pfSense just messed with their userbase again, maybe its time to stop using it? reddit / selfhosted ---------------------------------------------------------------------- thekrautboy · 2023-10-28 00:08 *I was surprised to not see any post about this here yet, so here it is i guess.* **Netgate (the company who runs pfSense) has just announced serious changes to their "free" so called "Home+Lab" license of pfSense.** [Here is the link to their offical blog post.](https://www.netgate.com/blog/addressing-changes-to-pfsense- plus-homelab) # Background: Netgate have offered a free and opensource version of pfSense, called the CE (Community Edition). They also offered a version called "pfSense Plus" which was paid and offered a few more features but also support from Netgate, which is of course perfectly fine and very common (look at Proxmox for example). A while ago (1,5 years) they introduced "**Home+Lab**" as a product and license version in order for casual users and "homelabbers" to dip a toe into their commercial offerings which has more features than the CE. Basically like "here you can use your enterprise version for free, but its a bit limited of course". The obvious goal there is to motivate users to switch from the free CE to a paid version, again nothing wrong with that. [Portainer for example does this too](https://www.portainer.io/take-3). Because of this, users switched from the "always" free CE version to the "Home+Lab" version, upgrading their installations and enjoying a few more features. According to Netgate, thousands of users have installed it. Great! # Now But just now [Netgate have announced](https://www.netgate.com/blog/addressing-changes-to-pfsense- plus-homelab) major changes to this, out of the blue, **without any prior notice**. The free "Home+Lab" version is no longer available for download, its just gone. As a reason they cite that thirdparty sellers (on Aliexpress etc. i imagine) were downloading the "better" version of pfSense, aka the "Home+Lab" version, and installing it on their hardware appliances and then selling them. Without Netgate seeing any revenue from this. Please see [their blogpost](https://www.netgate.com/blog/addressing- changes-to-pfsense-plus-homelab) for all the details. But one crucial point is that anyone who is currently running their "Home+Lab" version, can keep running it (yay!) but they also say that **future upgrades and bugfixes may require a subscription**. So basically, users installed a free "better" version, which now doesnt exist anymore, and to continue using it with updates, they "might" need to pay a subscription fee. Something as crucial like a firewall appliance should be kept up to date for security, so just ignoring that is not really a option. And Netgate also state that if you have to reinstall your current "Home+Lab" version, they cannot provide that for free to you. And those subscriptions apparently come at a very high price. **Are you willing to pay $400/year for your firewall software when youre only using it privately in your small homelab?** Paying for software, or any product, is not a bad thing. And companies need to make money, they need to pay employees. This should be obvious. There is no problem with that in itself. But the way this was done, telling their userbase for quite a while to try out this free version of the premium product, and then pulling the rug away underneath the feet, is just plain wrong and fucked up. *"Okay whatever, then just switch back to the actual free CE version!"* Great idea, but apparently thats not so super easy. **Lawrence Systems** have already made a excellent video summing up all these changes. I would recommend watching it to get the full picture, i can and want to only cover a bit here: * [Addressing Licence Changes to pfSense Plus Home and Lab](https://www.youtube.com/watch?v=rXI6-E1nc5M) They also made a video about switching back from pfSense plus (Home+Lab) to pfSense CE: * [How to Convert From pfsense plus 23.05 to pfsense CE 2.7](https://www.youtube.com/watch?v=kFUcmWTazGg) Reading recent posts about this on /r/pfSense subreddit, the community seems to be quite angry about this. And it doesnt help that their subreddit is actually run by Netgate employees, so it isnt exactly a independent discussion forum there at all. For example a user tried to get feedback and support for [a tool to convert pfSense configs to OPNsense configs](https://www.reddit.com/r/homelab/comments/17hs7o2/bo unty_for_pfsense_to_opnsense_conversion/), and the moderators removed the post without further comment. My personal recommendation would be that this is a huge opportunity to finally switch away from pfSense, they have shown once again that they cannot be trusted. Take a look at the most obvious "competitor" /r/OPNsenseFirewall, they started as a fork of pfSense and have developed quite nicely. And to make it even more clear what kind of people are running Netgate (pfSense), if you havent read it yet, [this is the story](https://opnsense.org/opnsense-com/) of when people announced the fork OPNsense, how a **employee of Netgate** was running `opnsense.com` which [was a mock website](http://web.archive.org/web/2 0160314132836/http:/www.opnsense.com/) entirely made to shit on the OPNsense project and discredit them. And yes, [this employee still works for them today it seems](https://www.netgate.com/blog/author/jamie-thompson). This alone should be reason enough to **never use anything by Netgate**, ever, wether its a free CE or paid. Atleast right now they are still offering the free and opensource CE version. But who knows how long that will last. They might as well kill that option without prior notice in a few months or a year from now. Its better to think about switching before being forced to. There have also been various other issues with Netgate´s behaviour towards their users over the years, but covering them all here would be too much and offtopic, i would like to focus this post mostly on the very recent issue. If people get angry about Oracle and seemingly shutting down "free" VPS instances at random, then they should be angry about Netgate pulling shit like this too. #TL;DR **Stop using pfSense (and any Netgate products) switch to something else.** Its not the only alternative, but /r/OPNsenseFirewall is one example. *Disclaimer: I am no pfSense expert, very far from it. If i got any of the history or current events wrong in this post, please let me know and i will immediately correct them. For me when the time came to pick a (virtualized) firewall/router appliance, i installed both pfSense and OPNsense in VMs and took a quick look. Even tho pfSense did leave a very "enterprise-ish" impression, it didnt feel right somehow, just odd in some way. Then looking at OPNsense, i felt immediately at home, i cant really narrow down why exactly. It simply felt much more open and friendly from the beginning. And i mean the software, at that point i had no idea what was going on between pfSense and OPNsense. All i knew was that OPNsense originated from pfSense, thats all. I tried both a tiny bit and quickly decided that i like OPNsense more, and thats what i have been using for a long time now and im very happy with it.* ---------------------------------------------------------------------- lunakoa · 2023-10-28 00:51 I run CE, what did I miss not have home+lab? ---------------------------------------------------------------------- mervincm · 2023-10-28 00:54 I was running plus when I wanted to move to replacement hardware. I installed CE on the new hardware and restored the plus backup. It stayed at the CE version. It was trivial to do. ---------------------------------------------------------------------- usa_commie · 2023-10-28 00:56 Opnsense. Haven't looked back ---------------------------------------------------------------------- thekrautboy · 2023-10-28 00:56 Was that a "actual plus" backup? Or was it a backup from a "Home+Lab" version? ---------------------------------------------------------------------- murderbymodem · 2023-10-28 00:58 OpenWRT runs on x86 as well and is what I settled on for my personal setup. ---------------------------------------------------------------------- thekrautboy · 2023-10-28 01:09 Too late for that question, it doesnt exist anymore. You can probably find find comparisons in some thirdparty discussions, or with web.archive.org ---------------------------------------------------------------------- getgoingfast · 2023-10-28 01:12 What is the difference? My impression is that they will be treated similar as far is license is concerned, no? ---------------------------------------------------------------------- Fluffer_Wuffer · 2023-10-28 01:16 I did this.. went PFSense > OPNSense > OpenWRT. The thing to realise the Sense solution are firewalls, they have much more comprehensive features, have better troubleshooting tools.. where OpenWRT is mainly.a Router, extemely lightweight, and has a vast amount of online knowledge you can call upon. So choose appropriately,. OpenWRT worked better for me, as I wanted a Multi-VPN router, for ProtonVPN, TailScale etc. ---------------------------------------------------------------------- thekrautboy · 2023-10-28 01:18 Im not sure right now, would need to look that up. But as far as restoring a backup goes it apparently isnt very simple between various editions, basically trying to downgrade. ---------------------------------------------------------------------- x390_ · 2023-10-28 01:19 Should have linked r/opnsense