Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Addressing Changes to PfSense Plus Home+Lab

netgate.com

Post reply on HN
Print view View original

41–50 of 63 posts

Re: Addressing Changes to PfSense Plus Home+Lab

#41

Post by lanman95 »

n8henrie wrote: post #39

Lots of comments about moving to OPNSense -- anyone using something Linux-based that they would recommend as a comparable alternative? My impression is that this might not exist yet (the currently available projects are significant lacking in either features or reliability), and that my odds of getting something user-friendly with tools like pfBlockerNG are even slimmer. I always feel so handicapped when something br…

I am really happy with IPFire on my home network. It doesn't have all the advanced features that PF/OPNSense have, but it's suitable for my needs.

Re: Addressing Changes to PfSense Plus Home+Lab

#42

Post by fostware »

geek_at wrote: post #16
LeoPanthera wrote: post #10

I migrated to OPNsense during the wireguard fiasco. It was an extremely boring migration, and I mean that as compliment. It's been quietly doing its job ever since, with a minimum of fuss.

I have thought about moving from pfsense to opnsense but in my test install I had a feeling it has fewer features (and messy UI). For example something I use pretty heavily is pfblocker that automatically geo-blocks ips from different countries that most attack my homelab (Russia, USA, china ,etc..) from accessing my homelab Is there something like this on opnsense?

Aliases can consist of one or more countries (tick boxes) pulled from MaxMind's GeoIP DB. Doesn't use ASN-based sources unfortunately. Can be used in source and destination networks, IPv4&/IPv6 , just like pfSense.

Re: Addressing Changes to PfSense Plus Home+Lab

#43

Post by BLKNSLVR »

geek_at wrote: post #16
LeoPanthera wrote: post #10

I migrated to OPNsense during the wireguard fiasco. It was an extremely boring migration, and I mean that as compliment. It's been quietly doing its job ever since, with a minimum of fuss.

I have thought about moving from pfsense to opnsense but in my test install I had a feeling it has fewer features (and messy UI). For example something I use pretty heavily is pfblocker that automatically geo-blocks ips from different countries that most attack my homelab (Russia, USA, china ,etc..) from accessing my homelab Is there something like this on opnsense?

I use it on OPNSense and it seems to work fine. There may be a Megamind (edit: MaxMind, not Megamind) account plugin setup out something to get it going, but if I worked it out, then you should be right.

I use it to flat out block all incoming and outgoing connections to a certain small group of countries. More out of curiosity than necessity.

It's also got a Crowdstrike interface for more dynamic blocking.

Re: Addressing Changes to PfSense Plus Home+Lab

#44

Post by BLKNSLVR »

alias_neo wrote: post #18
geek_at wrote: post #16

Earlier quoted context omitted.

I have thought about moving from pfsense to opnsense but in my test install I had a feeling it has fewer features (and messy UI). For example something I use pretty heavily is pfblocker that automatically geo-blocks ips from different countries that most attack my homelab (Russia, USA, china ,etc..) from accessing my homelab Is there something like this on opnsense?

This is important for me too. From my searching, they have "GeoIP aliases" which is supposed to be their alternative to PfBlocker-NG; I have no idea if/how it functions as I haven't made the mode yet, but this is a deal breaker if it doesn't work the way I need.

It works as far as I can tell. I use it, and the logs show that it blocks connections to and from IP addresses associated with the selected countries.

Re: Addressing Changes to PfSense Plus Home+Lab

#45

Post by alias_neo »

Brian-Puccio wrote: post #30
alias_neo wrote: post #27

Earlier quoted context omitted.

That's kind of what I was expecting; but do you have any tips? Did you just do it from memory? I was thinking I'll screenshot the major config screens and interface layouts, my BGP configs etc, then work from them.

Yes, screenshot things. But also export your config because you will inevitably forget to screenshot a thing or seven and you can poke around the config export for that port number or IP address. Worst case scenario, you can spin up a VM of pfsense quickly and reimport the config if you have to.

I have off-box backups of my configs. Thanks for the VM idea; sometimes I forget to use VMs to do things "embedded" devices usually do for me; switches, routers, etc!

There's going to be a point soon where I have two fiber providers (and thus two WAN links) for a little while, I'll try move the existing pfSense off of my Protectli box to a VM, keep everything up for the family while I configure OPNSense on the Protectli, then if I do it right, I can move everything over with minimal reconfiguration.

Re: Addressing Changes to PfSense Plus Home+Lab

#46

Post by throw0101a »

kortilla wrote: post #15

Has Netgate provided any meaningful new features to pfsense over the last 5-10 years? Or is it just “support” for essentially what pfsense was a decade ago?

