looking to replace my firewall reddit / freebsd ---------------------------------------------------------------------- Charming-Barracuda86 · 2022-04-28 12:05 Soo I currently run a openbsd bhyve VM for my router It runs just strait pf as well as dhcp and DNS I'm looking at whether I should look at replacing or moving it I can't zfs send it due to some other issues on my host so I have to rebuild from scratch regardless Should a look a using something like a small form factor computer? Or stick with VM STRAIT PF or look at going with one of the senses? Edit:. I know it seems like alot of random question but I have a fair range of end of life PC's like Lenovo m90 computers I could use as a hardware device and the new server running freebsd was setup to handle alot of VM. So I can honestly go either way ---------------------------------------------------------------------- moviuro · 2022-04-28 12:14 I had previously FreeBSD as a router node in my setup with pf and DHCP server running "bare" on it, and unbound (DNS) in a jail. I am changing that to have one machine dedicated to firewalling because I don't want interference from my apps running on the FreeBSD machine with "core" networking daemons. you should run pf, DHCP on your FreeBSD machine if: * you are sensitive to the power bill (one fewer machine to power!) * you don't use specific pf improvements that are OpenBSD-only * you don't mind mixing usage on the FreeBSD machine (it probably runs other things than just DNS and pf, right?) ---------------------------------------------------------------------- Charming-Barracuda86 · 2022-04-28 12:28 The current setup is a VM that only does those tasks as it has the Wan vlaned into it so I make sure as the only external point on my network it performs no other actions whatsoever ---------------------------------------------------------------------- dannomac · 2022-04-28 15:31 My current setup is an [APU2](https://pcengines.ch/apu2.htm), running straight FreeBSD 12 (13 soon) and IPFW. It can sustain NAT at roughly 820Mbps. With a bit of optimization I bet I could do better, but I haven't spent a lot of time on it. For something like a firewall I generally prefer dedicated devices rather than a VM. ---------------------------------------------------------------------- Gornergy · 2022-04-28 23:28 For whatever it's worth, I've been using a pfsense VM (on ESXi) for a few years and have zero complaints. That being said, there have been times I've wanted to reboot the ESXi machine without losing internet, and I'm also taking notes for whenever my next big upgrade is. I'm seriously considering one of the netgate pfsense boxes. ---------------------------------------------------------------------- PkHolm · 2022-04-29 00:53 Look to APU2 from PC Engines. You will not find such good Intel NICs for that money anywhere else. I have one myself for a year and use as FreeBSD router, works like a charm. P.S, You do not need ZFS send to move server out of VM. normal "cp -a" works just fine. ---------------------------------------------------------------------- AntoineDarquier · 2022-04-29 09:32 You can choose pfSense or OPNsense or just pure FreeBSD. The benefit of using pure FreeBSD is that you will gain a better understanding of how the firewall works, and gain the knowledge that will allow you to better configure the firewall. Another advantage of FreeBSD is that you are not bound by the limitations of pfSense and OPNsense. There are features that FreeBSD has that are not present in the specialized firewall systems. But you also need to know whether you need this or not. An advantage of pfSense and OPNsense is that you will need less time for the setup. ---------------------------------------------------------------------- Charming-Barracuda86 · 2022-04-29 09:36 Yeah. So my current setup and rules using just pf has been awesome and given me some great ideas of how it all works... I'm not a bit more interested in getting some reporting and monitoring up and running, I run 3 clans at home a standard, a guest, and my completely isolated home automation network. So I'm now more interested in the reporting and security advantages I can get from both of these products