instead. ---------------------------------------------------------------------- getgoingfast · 2023-10-28 01:23 Going from Plus to CE is pretty straightforward. https://www.youtube.com/watch?v=kFUcmWTazGg Not sure about Home+Lab though. ---------------------------------------------------------------------- thekrautboy · 2023-10-28 01:23 Yeah, thats exactly what i already mentioned and linked in the orginal post here. ---------------------------------------------------------------------- thekrautboy · 2023-10-28 01:26 I very much agree. OpenWRT is a fantastic project. But its not really aimed at the same purpose as OPNsense is for example. One typtically runs on a common router that allows custom firmware, and the other runs on dedicated x86 hardware devices, or in a VM. ---------------------------------------------------------------------- thekrautboy · 2023-10-28 01:28 Much appreciated, it added it but not replaced it. ---------------------------------------------------------------------- ______-_-_________ · 2023-10-28 01:32 I currently use the CE version, but considering they've said updates and features will be slow to come to the CE edition, I'm considering switching to opnsense. I need to install opnsense on a VM to test it out before making the switch. ---------------------------------------------------------------------- AnApexBread · 2023-10-28 01:33 Not much. Plus gets more regular updates, and some features like Ethernet level frame filtering, OpenVPN-DCO, and OpenVPN import from config. ---------------------------------------------------------------------- flecom · 2023-10-28 01:48 Migrated to opnsense after their meltdown on reddit, every time I hear about what's going on with pfsense I feel more assured I made the correct decision ---------------------------------------------------------------------- mrmindboggler · 2023-10-28 01:50 The VC money is probably drying up. Happens a lot with these initially "free" projects. All part of the plan. ---------------------------------------------------------------------- zfa · 2023-10-28 01:58 Cunts gonna cunt. Writing's been on the wall for that whole shitshow for years now, I only hope this brings the water to a temp high enough that the last few frogs boiling away in the pfsense pot come to their senses and maybe now decide it's time to jump out of the pot. Thanks for the post. ---------------------------------------------------------------------- ZaxLofful · 2023-10-28 02:02 Stuff like this at NetGate is the literal reason I switch to MikroTik. ---------------------------------------------------------------------- blaine07 · 2023-10-28 02:21 This is on my shortlist; moving out. ---------------------------------------------------------------------- Patient-Tech · 2023-10-28 02:23 RouterOS is really solid and if you look around the licenses can be found at a discount. It’s also done by port speed and CHR is full price $45 for for gig speed. ---------------------------------------------------------------------- speedbrown · 2023-10-28 02:27 Any compromises from switching PFSense to OpenSense? ---------------------------------------------------------------------- lunakoa · 2023-10-28 02:28 I guess in my case nothing was lost then. ---------------------------------------------------------------------- ZaxLofful · 2023-10-28 02:28 I buy their hardware fur the OS, but also their newest stuff is fire!🔥 ---------------------------------------------------------------------- speedbrown · 2023-10-28 02:28 Nothing. They had one cool feature with bootloader slicing, but besides that nothing of real value. ---------------------------------------------------------------------- lunakoa · 2023-10-28 02:31 Based on OP and your response I am not missing much. So I cannot relate to what the controversy is. But maybe I can empathize in another way when RHEL decided to make it harder for Alma and Rocky to produce clones. ---------------------------------------------------------------------- Zealousideal_Mix_567 · 2023-10-28 02:31 I was looking at switching to them. They made that decision for me. Lol ---------------------------------------------------------------------- cr1tic · 2023-10-28 02:37 You people expect so much. They have a free open source version. Use it. Need more? Pay. Negate have been wonderful to the community and this take of yours is wildly off. ---------------------------------------------------------------------- mervincm · 2023-10-28 02:41 It was the free product, I have never had a paid one. ---------------------------------------------------------------------- Mr_SlimShady · 2023-10-28 02:43 Less documentation and it’s also not what you’re going to be seeing on a professional level. Pfsense is still what most companies out there are running. ---------------------------------------------------------------------- finlan101 · 2023-10-28 02:44 Sometimes how to guides are written for the pfSense ui but it’s pretty easy to figure out where it is on opnSense ---------------------------------------------------------------------- Nnyan · 2023-10-28 02:51 Same migrated from PFS to OPN and I like OPN better. ---------------------------------------------------------------------- BouncyPancake · 2023-10-28 02:54 I use pfSense CE but I sadly cannot migrate to OPNSense anytime soon. I use it for homelab and work related things and if I take the network down, everything suddenly becomes a million times more stressful and chaotic. At some point, I will create an OPNSense VM, configure it to be identical to my pfSense system, make a backup of the configurations, and install OPNSense on my main firewall then import the backup. I would recommend doing that for anyone who wants to migrate fast and easily. Just make a VM of OPNSense, configure it as needed, backup, install OPNSense on the main system, then import. ---------------------------------------------------------------------- sozmateimlate · 2023-10-28 02:56 Thanks for posting this, I've seen some motion related to pfSense this week but since I don't use I didn't have the energy to look up what was going on and this a great summary. ---------------------------------------------------------------------- murderbymodem · 2023-10-28 03:08 >One typtically runs on a common router that allows custom firmware, and the other runs on dedicated x86 hardware devices, or in a VM. "Typically" is the key word here. I ran OpenWRT on my consumer router before switching over to x86. If it ain't broke, don't fix it. >[OpenWrt can run in normal PC, VM, or server hardware, and take advantage of the much more powerful hardware the x86 (Intel/AMD) architecture can offer.](https://openwrt.org/docs/guide- user/installation/openwrt_x86) ---------------------------------------------------------------------- bleomycin · 2023-10-28 03:14 As someone who has used routeros/mikrotik devices only a handful of times over the years and found it beyond confusing compared to laterally every other type of network equipment would you say it has gotten better over time? When I last used it the documentation was extremely poor which is what has kept me away. I'm fine with learning new ways of doing things but only if it is well documented and I don't have to spend endless hours googling and banging my head. Documentation is the biggest reason I've stuck with pfsense for so long. Their website documentation, the book, and youtube provide so much well formatted information it's difficult to switch to an alternative especially for someone who only needs to dive deep into these topics a handful of times a year. ---------------------------------------------------------------------- ZaxLofful · 2023-10-28 03:16 It’s all meant to be done from the CLI, just like most enterprise network; that’s why I like it… ---------------------------------------------------------------------- bleomycin · 2023-10-28 03:24 Sure. CLI no problem. In another life I managed quite a few cisco IOS devices. The documentation was fantastic from cisco. Having a quick poke around https://help.mikrotik.com/docs/display/ROS/ is very encouraging! This is MUCH more fleshed out than when I last looked quite a few years ago. Since you seem to like and use their products would you say they have been better at keeping their docs up to date or do you find yourself still needing to google and dig through their forums often? ---------------------------------------------------------------------- ZaxLofful · 2023-10-28 03:25 I’m kind the opposite of normal developers, I just poke around and revert all the time; until I figure it all out. The couple of times I needed it, the official docs is what I used! ---------------------------------------------------------------------- Bluasoar · 2023-10-28 03:31 Was gonna comment this, switched from pf back when they announced the paid model and any pfsense guide has worked for the most part, if i’m not mistaken opnsense is a fork of pfsense from 2015 and they have some bad history. A netgate employee bought the opnsense.com domain in sept 2017 and started to bash opnsense using this domain as well as a video that contains scenes taken from the film “Downfall”, the historical war drama film depicting the final ten days of Adolf Hitler's rule over Nazi Germany, along with a comment reading “From deep within the OPNsense development bunker”. opnsense had to file a complain to WIPO to have the domain taken down. I switched a few years ago and haven’t looked back, they really are a scummy company.. ---------------------------------------------------------------------- lunakoa · 2023-10-28 03:48 You can run ddwrt as well. ---------------------------------------------------------------------- ArtPsychological9967 · 2023-10-28 03:50 If you don't mind a question, is there anything like PfblockerNG for Opnsense? It is the sole part I might miss. ---------------------------------------------------------------------- ZenoFairlight · 2023-10-28 03:54 If you're comfortable with a CLI, VyOS is another option. There's a pretty easy guide for building a full ISO in their documentation. ---------------------------------------------------------------------- N30DARK · 2023-10-28 03:56 >ted to move to replacement hardware. I installed CE on the new hardware and restored the plus backup. It stayed at the CE version. I We found the shill, kidding. Regardless, they could've better communicated this for their users. I have the free CE version, and it has been great. But, the lack of communication sucks. ---------------------------------------------------------------------- seizedengine · 2023-10-28 04:02 Maybe tiny companies... ---------------------------------------------------------------------- billyalt · 2023-10-28 04:04 Definitely way more Cisco shops out there ---------------------------------------------------------------------- JM-Lemmi · 2023-10-28 04:24 In my experience the docs are very up to date and extensive. I can recommend it ---------------------------------------------------------------------- lmamakos · 2023-10-28 04:33 So the people that make the free version of the software and the paid version of the software decided others were taking advantage of the free eval version, and stopping giving that away for free. Why not just use the CE version? It's been working fine for me for more than a decade. Is there functionality missing in the free CE version that you'll be giving up, or are you just pissed off that something changed unexpectedly in the selection of free things that are available to you? Is OPNsense really more "open and friendly?" I dunno, I know some of the guys at Netgate professionally, and they're trying to run a business.. and for some reason, giving away software for free. Probably as a combination of giving back to the community and having people do testing at the same time. Seems like a reasonable tradeoff. ---------------------------------------------------------------------- Affectionate-Fig-805 · 2023-10-28 04:39 But the free upgrade from CE to plus is still there? Or they also removed this free upgrade path? ---------------------------------------------------------------------- RandomPhaseNoise · 2023-10-28 04:41 What about starting to create a redundant router environment? Keep the vm router as a fallback? ---------------------------------------------------------------------- primalbluewolf · 2023-10-28 04:45 > I was surprised to not see any post about this here yet, so here it is i guess. I guess you don't browse here much. It's already been discussed some days ago. ---------------------------------------------------------------------- ddpbsd · 2023-10-28 04:49 FreeBSD‘s never pulled that nonsense AFAIK. Nor have Open, Net, Dragonfly, or Hardened. ---------------------------------------------------------------------- BouncyPancake · 2023-10-28 05:19 Could absolutely do that too. I wouldn't just because I need to upgrade my networking soon so it's gonna get ugly but if you have the ability, go for it. Would be knocking out two birds with one stone ---------------------------------------------------------------------- ScottyPuffJr · 2023-10-28 05:28 Sophos utm home/free. Never looked back ---------------------------------------------------------------------- ScottyPuffJr · 2023-10-28 05:32 I don't understand the down votes. This move seems logical to avoid Chinese / random companies /individual from using their free software to profit without paying licensing fee. Those of you who complaining, what do you suggest? What ideas do you have to prevent people abusing home/lab edition? ---------------------------------------------------------------------- JzJad12 · 2023-10-28 05:43 First realvnc does a bait and switch with rport, then netgate pulls more stupid crap. Guess its time to buy an opnsense appliance just to show how much better they are as a company. ---------------------------------------------------------------------- Fenix04 · 2023-10-28 05:55 It's been removed. ---------------------------------------------------------------------- netmind604 · 2023-10-28 05:56 Was there ever a real reason to use offense+ other than more frequent updates? I couldn't go opnsense as a newbie to and needed the much richer docs tutorials and ecosystem. Stayed on offense CE as it's fully open and I wanted to support that. TBF what did you expect? For profit company starts to add closed code "for free".... Of course it won't last and the fact you pay nothing .... Well means you should expect no say. ---------------------------------------------------------------------- clovepalmer · 2023-10-28 06:13 Never reward bait and switch. Fuck this company ---------------------------------------------------------------------- iccb · 2023-10-28 06:13 One option is ipfire. [ipfire](https://ipfire.org) ---------------------------------------------------------------------- thekrautboy · 2023-10-28 06:22 No, i dont much time here... ---------------------------------------------------------------------- thekrautboy · 2023-10-28 06:27 It was removed without prior notice. ---------------------------------------------------------------------- iTzzKoLT · 2023-10-28 06:41 I recently did a i9 proxmox build and it became an opportunity to do a fresh install of opnsense from my pfSense install. It's a bit different to get use to, UI wise, in some sense pfSense seemed a little more clunky but easier to read things like the firewall table. But I decided I was going to switch because of hearing the scummy things they do so this reinforced my decision and push getting use to opnsense. Good writeup ---------------------------------------------------------------------- d4rkblu · 2023-10-28 06:54 just run OpenBSD ---------------------------------------------------------------------- Daniel15 · 2023-10-28 07:04 I've been trying a few software routers... I have a 10Gbps internet connection and the issue I had with opnsense was that I couldn't achieve 10Gbps NAT throughput even after tuning a few tunables. It maxed out around 3.1Gbps. Seems like something (NAT maybe) is single threaded as it was hitting 100% usage for one core. I tried OpenWrt instead, and I easily managed 10Gbps throughput with only around 10% CPU usage on a Core i5-9500, same PC I was trying opnsense on. OpenWrt didn't need any tweaking to hit those speeds! It just worked. ---------------------------------------------------------------------- Daniel15 · 2023-10-28 07:06 The annoying thing is that IPv6 is still a second class citizen. There's no fastpath or fast track for IPv6 yet even thoughtthey've been promising it for years. ---------------------------------------------------------------------- AnomalyNexus · 2023-10-28 07:46 Check that whatever plugins you use have an equivalent. I tried both and prefer opnsense ---------------------------------------------------------------------- BeYeCursed100Fold · 2023-10-28 07:58 There is not a PfBlockerNG equivalent plugin, but there are multiple guides that walk you through how to configure similar functionality in about 15-30 minutes or less. Once it is set up, configuration changes are very simple. ---------------------------------------------------------------------- blicknixr · 2023-10-28 08:04 Technically not true that it is a Linux, OpenBSD is a Unix-Like OS. But yeah, your point stands. ---------------------------------------------------------------------- Brent_the_constraint · 2023-10-28 08:06 Beside the obvious alternatives I understand the move. However it would also have been possible to forbid the installation of that particular license on commercially sold hardware under thread of a fine… ---------------------------------------------------------------------- SpongederpSquarefap · 2023-10-28 08:08 Yep OP is right, but OP didn't mention the fucking disasterous WireGuard implementation they tried to pull off God that was a mess This is yet another reminder to tick off "switch to OPNsense" on my to do list ---------------------------------------------------------------------- TetchyTechy · 2023-10-28 08:10 Yes, I think so - just like what happened with unity ---------------------------------------------------------------------- murderbymodem · 2023-10-28 08:15 My comment is about OpenWRT, not OPNSense. OpenWRT is Linux. https://openwrt.org/about >OpenWrt ​is a highly extensible ​GNU/​Linux ​distribution for embedded devices ​(typically wireless routers). Unlike many other distributions for these routers, OpenWrt ​is built from the ground up to be a full-featured, easily modifiable operating system for your router. In practice, this means that you can have all the features you need with none of the bloat, powered by a Linux kernel ​that's more recent than most other distributions. ---------------------------------------------------------------------- TetchyTechy · 2023-10-28 08:24 I think they always planned for ce's obsolescence from the very start, just they fudged the whole thing with poor communication and wrong decisions...probably they will be aiming for business from now on because that's their main revenue stream and their lifeblood and not the