Hacker News Reader

Comment by pelasaco | Hacker News Reader

if you are here and considering to use pfSense, please take a look on https://opnsense.org/ and more important https://docs.opnsense.org/history/thefork.html

View on HN

I'm really stuck between deciding on which. opnsense claims it's concerned about code quality and separating logic from the UI. Sounds great (and means that pfSense must really suck in terms of code quality and security if they aren't doing that) but then following the link to the PHP framework they use you get:

> A full-stack PHP framework delivered as a C-extension!

I mean, I've can't even begin to imagine how insecure that awful combination of insecure by default languages is.

Yes, it's no Rust, but so what? You'll be dealing with a locked-down box in most/all situations, stuff won't be accessible to other than the sys admin (unless you misconfigure it).

I can't really comment on the quality of the code, my reason for going opnsens over pfsense is mainly because the company that owns pfsense seem to be real asshats.

But, looking at: https://docs.opnsense.org/development/architecture.html It seems that it's mostly just the frontend that's php, or am I missing something?

Yes, I certainly feel much better now I read that thank you. I think I'll probably use opn then.

>> A full-stack PHP framework delivered as a C-extension!

> I mean, I've can't even begin to imagine how insecure that awful combination of insecure by default languages is.

What is inherently insecure about PHP? Or Phalcon? Do they have vulnerabilities that other C programs don't have?

PHP itself used to have a poor security track record. Not sure what the situation is these days? I guess this[1] is one place to start.

C programs are often exposed to classes of vulnerability owing to weaker safety guarantees see[2]

[1] https://wiki.php.net/cve

[2] https://msrc-blog.microsoft.com/2019/07/22/why-rust-for-safe...

Vulnerabilities in PHP appear regularly. A mass of them for PHP 7.x appeared in my inbox yesterday:

https://ubuntu.com/security/notices/USN-5006-1

I should think a quick google of "C string vulnerability" will answer your question.

Ah yes, the C users got triggered.

OPNSense replaced a lot of the old PHP that was in pfSense after it forked. So if PHP is a concern for you, you could argue that's OPNSense's PHP is better than pfSense's PHP.

OPNSense also splits front-end into the MVC and control layer, as well as the back-end between the control layer and the configuration daemon which is written in python.

All of the actual packet processing and daemons are C or C++, essentially the standard packages you'd find in FreeBSD.

Whether PHP or C is more secure depends on who wrote it.

I'm not a PHP programmer so I can't assess the quality of the code myself but do we know objectively that OPNSense's PHP is better than pfSense? That seems like a big assumption that just because it's been rewritten it's more secure or "better"

I do because I've worked with the code. It's not 100% beter or something like that, but the Phalcon framework does impose quality requirements to work with it effectively. It also has immutable facilities loaded as an extension (for speed benefit but also means you can't actually mess with the framework at runtime).

While I haven't really done any hardcode PHP work after PHP5 came out, there are plenty of ways to do it wrong, and a few ways to do it right. One thing is separation of concerns and encapsulation to the point where a fault in PHP can only mess up the PHP part and not the external system PHP calls into to ask for configuration changes.

Currently, a lot of the old pfSense code has been removed and replaced with code in the MVC framework, but it's a lot of work, and the team behind open-source OPNSense isn't huge. It will take time to cover it all.

If it helps, about a year ago I was replacing a UniFi setup at home and I was trying to decide with pfSense or OPNsense. After poking at both in VMs for about a week I settled on OPNsese.

My main reasons were that it did everything I wanted pfSense to do, something about the UI felt a bit smoother to me, and it didn't have the smarmy/wonky feeling that pfSense does (aggressive company behavior, closed-ish stuff, and then post-switch the Wireguard stuff happened).

I'm running this on a Protectli FW4B and have been quite happy. It's still doing exactly what I wanted, updates have been good, a bug I reported got fixed quickly, and it's... just working.

Also, by going to open hardware (and not the Netgate stuff I was originally thinking of) I can switch to another platform (eg: Untangle, OpenBSD) if desired.

But, for the forseeable future, OPNsense seems to be working just fine. <shrug>

What moved you off of Unifi? Did you move off entirely, or just for the gateway?