> Or is it just “support” for essentially what pfsense was a decade ago?

"Just"?

I'm sure all of use nerds and geeks on HN think commercial support is often not important, but there are plenty of SMEs that need to de-risk some things when running their infrastructure.

Re: Addressing Changes to PfSense Plus Home+Lab

#47

Post by alias_neo »

deadfece wrote: post #35
alias_neo wrote: post #17

Earlier quoted context omitted.

Got any tips for the migration? I've been meaning to do it for a while, but I really need to limit down time or my wife and kids will bury me; preferably need to do it over an evening while they're all asleep. I only have the one piece of hardware so I need a record of the configs somehow to refer to as I do the migration. Perhaps also some sort of backup so I can restore it in a pinch if I can't get OPNSense set up…

When switching from pfsense to opnsense, I had to move everything to opnsense manually (and I do mean manually, not just updating terraform). It only took about 20 minutes to put things back on both members and have my tunnels up and going again, even counting my very specific customizations. It was anti-climactic and worked so well as to be boring, which is the absolute highest compliment that a replacement and cuto…

Thanks for the info; I tried OPNSense originally but I had an issue with PPP on my old internet provider I never could get working so I switched to pfSense reluctantly and it just worked.

I doubt I have anywhere near the networking knowledge you have, so some of the more complex things I have set up; like my BGP routes for my Kubernetes clusters and my VLANs/trunks etc, that have taken a lot of tinkering might take me quite some time. I expect the way they're configured will be different, terminology might be different, and of course the UI will be different, so I can't just do it by reference.

I have no problem taking my time, so long as we have the basic networking we need for family and working from home.

Re: Addressing Changes to PfSense Plus Home+Lab

#48

Post by deadfece »

alias_neo wrote: post #47
deadfece wrote: post #35

Earlier quoted context omitted.

When switching from pfsense to opnsense, I had to move everything to opnsense manually (and I do mean manually, not just updating terraform). It only took about 20 minutes to put things back on both members and have my tunnels up and going again, even counting my very specific customizations. It was anti-climactic and worked so well as to be boring, which is the absolute highest compliment that a replacement and cuto…

Thanks for the info; I tried OPNSense originally but I had an issue with PPP on my old internet provider I never could get working so I switched to pfSense reluctantly and it just worked. I doubt I have anywhere near the networking knowledge you have, so some of the more complex things I have set up; like my BGP routes for my Kubernetes clusters and my VLANs/trunks etc, that have taken a lot of tinkering might take m…

With regard to bgp, vlans, subinterfaces etc.

Those things work the same way in opnsense. Most of my conversion was just data entry of the particulars.

I try to keep my main fws as simple as I can, for the benefit of the household, but I do get carried away with home automation and IaC/CM to my firewalls.

Re: Addressing Changes to PfSense Plus Home+Lab

#49

Post by alias_neo »

BLKNSLVR wrote: post #44
alias_neo wrote: post #18

Earlier quoted context omitted.

This is important for me too. From my searching, they have "GeoIP aliases" which is supposed to be their alternative to PfBlocker-NG; I have no idea if/how it functions as I haven't made the mode yet, but this is a deal breaker if it doesn't work the way I need.

It works as far as I can tell. I use it, and the logs show that it blocks connections to and from IP addresses associated with the selected countries.

Excellent, thanks for the confirmation.

Re: Addressing Changes to PfSense Plus Home+Lab

#50

Post by auveair »

dewey wrote: post #38
auveair wrote: post #32

Earlier quoted context omitted.

> Hey, listen, the company is putting a lot of effort into pfSense for which they are not paid. And? pfsense uses thousands of packages that they don't pay for either, that's the spirit of open source, I can't understand who post this on HN without understanding it. @dang: Can we ban these comments? Lately they arrive like clockwork and bring very little to the comments, especially since it doesn't seem to be talking…

> pfsense uses thousands of packages that they don't pay for either, that's the spirit of open source You are miss-understanding what open source means. It doesn't mean everything has to be free. Many companies are built on top of open source software which allows them to do exactly that in their license. You also don't know if pfsense sponsors packages or contributes code to the packages they are using. It's the rig…

> It's the right of every open source software author to continue working on their software privately under a different license, and that's exactly what happened here.

Yep, and nobody had any qualms about it in this thread, which is why I find such posts to be tiresome to read.

> Just because you are not happy that you don't have access to their software for free any more doesn't mean it's against the open source spirit.

This is exactly what I'm complaining about, I never said I wasn't happy.

Post reply on HN