PfSense 2.3-Release Now Available | Hacker News Reader

PfSense 2.3-Release Now Available

blog.pfsense.org

55 pointsy0ghur7_xxx32 comments

With the crappy, underpowered consumer routers with gaping security holes pfSense is a god send. Last few years I've been running pfSense and the experience has been fairly great.

I had a backup server running Ubuntu with ZFS which was always on anyways so I just had to install pfSense on OS disk and it imported the ZFS disks right away. So for a long time it was both my backup server and the router/firewall.

But lately with all the upgrades (including 2.3 betas and RCs I ran) SAMBA throughput was reduced significantly - not entirely sure if it were the drivers, ZFS or something else. And I realized maybe it is not such a great practice to make your router/firewall double up as a backup server. So I virtualized the box using ESXi and ran pfSense and Debian in two VMs on it.

The box being weak and running virtualized along side another backup server VM exposed the performance issues with pfSense - I had given a single CPU and 512Mb to it and with the GUI and other process overheads - DNS cache, pingers etc. meant that I had noticeable slowdowns when both VMs were active.

I am giving VyOS a try - it's a debian based router distro and purely command line based but resource utilization wise it seems to be doing fine with 512Mb and single CPU.

Anyone having a low power dedicated box for pfSense should just use pfSense though - the UI is way too good in 2.3 release and stuff just works - IPV6, Tunneling, VPN are very easy to configure along with a bunch of other things limited only by the box you're running it on.

There's also OpenBSD which lends itself very nicely for router/firewall setups.

The Ubiquiti edgemax routers are also pretty nice and cheap, they have a good GUI. I remember also someone here posting how he runs openbsd in the edgemax routers.

I have never looked into OpenBSD - but how is the driver support now a days? I did some searching around and looks like VMWare tools for example need to be installed in FBSD emulation mode. It might be a good idea from a security perspective, just not sure how well it will work either bare hardware or virtualized.

It has good in-kernel support for virtio drivers (e.g. kvm, bhyve, vmware) and can also run domU in the latest release.

It doesn't support "vmware tools" as such, but does support the virtual interfaces for network, disk, ballooning etc...

http://man.openbsd.org/OpenBSD-current/man4/virtio.4

Fwiw, the EdgeRouter Lite runs Vyatta on Debian on a MIPS CPU with hardware offload. It's really hard to build something more capable for "power user" home NAT duty for less money. Also, it's fanless and doesn't require too much tinkering to get working (though the web UI doesn't surface all the options -- you'll still likely need to invest an hour or two getting familiar with Vyatta, which is very similar to Cisco IOS from a CLI standpoint): https://www.ubnt.com/edgemax/edgerouter-lite/

If you're in the Bay, Streakwave (authorized Ubiquiti dealer) is right in San Jose: https://www.streakwave.com/mobile/searchresult.asp?Tp=

(WASD keyboards, makers of the CODE keyboard, are also in the Bay Area and do local pickup as a delivery option!)

I've been quite pleased with the uptime and performance of my little $100 million-packet-per-second router. I used to be a big believer in pfsense, but the ERLite got me to retire that old thing.

I recognized your reply from /r/pfsense. Dude, you are running unsupported scenario and using your pfSense as NAS. That is a big no no

And I realized maybe it is not such a great practice to make your router/firewall double up as a backup server. So I virtualized the box using ESXi and ran pfSense and Debian in two VMs on it.

It sounds like that was previously the case, but the complaints above appear to be pfsense in a VM and debian in a different VM. Why wouldn't that scenario be supported?

As I expected someone would, small world :) Just to clarify though I moved to VM based setup after that and had issues due to the hardware being weak.

If you're a BSD fan, why not use FreeNAS + pfSense on separate VMs? Let them both do what they're good at :)

I put Bhyve support in pfSense so people could do this.

Exactly, I wonder why aren't there any Consumer Router Based on this. I dont need any config or enterprise features.

Not that a firewall needs to look pretty, and yes, I know it's Bootstrap, but the new UI is so much more pleasant to look at! Worth it for this alone.

And even then, the largest benefit of all that new GUI code is not the look, but rather the regularity it brought to the source code for same, after over 12 years of organic growth of same.

I'd really love to see an API or a unified configuration system. At $WORK we have a need for many small firewall appliances, but I refuse to use anything we can't deploy zero-touch, automate, monitor and back up/restore in a semi-sane way.

Either it needs a configuration language like Cisco/Juniper than can be dumped/imported/configured over SSH, or a web API (supposedly on the roadmap for pfsense 3.0 ... ?). I can't say I'm too familiar with the project, but it feels like it's just not a priority and that it's is going to remain very web UI focussed.

> I'd really love to see an API or a unified configuration system.

That's next (3.0)

> feels like it's just not a priority and that it's is going to remain very web UI focussed.

part of it is the audience we have. part of it is dealing with the architecture we have.

but... trust me, it's likely more important to me than you.

pfsense was forked a year or two ago, their 2.3 is just to keep up with the new kid on the block opnsense. And guess what, they have an API ;) https://opnsense.org/

I don't really see what OPNsense has done too much differently, other than commence re-writing the UI in a different PHP framework and Bootstrap it.

To look at it, you're largely looking at pfSense.

I couldn't find a clear map of what has been changed or added to.

One of the team members at OPNsense "liberated" the source to his former employer's fork of pfSense (they were using it for their product.)

That's how they got to where they are. The pace of innovation in that project has slowed since its launch.

I have had decent luck the few times I've just dumped the xml config from one pfSense box and loaded it on another.

But yes, I eagerly await the API in 3.0

Super nasty but RouterOS has an API: http://wiki.mikrotik.com/wiki/Manual:API

The hardware has been around for a long time (Soekris) and there are many out in the field.

Such a wonderful product! Thank you everyone that works on the code!!! I'm finally able to buy them from the store, feels good to give back after all these years.

Hmm, it looks like pfSense doesn't support the one requirement I have of any router: per-IP (not _interface_) statistics. Is this really such an unusual thing to want? I want to know how much traffic each device on my network is producing, in each direction. Ideally also: for suspect devices, I'd like to know _who_ they are talking to.

Sounds like you're looking for the darkstat package, which is available in pfSense.

Awesome. I got a Qotom Q190PG4 and am up an running.

I recommend having a look at ntopng. I seem to recall that the package is available in pfSense (however it might not be available in 2.3 -- see the release notes).

I just want to say I absolutely love pfSense! After going through so many routers I decided to just build my own... For the same cost of a high end consumer router I built my own 802.11AC Gigabit router that can handle anything without crashing every day!

Yeah, old design was feeling dated when I had to make couple changes from my phone.

Only wish list I have -- allow ZFS on root with zraid. Hope, it's possible in the future.

Very near future. We're changing the installer for 2.4 (based on 11). Should be available later this year.

Great work. I have been using pfsense for 5.5 years now and it never disappoints.

In my last round of my linux firewall comparison I liked opnsense very much:

https://opnsense.org/

not affiliated, I just liked it. However the GUI is made of many php scripts (if they did not change meanwhile) - so it would be great if many more eyes would like to take a look at the code...

They took those PHP scripts and rewrote / are rewriting them in a different PHP framework, for better, or worse.

New account...

Reply on news.ycombinator.com