I moved entirely. It was mostly the GW that I didn't like. The primary bug was when they changed the maximum SSID length from 32 (standard) to 31 and I could no longer edit my network.

I also had a very frustrating ARP bug where ARP broadcasts wouldn't work across mesh'd APs (https://www.reddit.com/r/UNIFI/comments/ghs4bg/arp_for_clien...).

Then there was just some various other quirkyness/weirdness, and I happened to get out just before the big security breach was disclosed.

I ended up going to a Ruckus R610 AP that I got via eBay running the Unleashed OS, and it's outstanding. Coverage is so good I no longer need my old AP + extra mesh'd one.

For switching I'm just using an old TP-Link that I had laying around.

UniFi seemed really neat at first, but then it just felt... overwraught. I don't need single-pane-of-glass monitoring of a ton of stuff for my home network. I don't want to run a management software server just for my home network. I do want something robust, but I don't want to worry about it, and I want to be able to piecemeal upgrade it. A small PC running OPNsense + a solid AP + just whatever for switching does exactly that.

(I'm not a homelab-type person... If I want that I use VMs, or my employer's hardware. I want my home network to be a solid, reliable utility that requires little maintenance. I don't want to be tweaking my home network after my day job.)

PHP is already written in C and can be quite secure when following best practices (as with any language), so I'm not sure why an additional PHP extension written in C would be a red flag?

Note that Phalcon is a PHP extension (not a C extension) that provides new functionality available in the PHP runtime. This is roughly equivalent to a Ruby gem with a C extension, like Nokogiri.

> I've can't even begin to imagine how insecure that awful combination of insecure by default languages is.

Phalcon was at one point moderately well-regarded, though it's fallen out of favor for a wide variety of reasons, mostly the PHP development style moving on. I say this because as near as I can tell, Phalcon has had an entire single CVE in its entire decade plus of active development.

Casual anti-PHP bigotry isn't just uninformed, its harmful.

I considered both and ended up just using pf on OpenBSD. Very simple config on top of a rock solid OS.

OpenBSD is also my go to. The only caveat I'll throw out is when I upgraded to gigabit internet I discovered OpenBSD on the protectli FW4B couldn't keep up. In fact in iperf benchmarks it pushed ~300 Mb/s to FreeBSD's 600 Mb/s. Considering all the work done on Linux's network stack I plan to try it next to see if I can squeeze any more out of the hardware.

Just means anyone who wants to try OpenBSD should spec something a little more powerful than that appliance.

Makes sense. Open bsd focuses on code quality and security not performance. I bet a lot of DMA tricks are poo poo’d by openbsd

Linux + nftables isn't a bad combination. Certainly an improvement over the old iptables userspace.

I don’t know if it would fix your problem, but pf on FreeBSD is SMP-enabled unlike OpenBSD’s. You have to deal with using the “old” pf.conf syntax though.

I've been looking to replace the ancient, used, power hungry, overbuilt 2U rack server I'm currently using for PfSsense with something lighter (ditto my Proxmox server, incidentally). Last I used OPNsense it had issues with the NICs in whatever it was I put it on that caused it to frequently drop connections. Is there any recommended hardware for OPNsense?

I have used a low power Qotom Intel-based mini pc with 4 NICs running Opnsense since version 18.x. I bought it off Amazon for 300 USD and it runs like a charm. It currently serves my 1Gbps fibre connection with significant amount of simultaneous workloads without a sweat. Only downside is in the older models the Qotom bios will not get past POST if no screen is plugged in, so you will need either a screen when you reboot or a stump VGA cable with a resistor built in. Apart from this, I can highly recommend it.

Seconded. These are my default choice for pfsense (and probably opnsense in the future).

Only issue I've had is that if it's a J1900 Celeron CPU, ensure you have the machine set to boot via UEFI before installing. (IIRC there's an open issue for FreeBSD installations failing to legacy boot on J1900 boards.)

Good point. My current firewall is an older Celeron cpu and with 20+ devices hammering the 1Gbps fibre,I can hardly make it sweat.