open source community. ---------------------------------------------------------------------- katrinatransfem · 2023-10-28 08:33 I'm not entirely sure what PfblockerNG does, but on Unbound DNS, there is the ability to add PiHole blocklists to have DNS filtering similar to what PiHole does. But maybe I'm talking about something completely different? ---------------------------------------------------------------------- ElusiveGuy · 2023-10-28 08:36 I would love to run VyOS, moving from Ubiquiti EdgeOS (Vyatta derived), but honestly they have a similar problem here: there is no reasonably priced stable build for home/personal use. Your options are: * use a rolling release, which I'll never do for a router where I value stability first * build my own iso, but it's unclear how updates will work? The docs for this do look a bit more fleshed out now. * pay $1200/yr (!!!) for a supported version I'm not even expecting it to be free, but at most in the sub-$100/yr range. They've tried personal licences a couple times now but they kept changing the structure before just pulling the tier entirely. ---------------------------------------------------------------------- sassydodo · 2023-10-28 08:37 I've used both pfsense and opnsense. Given this was like 4+ years ago, but still. Used opnsense because userinterface had better ui/ux. Otherwise pfsense had much more to give, but I really never needed it so switched to lighter/easier to use version - opnsense. I really don't see a problem with switching/reinstalling different version of pfsense if you don't want to use "paid" version. Now, the problem of AliExpress - this is true. The most important part of the network gear isn't hardware, it's software and drivers on said gear. Pfsense turns cheap shitty minipc worth $100 into powerful router on par with enterprise gear worth $10000 and capable of running thousands of users in multiple locations with site to site networks. ---------------------------------------------------------------------- primalbluewolf · 2023-10-28 08:37 Hmm. I dont see the post Im thinking of. Its either been deleted, or I've mixed up which sub it was on. Apologies! ---------------------------------------------------------------------- katrinatransfem · 2023-10-28 08:38 Yes, but most business customers, or the people that advise those business customers, choose stuff that they have already tried out on their homelab and are familiar with. ---------------------------------------------------------------------- ModerateBiscuit · 2023-10-28 08:52 My weekend job is working out how to migrate my VPN config over. Once I've done that in moving. ---------------------------------------------------------------------- Mr_SlimShady · 2023-10-28 09:05 I meant between the two. That was the scope of the discussion here. ---------------------------------------------------------------------- Affectionate-Fig-805 · 2023-10-28 09:27 oh. thanks for the info. ---------------------------------------------------------------------- marvbinks · 2023-10-28 09:45 My uneducated guess is that lots of people have set this version up for someone else as a service and is now going to have to answer some awkward questions about the previously free software they provided. ---------------------------------------------------------------------- Blazorax · 2023-10-28 09:50 I can understand this topic can be personal, yet I see no issue. CE still available, homelab is their product and they have been allowing ppl to use for free. Now they decided not to allow it anymore, so be it. It is their product after all. Maybe I'm missing something, if I do, please elaborate and I am happy to be corrected. ---------------------------------------------------------------------- Silejonu · 2023-10-28 09:50 Especially since there is a search function in OPNsense. ---------------------------------------------------------------------- supra98tt · 2023-10-28 10:01 When they pulled the shit against opnsense back in the day, I moved to sophos home edition and never looked back. Netgate as a company is cancer. Either run opnsense or sophos home if you don't mind closed source firewall. ---------------------------------------------------------------------- XelNika · 2023-10-28 10:10 > build my own iso, but it's unclear how updates will work? The docs for this do look a bit more fleshed out now. I believe updates work the same way for all versions of VyOS. You load in a new OS image from somewhere and mark it as the boot image. There are no automatic updates for the paid or rolling releases either. I just wrote a GitHub Actions workflow to pull a stable branch and build the image on demand. I have encountered broken features in their rolling release myself so I would not recommend it for regular home use. ---------------------------------------------------------------------- ElusiveGuy · 2023-10-28 10:17 > You load in a new OS image from somewhere and mark it as the boot image. Ahh, I believe that's more or less how the EdgeOS/Vyatta updates work, so not much has changed there. > I wrote a GitHub Actions workflow to pull a stable branch and build the image on demand. Yea, some form of automation would make it viable. Having to manually do a build just to update sounds like a good way to fall behind. > I have encountered broken features in their rolling release myself so I would not recommend it for regular home use. That is exactly why I heavily disagree with their stance of "rolling release is good enough for personal use", most of us just want our network equipment to be stable, and not have to beta test / troubleshoot every time an update comes out. Hell, I run Debian everywhere precisely because I like being able to `apt upgrade` without having to worry (too much) that it might break something. ---------------------------------------------------------------------- NightH4nter · 2023-10-28 10:19 yes, but they're technically still general-purpose systems, not firewall/router systems ---------------------------------------------------------------------- ydna_eissua · 2023-10-28 10:19 And the poster above you is also wrong. OpenBSD is not the base for PFSense or OpnSense. FreeBSD is. ---------------------------------------------------------------------- NightH4nter · 2023-10-28 10:22 it's not a firewall/router os. not everyone has time/wants to build things up and configure them from scratch ---------------------------------------------------------------------- NightH4nter · 2023-10-28 10:25 > You people expect so much. nope, just transparency and adherence to the promises given ---------------------------------------------------------------------- NightH4nter · 2023-10-28 10:29 it's all about breaking the promises previously given ---------------------------------------------------------------------- thekrautboy · 2023-10-28 10:29 I promise you, there was no pfsense/netgate on this sub in recent days, sadly i spend a lot of time browsing /new here and i would definitely have seen it, even before it might have been removed. ---------------------------------------------------------------------- thekrautboy · 2023-10-28 10:33 Of course its their product and they can do whatever they want it it. Doesnt mean their users need to like what they do. The problem is not removing a product version from their lineup. The specific problem in this case is that they did so with zero notice upfront. Users upgraded their installs from the free CE to the free H+L, then H+L gets removed and those users are now supposed to pay a subscription to properly keep using it. Most people would call that a bait and switch. ---------------------------------------------------------------------- thekrautboy · 2023-10-28 10:40 Feel free to add more context please or links to other issues. I did not want to make this a "look how bad Netgate has been for years" post, but mostly focus on this one current issue. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-10-28 10:43 https://arstechnica.com/gadgets/2021/03/buffer-overruns-license- violations-and-bad-code-freebsd-13s-close-call/ https://old.reddit.com/r/homelab/comments/m5x946/fyi_you_should_probab ly_avoid_using_wireguard_on/ https://lists.zx2c4.com/pipermail/wireguard/2021-March/006499.html It's how they respond to stuff that's shitty ---------------------------------------------------------------------- thekrautboy · 2023-10-28 10:55 Thanks! Going to read those. ---------------------------------------------------------------------- holzgraeber · 2023-10-28 11:01 For me, I found the mikrotik documentation to be mor concise and understandable than any other switch/router OS that I had the "joy" of working with ---------------------------------------------------------------------- mixman68 · 2023-10-28 11:08 Do you know if a script exists to migrate something ? Like rules, groups, Third services not a problem to manual migrate but migrate 300 rules by hand 😢😢 ---------------------------------------------------------------------- schellenbergenator · 2023-10-28 11:35 Did you have to rebuild all your network configurations from scratch or is there migration tools to help move over. ---------------------------------------------------------------------- Aronacus · 2023-10-28 11:36 Dropped them last year for a Ubiquiti stack. Very pleased. ---------------------------------------------------------------------- schellenbergenator · 2023-10-28 11:47 What does that have to do with anything? ---------------------------------------------------------------------- Finagles_Law · 