Hacker News Reader

Comment by mwpmaybe | Hacker News Reader

Just a quick shout-out for pfSense as an excellent router OS. I've been playing around with ClearOS, DD-WRT, m0n0wall, Smoothwall, Shorewall, etc. (as well as many of my own home-grown solutions) for years and nothing even comes close to the features and performance offered by pfSense. DD-WRT is close but you're extremely limited in terms of the hardware it will run on (think WRT54G/L units with ancient processors and 16MB RAM). Not to dismiss all those other efforts but pfSense is at least worth a try. The writer of this article seems to disregard it off the bat but it's worth the time investment if you're looking for something secure and stable with features like Snort, VPN, traffic shaping, country blocking, DNSBL... the list goes on and on! Plus, it gave me an excuse to finally get my feet wet with FreeBSD. :-)

View on HN

I helped make a list[0] (which is still kept current) of OpenWrt and dd-wrt hardware a while back. You might want to give OpenWrt another chance, it may not be as outdated as it might seem.

[0]http://rooftopbazaar.com/routerfirmware/

Can you run OpenWRT/DD-WRT on off-the-shelf x86-64 hardware?

I haven't done so personally, but they have 86-64 builds yes. http://www.instructables.com/id/Openwrt-on-a-pc/

I used to run my customized build of OpenWRT on an old, passively-cooled Pentium II box. It ran completely from ramdisk and had all configuration baked into this ramdisk image so that the noisy HDD could be powered down immediately after bootup. This was before the era of cheap small SSDs.

The official builds support installation on disk partition just like any other Linux distribution.

I would have liked to see a comparison between Ubuntu and pfSense on the same hardware. It would have also been useful to subject each of the routers to at least a basic pentest.

pfSense is a good operating system and provides a nice pointy-clicky interface for configuration. I'll give it that.

I was a bit turned off by how they yanked the pfsense-tools repository and then put in some restrictions on access to it.

(Jim: There's no need to reply and have the same conversation yet again. I'm well aware of what your reasons for doing so were and you are well within your rights to do it; we don't have to agree with it or like it, though.)

pfSense is FreeBSD with a clunky web interface that does some "magic" with PHP using XML. now, that characterization won't be as accurate in the future (I'm genuinely curious to see what happens with python, dpdk, and other things they've mentioned/hinted at) but let's be entirely honest here: it's FreeBSD with a web interface and a support company behind it.

Most router/firewall distributions can be described in such overly-simplistic terms.

pfSense-tools is no longer used in pfSense 2.3 (which is in beta).

https://blog.pfsense.org/?p=1842

I think your info on DD-WRT's hardware support is a bit outdated. When I bought my last router, an Asus AC68, full support was one of my mandatory criteria.

Yes, you're correct, DD-WRT runs on modern consumer AP/router hardware. But the processing power* of that Asus (a quick google tells me 800MHz x 2 cores with 256 MB RAM) pales in comparison to e.g. an Atom C2358 (1.7 GHz x 2 cores) with 4 GB RAM. You can't run DD-WRT on the latter, or at least not last I checked, which is the point I was trying to make (albeit poorly). And when it comes to running things like Snort, VPN, etc., you're going to want that extra memory and processing power. Granted, it's probably overkill for most people, but one might say the same about the Homebrew/Ubuntu solution described in the OP. The whole point of the OP was moving away from MIPS-based consumer AP/router hardware with small memory footprints.

* And yes, the Asus has silicon dedicated to networking features, but so does the C2358.

Reply on news.ycombinator.com