PfSense 2.2-Release Now Available • Hacker News Board

Re: PfSense 2.2-Release Now Available

#31

Post by dexcs » Wed, Jan 28, 2015, 9:05 AM UTC

anderiv wrote: post #16

dexcs wrote: post #11

We use it with about 30 offices, all connected via openvpn. 180GB transfer every day. No problem for months.... Hell of a software!

Curious why you chose OpenVPN for your site-to-site links. I use it extensively for mobile VPN users, but for an "infrastructure" VPN, I use IPsec, which I find to be a much superior solution for that use case than OpenVPN.

Maybe it's just one of those "feelings" but i think it's way more flexible... :)

Re: PfSense 2.2-Release Now Available

#32

Post by not_with_retard » Wed, Jan 28, 2015, 9:17 AM UTC

tmp00110011 wrote: post #10

It still ships an oudated port of PF. Horrible. Go run OpenBSD instead.

Not only that, but the creator of pfsense seems to believe that it's just as secure as OBSD, and talks shit on Twitter all the time.

These two things have turned me off of using pfsense for good, as he obviously understands very little about security, which is kind of important in this area.

Re: PfSense 2.2-Release Now Available

#33

Post by feld » Wed, Jan 28, 2015, 12:36 PM UTC

olavgg wrote: post #13

feld wrote: post #7

Earlier quoted context omitted.

You could have used it before with a gif tunnel. That's the way I've been doing 6rd on vanilla FreeBSD without any 6rd support. edit: Here's what you put in rc.conf cloned_interfaces="gif0" ipv6_activate_all_interfaces="YES" ifconfig_gif0="tunnel $MYIPv4 $THEIRIPv4" ifconfig_gif0_ipv6="inet6 alias $MYIPv6 $THEIRIPv6 prefixlen 128" ipv6_defaultrouter="$THEIRIPv6 -mtu 1280"

Great! Thanks!

This does have one limitation -- you cannot reach other IPv6 addresses also using the same 6rd gateway. It just doesn't work without handling the full 6rd protocol. But if you just want IPv6 to the wider internet and don't care about connecting to other users on your ISP over v6 this is a reasonable solution.

Re: PfSense 2.2-Release Now Available

#34

Post by feld » Wed, Jan 28, 2015, 12:37 PM UTC

gaadd33 wrote: post #15

tmp00110011 wrote: post #10

It still ships an oudated port of PF. Horrible. Go run OpenBSD instead.

Does OpenBSD/newer PF have better throughput on 10Gbe+ hardware? I've heard that OpenBSD/PF tends to run into issues due to giant lock and SMP issues. Since you seem knowledgeable, any pointers to information about that?

everything I've seen indicates OpenBSD pf wins on slower single cores but on fast multi core hardware FreeBSD pf wins.

Re: PfSense 2.2-Release Now Available

#35

Post by feld » Wed, Jan 28, 2015, 12:38 PM UTC

organsnyder wrote: post #25

peckrob wrote: post #21

Earlier quoted context omitted.

I run this exact same setup (pfSense-based Mini-ITX router and several UAP-ACs), and it works outstanding. I had used DD-WRT for several years, but having hack pile up on top of hack to keep things running on DD-WRT. When we moved to a larger house, we could no longer adequately cover the house from a single router/access point combo, so I took the leap and built a pfSense machine. Absolutely don't regret it. After g…

I tried running the Ubiquiti controller software on the pfSense box for a while, but it was a pain - it took 5-10 minutes to start up, and it was lost whenever I did a pfSense upgrade. I've found it much easier to just point the access points at a general-purpose server (on-site if available, or on a remote VPS that I have already).

The startup time was a weird combination of unifi/java/freebsd. I haven't seen it in some time.

Re: PfSense 2.2-Release Now Available

#36

Post by listic » Wed, Jan 28, 2015, 8:24 PM UTC

htilonom wrote: post #12

listic wrote: post #8

Is ARM support on the radar? There is more and more capable ARM hardware by the day, while x86 is not getting any cheaper. I would be happy to try pfSense on something like BPI-R1 (dual-core 1 GHz Cortex-A7, Wi-Fi, etc., $69 for board) http://www.aliexpress.com/store/product/Newest-arrive-BPI-R1... http://www.bananapi.com/?layout=edit&id=59

MIPS is I believe planned first. Check out Netgate (company behind Pfsense), they already have development boards with MIPS. Bigger upcoming feature is bhyve hypervisor on Pfsense :D

I can't see where any trace of MIPS products by Netgate. Are you sure? http://store.netgate.com/

It looks like ARM and MIPS support was on their radar almost 5 years ago https://blog.pfsense.org/?p=472 so I guess we should not get our hopes high yet.