Comment by blinkingled | Hacker News Reader

Comment by blinkingled | Hacker News Reader

With the crappy, underpowered consumer routers with gaping security holes pfSense is a god send. Last few years I've been running pfSense and the experience has been fairly great.

I had a backup server running Ubuntu with ZFS which was always on anyways so I just had to install pfSense on OS disk and it imported the ZFS disks right away. So for a long time it was both my backup server and the router/firewall.

But lately with all the upgrades (including 2.3 betas and RCs I ran) SAMBA throughput was reduced significantly - not entirely sure if it were the drivers, ZFS or something else. And I realized maybe it is not such a great practice to make your router/firewall double up as a backup server. So I virtualized the box using ESXi and ran pfSense and Debian in two VMs on it.

The box being weak and running virtualized along side another backup server VM exposed the performance issues with pfSense - I had given a single CPU and 512Mb to it and with the GUI and other process overheads - DNS cache, pingers etc. meant that I had noticeable slowdowns when both VMs were active.

I am giving VyOS a try - it's a debian based router distro and purely command line based but resource utilization wise it seems to be doing fine with 512Mb and single CPU.

Anyone having a low power dedicated box for pfSense should just use pfSense though - the UI is way too good in 2.3 release and stuff just works - IPV6, Tunneling, VPN are very easy to configure along with a bunch of other things limited only by the box you're running it on.

There's also OpenBSD which lends itself very nicely for router/firewall setups.

The Ubiquiti edgemax routers are also pretty nice and cheap, they have a good GUI. I remember also someone here posting how he runs openbsd in the edgemax routers.

I have never looked into OpenBSD - but how is the driver support now a days? I did some searching around and looks like VMWare tools for example need to be installed in FBSD emulation mode. It might be a good idea from a security perspective, just not sure how well it will work either bare hardware or virtualized.

It has good in-kernel support for virtio drivers (e.g. kvm, bhyve, vmware) and can also run domU in the latest release.

It doesn't support "vmware tools" as such, but does support the virtual interfaces for network, disk, ballooning etc...

http://man.openbsd.org/OpenBSD-current/man4/virtio.4

Fwiw, the EdgeRouter Lite runs Vyatta on Debian on a MIPS CPU with hardware offload. It's really hard to build something more capable for "power user" home NAT duty for less money. Also, it's fanless and doesn't require too much tinkering to get working (though the web UI doesn't surface all the options -- you'll still likely need to invest an hour or two getting familiar with Vyatta, which is very similar to Cisco IOS from a CLI standpoint): https://www.ubnt.com/edgemax/edgerouter-lite/

If you're in the Bay, Streakwave (authorized Ubiquiti dealer) is right in San Jose: https://www.streakwave.com/mobile/searchresult.asp?Tp=

(WASD keyboards, makers of the CODE keyboard, are also in the Bay Area and do local pickup as a delivery option!)

I've been quite pleased with the uptime and performance of my little $100 million-packet-per-second router. I used to be a big believer in pfsense, but the ERLite got me to retire that old thing.

I recognized your reply from /r/pfsense. Dude, you are running unsupported scenario and using your pfSense as NAS. That is a big no no

And I realized maybe it is not such a great practice to make your router/firewall double up as a backup server. So I virtualized the box using ESXi and ran pfSense and Debian in two VMs on it.

It sounds like that was previously the case, but the complaints above appear to be pfsense in a VM and debian in a different VM. Why wouldn't that scenario be supported?

As I expected someone would, small world :) Just to clarify though I moved to VM based setup after that and had issues due to the hardware being weak.

If you're a BSD fan, why not use FreeNAS + pfSense on separate VMs? Let them both do what they're good at :)

I put Bhyve support in pfSense so people could do this.

Exactly, I wonder why aren't there any Consumer Router Based on this. I dont need any config or enterprise features.

Reply on news.ycombinator.com