but there is a cost to create ... Developer brain power is needed for that ...

Re: Addressing Changes to PfSense Plus Home+Lab

#24

Post by omnicognate »

ohcomments wrote: post #20

Here we go again.... I've been resisting the change from pfSense to OPNsense for a while now but I start to really think I should just move on and get it done. All these f* ups with licensing and b s* from Netgate starts to be annoying. Just make a 50 or 100 license for home users who need / want to deploy a better router / firewall and get done with it! I moved from CE to this PeshPlus thing because supposedly CE wa…

I briefly used pfSense before replacing it with a plain Arch installation (any distro would do just as well - I just use Arch for everything else so it's an easy choice).

In a moderately complex home setup with wireguard to access my home network remotely, multiple VLANs/SSIDs (including one to firewall off IoT things and one that routes wan traffic to a vpn, again via wireguard), my own DNS server, a filtering web proxy for the kids, etc., I haven't encountered anything pfSense or similar would have made any easier for me. It's all achievable by editing relatively straightforward config files. The most complex bit is the firewall, but I have a terse, straightforward nftables config that does what I need and that I understand fully. I didn't really see the value in putting a layer of GUI stuff on top of it and then having to keep up with changes to that layer, and in the process obscuring what's actually going on.

Re: Addressing Changes to PfSense Plus Home+Lab

#25

Post by ryan29 »

kortilla wrote: post #15

Has Netgate provided any meaningful new features to pfsense over the last 5-10 years? Or is it just “support” for essentially what pfsense was a decade ago?

They added boot environments to pfSense+. I think they use ZFS snapshots. You can take a snapshot, set it as the default boot environment, do some updates, and if things go bad you can reboot to get back to the snapshot you set as the default.

I’d like to see some kind of more resilient upgrade process where a pre-upgrade snapshot is taken, the firewall updates and reboots, some kind of watchdog tries to hit a well known endpoint, and the whole thing automatically rolls back to the known good config if it goes X minutes without being able to connect after the update. That would mitigate the riskiest part of updating remotely.

As for new features, once you have a reliable firewall, what more do you want? I wouldn’t complain about a better traffic shaper experience, but OpnSense did that and the “easier” traffic shaper in OpnSense isn’t as flexible IIRC.

For licensing, I don’t hate the TAC-Lite approach. They could make it more clear it’s a lifetime thing (I hope I’m right about that) and I hate begging for installers, but at least they aren’t forcing subscriptions yet. I fear that’s coming one day since it would force us to switch to something else and pfSense is working ok for us ATM.

Re: Addressing Changes to PfSense Plus Home+Lab

#27

Post by alias_neo »

LeoPanthera wrote: post #19
alias_neo wrote: post #17

Earlier quoted context omitted.

Got any tips for the migration? I've been meaning to do it for a while, but I really need to limit down time or my wife and kids will bury me; preferably need to do it over an evening while they're all asleep. I only have the one piece of hardware so I need a record of the configs somehow to refer to as I do the migration. Perhaps also some sort of backup so I can restore it in a pinch if I can't get OPNSense set up…

I'm afraid I did it the slow way, and just nuked the router and set up OPNSense from scratch. In older versions it was possible to import a PfSense backup - with a few glitches, but they're too different now. I think the slow way is the only way.

That's kind of what I was expecting; but do you have any tips? Did you just do it from memory? I was thinking I'll screenshot the major config screens and interface layouts, my BGP configs etc, then work from them.

Re: Addressing Changes to PfSense Plus Home+Lab

#28

Post by alias_neo »

LeoPanthera wrote: post #21
geek_at wrote: post #16

Earlier quoted context omitted.

I have thought about moving from pfsense to opnsense but in my test install I had a feeling it has fewer features (and messy UI). For example something I use pretty heavily is pfblocker that automatically geo-blocks ips from different countries that most attack my homelab (Russia, USA, china ,etc..) from accessing my homelab Is there something like this on opnsense?

OPNsense supports blocklists in Unbound: https://docs.opnsense.org/manual/unbound.html#blocklists However what you're saying doesn't make any sense. All incoming connections, from anywhere, are blocked by default. That's true in both pfSense and OPNsense. Are you saying that you allow all incoming connections, but then block specific countries? Because that's mad, and given the existence of VPNs, pointless.

No, there is a feature in Pfsense with Pf-Blocker-NG where you can open a port to a service as usual, say a web-server, then use an alias for the source address to only allow incoming connections from, say, your own country.

Useful for if you're roaming around and need access to that service from your laptop/mobile without a VPN, but also prevents attacks from countries you're unlikely to access it from.

Re: Addressing Changes to PfSense Plus Home+Lab

#29

Post by wtcactus »

Well, I was still using pfSense over opnSense due to a bit more polish and having proper Tailscale integration.

As soon as Tailscale has proper integration on opnSense, I'm definitively moving on. The CE version of pfSense has very outdated packages and that probably has an impact on security, which, for a Firewall, is a big no.

BTW: Does anyone know why Tailscale doesn't provide a proper package (with graphical interface) for opnSense, like it does for pfSense? I was under the impression that it would need very few changes for it to work.

Re: Addressing Changes to PfSense Plus Home+Lab

#30

Post by Brian-Puccio »

alias_neo wrote: post #27
LeoPanthera wrote: post #19

Earlier quoted context omitted.

I'm afraid I did it the slow way, and just nuked the router and set up OPNSense from scratch. In older versions it was possible to import a PfSense backup - with a few glitches, but they're too different now. I think the slow way is the only way.

That's kind of what I was expecting; but do you have any tips? Did you just do it from memory? I was thinking I'll screenshot the major config screens and interface layouts, my BGP configs etc, then work from them.

Yes, screenshot things.

But also export your config because you will inevitably forget to screenshot a thing or seven and you can poke around the config export for that port number or IP address.

Worst case scenario, you can spin up a VM of pfsense quickly and reimport the config if you have to.

Post reply on HN