2023-10-28 11:57 Maybe you should ask yourself why you need 300 rules? ---------------------------------------------------------------------- wally40 · 2023-10-28 12:03 I've wanted to go this route, but have had trouble getting Sophos to run on my hardware. Didn't spend too much time with it as pfsense ran on install. May have to circle back to it and troubleshoot it. ---------------------------------------------------------------------- ddpbsd · 2023-10-28 12:19 They make great firewalls ---------------------------------------------------------------------- ddpbsd · 2023-10-28 12:20 They make great firewalls and don’t screw you over ---------------------------------------------------------------------- CrappyTan69 · 2023-10-28 12:24 I'd like to know. I've been using pfsense for decades and have a well crafted network, remote access etc. Not impossible to rebuild but a ball ache. ---------------------------------------------------------------------- circularjourney · 2023-10-28 12:26 If you are comfortable with the CLI, why not just use Debian? ---------------------------------------------------------------------- ElusiveGuy · 2023-10-28 12:32 That's one option, and it's still on the table, but one thing I'd really like a GUI or at least an abstraction for is traffic shaping. `tc` CLI does my head in. Not in a huge rush to replace my EdgeOS gear right now, it's fine with my current WAN speeds. This is kinda just long-term planning for if I ever manage to get gigabit. ---------------------------------------------------------------------- circularjourney · 2023-10-28 12:35 it is a great os for that. building your own is not that hard. plus you have something no company can take away from you. both with your end product and your knowledge. ---------------------------------------------------------------------- verylittlegravitaas · 2023-10-28 12:48 Context? On Reddit!? ---------------------------------------------------------------------- idontmeanmaybe · 2023-10-28 13:04 I also had performance issues with opnsense and switched to Linux. A bonus is I get to use the CAKE shaper as well. ---------------------------------------------------------------------- idontmeanmaybe · 2023-10-28 13:08 I don’t think this is true. I never encountered anything that I couldn’t configure from either winbox or the web gui. I actually really liked their firewall gui. ---------------------------------------------------------------------- LDerJim · 2023-10-28 13:09 When I migrated a few years ago there was no migration script and I don't believe there is one now. Take plenty of screenshots and a backup. ---------------------------------------------------------------------- treebeardd · 2023-10-28 13:27 The free version of the rXg Router is an incredible solution for SOHO type scenarios, I run it myself and it's amazing. Let's say you want to have your work devices on one VLAN, your home devices on one VLAN, and your guests devices on a third VLAN so they NEVER see each other. Let's say you want to manually approve your guest's onboarding request, super easy! Just be warned, their product is built for someone who knows something about networking so if you're challenged by that requirement please take it as an opportunity to learn! Free technical support is available at reddit.com/r/rgnets, head over to RGNets.com for a free download! ---------------------------------------------------------------------- Hakker9 · 2023-10-28 13:44 Okay let me make an educated guess here. Your internet connection uses PPPoE. PPPoE is on BSD (which is both OPNsense and PFsense OS) a single threaded only thing. It's also my reason why I stopped using it. ---------------------------------------------------------------------- TheCaptain53 · 2023-10-28 13:49 Just to clarify - the Enterprise and Community versions of ProxMox hold feature parity. The main differences are the enterprise repository (ensuring more stable backups) and access to enterprise support. But the Enterprise version doesn't fundamentally do anything the community version can't. ---------------------------------------------------------------------- ArtPsychological9967 · 2023-10-28 13:58 That's almost all I use PfBlocker for! Perfect thank you. ---------------------------------------------------------------------- ArtPsychological9967 · 2023-10-28 13:59 Awesome. I'll look that way. ---------------------------------------------------------------------- oddmolly · 2023-10-28 14:04 You can you AdGuard as plugin on opnsense https://0x2142.com/how-to-set-up-adguard-on-opnsense/ ---------------------------------------------------------------------- MrDephcon · 2023-10-28 14:06 I don't understand the AliExpress argument. They want people to use free H+L to expose them to the ecosystem and hopefully pay for the full version. AliExpress vendors shipping thousands of routers with free H+L installed vastly boosts their user base... So isn't that mission accomplished? If some of those users upgrade to the paid version it's a win. By removing free H+L, Ali express vendors will just start shipping opnsense instead and I would expect the majority of users to continue to use it instead of moving to pfSense. Alternately if Ali vendors shipped without any software pre-installed, and then the customer installs free H+L, what's the difference? ---------------------------------------------------------------------- pastelfemby · 2023-10-28 14:12 Much as I enjoy all that opnsense offers, gotta say for many openwrt is probably the way. ---------------------------------------------------------------------- akryl9296 · 2023-10-28 14:13 Mind sharing the workflow for the benefit of all? ;) ---------------------------------------------------------------------- FallenFromTheLadder · 2023-10-28 14:17 Looking at a better UI, IMO. ---------------------------------------------------------------------- HTTP_404_NotFound · 2023-10-28 14:24 VyOS fits the needs of a router extremely well too. Extremely fast, and has an absolute ton of features. Just- everything is done via CLI. ---------------------------------------------------------------------- thekrautboy · 2023-10-28 14:39 That is correct. I only used Proxmox as a example for them offering a free opensource product, but also offering paid services in order to finance themselves. ---------------------------------------------------------------------- Z8DSc8in9neCnK4Vr · 2023-10-28 14:40 I use unbound, works very well. ---------------------------------------------------------------------- thekrautboy · 2023-10-28 14:41 This sounds so much like an ad. ---------------------------------------------------------------------- thekrautboy · 2023-10-28 14:44 Im not so sure either what Netgate exactly was thinking there. Maybe these vendors are just a scapegoat and the only real reason they are doing this now is to rake in money from people being "forced" to buy a subscription. And those vendors will probably simply go back to shipping standard pfSense preinstalled. Some of them have been offering OPNsense preinstalled already, i imagine to them it doesnt matter. They offer whatever people are asking for. ---------------------------------------------------------------------- HittingSmoke · 2023-10-28 14:55 > And to make it even more clear what kind of people are running Netgate (pfSense), if you havent read it yet, this is the story of when users announced the fork OPNsense, how Netgate was running opnsense.com which was a mock website entirely made to shit on the OPNsense project and discredit them. I encourage you to look at it and make up your own mind about it. And guess who exactly was running that website? Some disgruntled hardcore pfSense fan, or some low level employee who went too far? No, it was the founder & CEO of Netgate. This alone should be reason enough to never use anything by Netgate, ever, wether its a free CE or paid. Story time. I always found it difficult to like pfSense. I'm big on UI/UX and this was before their redesign. Even after the new design I really didn't love it. I started researching alternatives and asked in some (not /r/pfsense) subreddit about opnsense. Some dude named htilonom shows up absolutely going off the handle about it. Was calling it a scam. He seemed disturbingly passionate about hate for an open source project so I did some digging instead of taking his words at face value. He was running a subreddit called /r/opnscam where he was doing some downright creepy dude stalking an onlyfans girl level of stalking the opnsense devs. Posting random links to forum posts by opnsense devs, making wild accusations that didn't fit the links he was posting. Long nonsensical rants about topics like how criticizing the choice of using C or a web interface meant people wanted to "steal" code. Nobody else posted there. Was just years of this one guy talking to himself about opnsense being a scam and how the maintainers were incompetent or were somehow stealing from an open source codebase. I always suspected it was someone who had some business ties to pfSense, if not that CEO himself. ---------------------------------------------------------------------- HittingSmoke · 2023-10-28 15:01 You can, but you absolutely should not. ---------------------------------------------------------------------- lunakoa · 2023-10-28 15:13 Wow downvotes, I don't use it for internet access, I use it for EOIP, nice and small footprint between my ESXi hosts and DDWRT devices. Maybe OpenWRT, pfsense, and opnsense can do it too. But you got to admit it is a small