Hacker News Reader

Comment by SigmundA | Hacker News Reader

Probably because Scott Long considers Jason Donenfield an "attacker" of PfSense, FreeBSD and Netgate:

https://www.netgate.com/blog/painful-lessons-learned-in-secu...

Ars Technica wrote a report on the debacle[1], and I've since stopped using pfsense. I was already on the fence following their move away from open-source with "pfSense Plus"[2].

[1] https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice...

[2] https://www.phoronix.com/scan.php?page=news_item&px=Netgate-...

  "you either have a commit bit (enabling you to commit code to FreeBSD's repositories) or you don't. It's hard to find code reviews, and there generally isn't a fixed process ensuring that vitally important code gets reviewed prior to inclusion"

Doesn't sound very professional!

> I've since stopped using pfsense

I find myself in the same boat. What do you use/recommend instead?

Perhaps https://opnsense.org/ ?

OpnSense has long been the better option. It forked from pfsense years ago and has been better for a long time. Netgate engaged in some shameful behavior after the fork, their mistreatment of Jason isn't their first instance.

The only thing holding me back from opnsense is that there's no pfblockerng...

I don't use opnsense but a quick google revealed the following, is this not functionally the same?

https://www.cjross.net/dns-security-and-adblock-with-opnsens...

AdGuard Home is in the OPNsense community repo and a very nice alternative: https://www.routerperformance.net/opnsense-repo/

Unbound has a block list feature and there are several other options. None are quite to the same level as far as I know, but the rest of OpnSense makes up for it.

I'm an OpenWrt hawk, they have a plugin for DNS based blocking if you end up going that direction https://github.com/openwrt/packages/tree/master/net/adblock/...

I thought opnsense had various issues too? I can’t remember what, exactly, but perhaps it was around security or performance?

None that I have ever heard of. It uses HardenedBSD but they're dropping that soonish.

Maybe that’s what I’m thinking about. Seems early then to adopt?

Aside from community and WireGuard issues, any reason to abandon a working pfsense install?

I personally don't see the need, pfSense is rock-solid for my uses.

Not me personally, but I have a couple friends that have started using VyOS and they seem pretty satisfied.

https://vyos.io/

I swear by OpenWrt. It's not just for wifi routers. It's a regular Linux distro you can run on X86 too.

My favorite thing about OpenWrt is SQM CAKE, state of the art traffic shaping. A panacea for slow links

I'm in the same boat. As soon as I find time I'm nuking my pfsense router and installing OpenBSD. I just need it to do NAT, DHCP and always work. I don't need a fancy web-ui, traffic graphs or anything like that, I thought I did when I installed pfsense ~10 years ago but the only time I've logged in for any reason was when it stopped working for some reason (usually the ISP's fault).

OpenBSD's history is impeccable and I really don't want to have to think about my router after initial setup other than installing updates once in a while.

For my home use, I just switched to an Eero device. Not quite the same product categories, but my priority was software security, meaning that there are a very small number of workable options for home use.

Reply on news.ycombinator.com