footprint. ---------------------------------------------------------------------- Nestramutat- · 2023-10-28 15:13 Yup. I migrated after finding out the clusterfuck that was wireguard on pfSense, no regrets ---------------------------------------------------------------------- Nestramutat- · 2023-10-28 15:15 Yup, the whole Wireguard debacle is what had me switch to OPNSense in the first place ---------------------------------------------------------------------- lvlint67 · 2023-10-28 15:15 never liked pfsense.. the interface usually got in the way more than it helped. Ran a linux router for years.. These days i have mikrotik gear at the edge. (no they aren't insecure... all of the cve's you've heard about were publicly exposed admin interfaces...). ---------------------------------------------------------------------- thekrautboy · 2023-10-28 15:16 > This subreddit was created by a petty and childish troll who made pfSense users look bad by doing nothing on reddit but shitting on a similar open source project. It has been taken over and shut down. Excellent, well done! ---------------------------------------------------------------------- ColdDeck130 · 2023-10-28 15:32 I’ve been using Sophos UTM for years, but they announced that it will be End Of Life next year. I have been looking at OPNsense as a replacement. It will be a very interesting transition. ---------------------------------------------------------------------- leetnewb2 · 2023-10-28 15:47 Ever look at fireqos? I use firehol to manage iptables on my router and find the syntax intuitive. Never bothered with the traffic shaping piece, but I figure it is a reasonable abstraction. ---------------------------------------------------------------------- ZaxLofful · 2023-10-28 15:56 Meant as in they always give you the CLI example first, instead of GUI first like most companies…. ---------------------------------------------------------------------- BarServer · 2023-10-28 16:28 Oh god. I love you when I read this. :-) ---------------------------------------------------------------------- KN4MKB · 2023-10-28 16:46 I've ran both and unfortunately, as much as I HATE to admit it, pfSense "just worked". I tried opnsense, but strange problems kept coming up that had me fixing issues like wack a mole in a time where I needed something to just do it's job. I'll give opnsense another shot in the future. But as of now pfsense is doing what I need, the way I need it to on the community edition. I have no reason to swap now, but if they screw around with that, I guess opnsense will get another shot. ---------------------------------------------------------------------- bubblegumpuma · 2023-10-28 16:51 Most of those Aliexpress vendors ship with no RAM and no OS as a significantly cheaper option anyway, so many of the people who are buying that hardware are just grabbing their own OS in the first place, I'd think. It's certainly what I'd do if I were in the market for one of those 150 dollar firewall boxes. ---------------------------------------------------------------------- dethfrog · 2023-10-28 16:55 Interestingly, they may be bypassing this a bit with newer devices. I have a CRS317 which does L3HW acceleration, though I'm only using it for inter-vlan and not NAT/FW operation. The documents seem to imply this is a thing though for both IPv4/v6 if configured correctly though. ---------------------------------------------------------------------- user01401 · 2023-10-28 16:58 OpenWrt on x86/64. Also being Linux based you gain features such as SQM which is a game changer for bufferbloat and responsiveness with devices. ---------------------------------------------------------------------- WeiserMaster · 2023-10-28 17:10 CAKE SQM is awesome. ---------------------------------------------------------------------- WeiserMaster · 2023-10-28 17:13 IPFire devs lives in 1997 and don't want to wake up to the world that is IPv6. They even list IPv6 as a significant security risk lmao https://wiki.ipfire.org/optimization/start/security_hardening/reducing _attack_surface ---------------------------------------------------------------------- GadFly81 · 2023-10-28 17:39 I think something that should matter to you is that this is just another incident of a growing list. Netgate is out to make money, and they will do anything to pursue that. Including even reducing capabilities of the CE or removing it entirely. And before anyone says "they wouldn't do that" yes they did. Pfsense used to be full featured and completely free. Then they monetized it and offered a limited CE version. ---------------------------------------------------------------------- elyl · 2023-10-28 18:26 That opnsense.com archive. Man, it's just unhinged. ---------------------------------------------------------------------- xenophonf · 2023-10-28 18:31 Also, BSD-family operating systems are derived directly from Unix. They are not Unix-like. ---------------------------------------------------------------------- thekrautboy · 2023-10-28 18:43 Even more so when its by the CEO. ---------------------------------------------------------------------- iccb · 2023-10-28 18:48 Yeah, mostly true. It’s not perfect profuct, but option still. I gues that 98% home users don’t need ipv6 so it’s not so big thing to be disabled in default installation. ---------------------------------------------------------------------- WeiserMaster · 2023-10-28 18:51 \> I gues that 98% home users don’t need ipv6 Can't recommend IPFire to my folks in Germany. DSLite is so common that IPFire will not work. IPv4 is not available with DSLite. ---------------------------------------------------------------------- jackoftradesnh · 2023-10-28 19:14 I stopped using it after repeatedly running into scenarios where pfsense wouldn’t work with certain IETF standards. When researching all I would find is replies from their support basically saying ‘well bsd doesn’t support it so it’s a bsd issue - not us’. I’ve gone to opnsense and haven’t looked back. Better out of box experience with defaults and performance. ---------------------------------------------------------------------- Gaming09 · 2023-10-28 19:21 Does it include 'easy' geoblocking, that is a main use for me on top of the ad blocking ---------------------------------------------------------------------- lunakoa · 2023-10-28 19:23 Fair enough, I have been playing with opnsense in a lab, getting more comfortable with it. I will begin making contingency plans. ---------------------------------------------------------------------- lilolalu · 2023-10-28 19:24 Well, again someone using a "free" commercial product and complaining when the offer is changed. ---------------------------------------------------------------------- edparadox · 2023-10-28 20:06 To be fair, I do not get why people still use pfSense over OPNsense nowadays. ---------------------------------------------------------------------- thekrautboy · 2023-10-28 20:10 Because they are not aware of stuff like this going on. Same reason why people keep buying Fifa games every year. A vast majority of users simply does not care and is not informed about such details. The people who read these subreddits are more of the small hardcore userbase, far from the majority. ---------------------------------------------------------------------- nostradamefrus · 2023-10-28 20:10 Clicked on this as a pfSense CE user and, gotta be honest, this post is more of a bait and switch than what Netgate did. This is absolutely a scummy practice, don't get me wrong, but putting up a thread about a company "messing with their userbase" sends up a lot more red flags than "they took away one free offering". This doesn't impact CE users, so your very loud rallying cry of "***Are you willing to pay $400/year for your firewall software when youre only using it privately in your small homelab***" is pretty overblown if you're acknowledging the target audience of this sub is largely people who can get away fine with CE And what about Jellyfin's demise are you on about? I don't see any recent posts in here about anything going on with JF ---------------------------------------------------------------------- thekrautboy · 2023-10-28 20:21 > Clicked on this as a pfSense CE user and, gotta be honest, this post is more of a bait and switch than what Netgate did. This is absolutely a scummy practice, don't get me wrong, but putting up a thread about a company "messing with their userbase" sends up a lot more red flags than "they took away one free offering". This doesn't impact CE users, so your very loud rallying cry of "Are you willing to pay $400/year for your firewall software when youre only using it privately in your small homelab" is pretty overblown if you're acknowledging the target audience of this sub is largely people who can get away fine with CE Interesing that apparently you have never commented in /r/selfhosted before. And the only tech-related stuff in your history is submitting a bunch of "help me" posts to /r/sysadmin but those where few months ago. So you take a break from posting about NFL and Maine daily, just to come here out of nowhere to complain how unfair this post is about this company? Not odd at all. > And what about Jellyfin's demise are you on about? I don't see any recent posts in here about anything going on with JF Wake up Neo. ---------------------------------------------------------------------- Fluffer_Wuffer · 2023-10-28 20:22 EOIP? ---------------------------------------------------------------------- Blazorax · 2023-10-28 20:59 Did they give homelab users a grace period to move before they will charge at all? ---------------------------------------------------------------------- thekrautboy · 2023-10-28 21:01 Nobody will be charged out of nowhere and without their permission. But those users who did upgrade to H+L are now facing the issue to either "destroy" their entire setup and start fresh and use CE again, or try to convert to CE, or pay for the subscription to keep receiving updates etc. ---------------------------------------------------------------------- ydna_eissua · 2023-10-28 21:02 I guess it depends on ones opinion on the Ship of Theseus 😅 ---------------------------------------------------------------------- ef_pundane · 2023-10-28 21:10 [https://www.reddit.com/r/freebsd/comments/7go9o9/comment/dqllkvq](htt ps://www.reddit.com/r/freebsd/comments/7go9o9/comment/dqllkvq) ---------------------------------------------------------------------- nostradamefrus · 2023-10-28 21:22 The fuck does my post/comment history have anything to do with commenting here lmao I had an idea for something in my environment, came here to search for things other people have come up with, saw your post at the top of the sub, and clicked it as a pfSense user like I said. I didn't see anything on homelab You gonna be cryptic and dramatic about whatever you're implying is going on with JF for no reason or give me an actual answer? ---------------------------------------------------------------------- thekrautboy · 2023-10-28 21:31 Sure thing. And why not simply search for jellyfin here? ---------------------------------------------------------------------- Ylenara · 2023-10-28 21:32 Maybe? 😀 ---------------------------------------------------------------------- nostradamefrus · 2023-10-28 21:34 Still not seeing how involvement in other subs precludes me from commenting here but whatever inflates your ego, I guess I did search lol the most recent posts were all assorted "help me with jellyfin" threads. I went back maybe a week, week and a half in the results ---------------------------------------------------------------------- thekrautboy · 2023-10-28 21:36 https://www.reddit.com/r/selfhosted/comments/16ygpwo ---------------------------------------------------------------------- thekrautboy · 2023-10-28 21:43 And another one shows up out of nowhere, just as expected. ---------------------------------------------------------------------- jmartin72 · 2023-10-28 21:46 I switched to Ubiquiti and I couldn't be happier. ---------------------------------------------------------------------- coupledcargo · 2023-10-28 21:54 I tried opnsense after using ce for so many years but ended up on sophos, which provide a free license for personal use. I really like it, the feels generations ahead and seems to be pretty reliable. Not for everyone of course and who knows if sophos will do the same thing (pull the free version) ---------------------------------------------------------------------- thekrautboy · 2023-10-28 21:56 But isnt it EOL now? And also not opensource? Which exact Sophos product are you using? ---------------------------------------------------------------------- coupledcargo · 2023-10-28 22:08 I believe UTG is EOL, but XG isn't - which is what the home version is: [Free Firewall Home Edition](https://www.sophos.com/en-us/free- tools/sophos-xg-firewall-home-edition) It's not opensource which is why i say it wont be for everyone (lol or anyone in this thread!) ---------------------------------------------------------------------- BeYeCursed100Fold · 2023-10-28 22:33 Yes. The geoblocking is added via the MaxMind geoIp database. Google opnsense geoblocking maxmind tutorial. It takes 15 minutes or so to setup and is all done in the browser/UI...no commands needed. ---------------------------------------------------------------------- thekrautboy · 2023-10-28 22:58 Ah okay, thanks for clarifying. I will add this info to the OP. ---------------------------------------------------------------------- lunakoa · 2023-10-28 22:59 Ethernet of IP where you can span a layer 2 network on different segments. I use it when I have a physical lab but want a segment in a virtual network to connect to it. At that level ipx and netbuei should work. ---------------------------------------------------------------------- ZaxLofful · 2023-10-28 23:08 Last time I looked, I got the same idea! Fastpath is great! The other commenter could always ask on the forums! ---------------------------------------------------------------------- ribbit43 · 2023-10-28 23:35 There's so much hate for ubiquiti but I'm hoping for a dream router 2 ---------------------------------------------------------------------- Fluffer_Wuffer · 2023-10-29 00:04 Thanks,. It is amazing I've worked in Netsec for over a decade and never come across this term, but I get the concept and complexities. ---------------------------------------------------------------------- mixman68 · 2023-10-29 00:18 We mutualised a medium infrastructure with friends in a p2p core network with a central pfsense for routing to each site and control flows Core network @ 10 Gbit/s with pfsense and 12 remote sites, 3 of sites have a DMZ and the others consumes ressources only We migrated in 2014 from Debian iptables to pfsense+opnsense and we retired the opnsense server end of 2015 This is why too many rules ---------------------------------------------------------------------- BlueArcherX · 2023-10-29 00:37 yay! everyone is wrong! ---------------------------------------------------------------------- treebeardd · 2023-10-29 02:51 Consider it an endorsement from a power user and a fellow one time pfsense user. But I want you to choose what fits your needs. If that's a $60 mikrotik box then so be it. I have one myself and know people who use them and they certainly do NAT and DHCP just fine which is all most people really want. Just know that as long as you're not using it to collect revenue from customers, the free rXg program is free forever, as in $0, though of course you do have to host it yourself and it is much more demanding on hardware than the mikrotik. It also gives you a zillion extra features just check their YouTube. Just giving you an option. That you could self host. Choose what's best for you though. ---------------------------------------------------------------------- ElusiveGuy · 2023-10-29 05:59 Ooh, hadn't heard of it before but [looking at it now](https://firehol.org/tutorial/fireqos-new-user/) it looks quite nice, certainly much easier than raw `tc`. Thanks! ---------------------------------------------------------------------- flecom · 2023-10-29 07:08 so far not that I am aware of, I mostly use it for OpenVPN stuff... one issue I ran into is I could not get LCDProc working on my watchguard boxes, although in all fairness I tried for about 5 minutes and realized I didn't care that much and moved on with my life ---------------------------------------------------------------------- flecom · 2023-10-29 07:09 I am pretty sure I had to start from scratch, but my configurations were not complicated enough that it really discouraged me... mostly just moved over a bunch of openvpn configurations ---------------------------------------------------------------------- Blazorax · 2023-10-29 07:53 Install pfsense ce, restore pfsense homelab backup twice to load config and packages. Seem straight forward. Might as well do it now since the restore still work with CE with no issue ---------------------------------------------------------------------- markv9401 · 2023-10-29 07:55 The alternatives you listed are not quite on par. * OpnSense is great and should be used as the firewall. * VyOS is great, but it's more of a router software, enterprise grade while at it. It can do firewalling but it's unnecessarily complicated compared to OpnSense. * OpenWRT is an exceptional WiFi/Wireless AP software and then can do firewalling too but shouldn't be used as the main fw imo * Sophos may or may not be great, no experience with it on my side, and won't be any as it's not open source AFAIK * Mikrotik hardware may be priced fairly, sometimes, but their software and configuration thick client is just a terrible mess. It does indeed require certifications to set it up, even if you're a well battle experienced security guy. It's just bad imo, sorry ---------------------------------------------------------------------- DirkKuijt69420 · 2023-10-29 09:32 At most 5 minutes of work... I don't really see why people pretend this is the end of the world. ---------------------------------------------------------------------- tech2but1 · 2023-10-29 10:16 I could also just run head first into traffic. ---------------------------------------------------------------------- broknbottle · 2023-10-29 12:22 VyOS LTS can be easily built yourself via docker or even using GitHub Actions ---------------------------------------------------------------------- HoustonBOFH · 2023-10-29 14:29 Before that they locked away the tool chain so you can not build it yourself. That is what drove off opnsense. ---------------------------------------------------------------------- HoustonBOFH · 2023-10-29 14:39 To understand this, you have to know the history. Way back in the day, there were a lot of MITX pc vendors selling hardware with m0n0wall and pfSense preinstalled. Netgate was one of them. Jim sweet talked Chris into partnering, and the first thing he did was shut down all the other vendors, hard. Threats of lawsuits, abusive phone calls, and other stuff that should come as no surprise now. These companies were not making a fortune on the pfSense stuff so they caved. Which is sad, as the threats were hallow, and Jim would have lost in court. (But court is expensive, so what can you do?) So now, anyone selling anything with the pfSense name attached is something that will draw Jim out like steak to a dog. And he is the type to burn it all to the ground as long as he wins. ---------------------------------------------------------------------- HoustonBOFH · 2023-10-29 14:48 This so much. I work with a company that sells Netgate all the time because that is what the semi-tech decision makers ask for. I try to educate, but it falls on deaf ears. ---------------------------------------------------------------------- HoustonBOFH · 2023-10-29 14:55 They are not a startup. Jim just gets very upset if anyone else is in **HIS** game. ---------------------------------------------------------------------- HoustonBOFH · 2023-10-29 14:57 For your environment... For more complex environments, it can be an hour of work to do right. Or more. ---------------------------------------------------------------------- splice42 · 2023-10-29 15:04 > It’s all meant to be done from the CLI, just like most enterprise network I'm not sure what enterprise you work in, but I support large federal government departments and all our stuff has modern GUI and management panes. Sure, there's solid CLI support and there's stuff only available there. I love the CLI for a number of things. But CLI only on all our firewalls? Forget about it. ---------------------------------------------------------------------- XelNika · 2023-10-29 16:17 Sure, it's not a trade secret. https://github.com/niklasea/ansible/blob/da92161f63c64cf9ee0b0a91b8102 c2d9eaa1be3/.github/workflows/build_vyos.yml ---------------------------------------------------------------------- km_ikl · 2023-10-29 17:42 Netgate / pfSense would have been better off with using a licensing scheme like most (ie. you get CE, and only CE off the website, your home+lab license is paid for ($10/yr or something nominal), and the full enterprise edition is whatever the cost is. I'm using CE, but I'm considering switching to OPNSense if for no other reason than having Suricata pre-installed sounds really, really good. ---------------------------------------------------------------------- lunakoa · 2023-10-29 18:42 I get why it can be bad, but people saying it is bad and not explaining why is so poor effort I wonder why it doesn't violate #5 in rules in this subreddit. I guess you can say I am guilty as well, cause my post was low effort, so here I am making amends. **What I like** It is small lightweight, simple, if you just want simple NAT, I mean it runs as a VM with 128MB of RAM even less. You can create labs with a cheap physical ddwrt device and connect the labs with multiple ESXi hosts running a tiny ddwrt VM (with EOIP) without creating another VLAN on your network. I do this when when I set up a quick lab that needs physical devices like a kasa plug, tasmota device, a mobile device like a tablet, or a camera, I plug them into a cheap ddwrt device and use EIOP to have VMs appear on that lab network. Maybe openwrt can do that. I am open to trying if someone says it can do that. **So the bad** It doesn't have open vm tools, so you can't do a guest shutdown if it is a VM. Doesn't run an agent like telegraf to monitor performance with influxdb and grafana. Its all in the firmware so if a vulnerability in openvpn or dnsmasq is found you have to wait till a new image comes out. But yeah for production and if you have the horsepower or spare PC, go for pfsense or opnsense and I use pfsense and been testing the waters with opnsense. ---------------------------------------------------------------------- tech2but1 · 2023-10-29 18:59 > Its all in the firmware so if a vulnerability in openvpn or dnsmasq is found you have to wait till a new image comes out. Do new images still come out? I thought it had been abandoned as a project last time I looked. Noting current or recent seemed to be listed in the database and the firmware was still on the same version I was using years ago. ---------------------------------------------------------------------- lunakoa · 2023-10-29 19:44 Honestly I dunno, I been using the same image for my labs. I have saved config files for whatever purpose the lab is for. Mostly for dns, ip and wifi info. So been using the same image to match the config. ---------------------------------------------------------------------- TackOverflow · 2023-10-29 22:01 I never thought of running OpenWRT on desktop hardware. Interesting... ---------------------------------------------------------------------- Puzzled_Proposal2715 · 2023-10-30 00:35 I know it's just me being lazy, but I wish there was a simple export from pfsense and import into opnsense option. I've tweaked so many things over the years, I'd be lucky to find all the different rabbit holes everything is in without just walking through every menu option and writing everything down. ---------------------------------------------------------------------- segfaulting · 2023-10-30 06:44 VyOS is AMAZING ---------------------------------------------------------------------- expression_of_intent · 2023-10-30 11:56 For context, home lab is something that interests me. I don’t post here, but I do read a lot. This means I have no direct knowledge of any of the products mentioned in this thread. First up, this was a very interesting post and follow up thread, so thanks for that. Secondly, I cannot comment on the relative merits of the various products mentioned including opnsense, but that ‘opnsense.com’ stunt would be enough for me to never use any product coming from this company. I wouldn’t buy fish and chips from someone who did this. In any company I’ve worked for, if I raised this to the budget holder/decision maker there would be a red line crossing out that supplier. ---------------------------------------------------------------------- Whatwhenwherehi · 2023-10-30 15:24 Opensense Clearos Untangle Even unifi Are all free or free with hardware purchase. All good choices compared. ---------------------------------------------------------------------- Low-Chapter5294 · 2023-10-30 16:03 In what way is CE actually limited in a way that any of us would care? It sounds more like you have a grudge against them or a business practice that counted on using something for free that wasn't. ---------------------------------------------------------------------- Low-Chapter5294 · 2023-10-30 16:04 LOl - well done. ---------------------------------------------------------------------- Low-Chapter5294 · 2023-10-30 16:06 Yeah - non-free service being used for free? Not exactly baitandswitch. ---------------------------------------------------------------------- Low-Chapter5294 · 2023-10-30 16:08 Nice story bro. ---------------------------------------------------------------------- Low-Chapter5294 · 2023-10-30 16:10 Lol - what IETF standards... ---------------------------------------------------------------------- Low-Chapter5294 · 2023-10-30 16:11 Nice move to a closed source system...ok.. do you come to selfhosted often? ---------------------------------------------------------------------- Low-Chapter5294 · 2023-10-30 16:12 Write the script yourself. You can backup your config and take a look at the file. ---------------------------------------------------------------------- telenieko · 2023-10-30 16:19 TL;DR often goes at the top of the post, not the bottom 😉 ---------------------------------------------------------------------- thekrautboy · 2023-10-30 16:40 Just making sure you read the whole thing... ---------------------------------------------------------------------- Aronacus · 2023-10-30 16:57 I moved to a closed source system that isn't Fucking me! Are you old enough to remember the days where Redhat said they'd stand against Microsoft? You know Redhat Enterprise licensing are insane now? ​ I get you are basically calling me a "traitor" ---------------------------------------------------------------------- pdp10 · 2023-11-04 18:47 If you have IPv6 available, that doesn't use NAT. ---------------------------------------------------------------------- Daniel15 · 2023-11-04 19:56 A lot of stuff still uses IPv4 and thus uses NAT - for example Ookla's speedtest.net is still IPv4-only. ---------------------------------------------------------------------- pdp10 · 2023-11-04 20:07 You can offload [some large fraction of your traffic](https://google.com/ipv6/) to IPv6, reducing the impact of the NAT bottleneck. ---------------------------------------------------------------------- kmisterk · 2023-11-06 18:54 ## Message Removed Harassment, abuse, insults, expletives, or other negative comments or posts *targeting a person* is absolutely not tolerated. Bigotry, excessive elitism, and intentionally-demeaning dialogue will also be removed as deemed necessary. We aim to promote an inclusive, yet constructive community that helps people group. [Message the mods](https://www.reddit.com/message/compose/?to=/r/selfh osted&subject=Removed for Rule 3&message=[Removed Post](https://www.re ddit.com/r/selfhosted/comments/17i1dns/-/k6rl35z/\)) ---------------------------------------------------------------------- alex-eagle · 2023-11-07 14:58 I'm using IPFire 2.27 Super happy with it. I truly don't need the complexities of PFSense, although last time I use OPNSense, it was almost identical.