Stay away from Realtek and I’m sure you’ll be fine. Intel would be my first pick followed by Chelsio (for 10gb). Broadcom will be serviceable.

In all cases I’d double check the individual chipset by doing a quick search on the forums whether you decide to go pf or opn.

Yeah, see, that's the kind of research I was hoping to avoid. I just want to buy one thing that I know will work.

You are going to run into that issue with literally any OS or distro you choose. If you don’t want to spend 30 seconds typing a search for i210 (or insert chipset) then you should buy one of the appliances that opnsense sells. Just expect to pay a premium to be lazy.

> You are going to run into that issue with literally any OS or distro you choose.

PfSense offers a range of hardware they support, which disproves your assertion by itself without even mentioning companies like Apple and System76.

> one of the appliances that opnsense sells. Just expect to pay a premium to be lazy.

I'm totally willing to pay a premium to be lazy. Where did I imply otherwise? If OPNsense offers hardware these days then why didn't anyone just say so?

> PfSense offers a range of hardware they support, which disproves your assertion by itself without even mentioning companies like Apple and System76.

That disproves nothing. If you want to build your own system you need to research hardware if you want to have a pain free deployment.

> I'm totally willing to pay a premium to be lazy. Where did I imply otherwise? If OPNsense offers hardware these days then why didn't anyone just say so?

This forum is generally filled with people who want to build their own. As for why nobody mentioned they sell hardware: probably because they sold hardware from the beginning and it’s advertised all over their site?

> That disproves nothing. If you want to build your own system you need to research hardware if you want to have a pain free deployment.

Again, I said nothing about building my own.

> This forum is generally filled with people who want to build their own.

This forum is generally filled with people with a lot of qualities. For instance, there are a lot of people here who buy Apple products, which are very much not in the spirit of building one's own. Your assumption doesn't make a lot of sense to me.

> As for why nobody mentioned they sell hardware: probably because they sold hardware from the beginning and it’s advertised all over their site?

That's fair, I haven't looked at their site in ages because the last time I used OPNsense was after the very initial split and to my recollection there was no hardware then.

OPNsense NIC compatibility seems mostly down to FreeBSD compatibility since it's built on the latter. So you can look at guides for FreeBSD itself or other systems based upon it. For example, STH's rundown of "Top Picks for FreeNAS NICs" [0] applies pretty well to OPNsense as well. The short version is that Intel and Chelsio have excellent support, though for just 1 GbE not really any reason to get anything but Intel. STH recommends Chelsio for 10GbE+ and from my limited testing that matches my experience pushing OPNsense as well. The main thing I encountered you should be aware of is that OPNsense (at least as of the current version 21.x) does not enable the Chelsio driver (cxgbe) by default so you need to add the loader to have it recognized. See the FreeBSD man page cxgbe(4) [1], you can add that in the Web GUI via System > Tunables.

----

0: https://www.servethehome.com/buyers-guides/top-hardware-comp...

1: https://www.freebsd.org/cgi/man.cgi?query=cxgbe&sektion=4

Alright, let me rephrase this since people are misunderstanding:

Does the OPNsense project recommend or endorse any specific models of low-power all-in-one computer hardware for running OPNsense? And if no, is there any specific thing the community would recommend?

I don't want to spend hours on research or build something on Newegg. I want to by a complete piece of hardware that I install OPNsense on and know that I won't have to worry about hardware compatibility.

PS: Apparently OPNsense offers their own appliances these days just like PfSense does.

I use a few of these, they work great. Although I personally run Linux on them, I don't see any reason why OPNSense wouldn't work, as it's essentially just an x86_64 system:

https://www.pcengines.ch/apu2.htm

I've been using one of these for over 5 years as a home router, it's been very stable, not a single issue, only reboots have been for OS upgrades. Very nice little boxes. Had to put it together initially (think the heat sink and nvme and case) but that was straight-forward. Has supported everything I've needed over the years.

Is it easy to migrate pfSense instances to OPNSense?

How does security patching compare?

Opnsense has been far more consistent with their upgrade releases.

Migration is really a complete reinstall and rebuild of your rules. I took a backup of my physical pfsense box and restored it to a VM then reinstalled opnsense on the physical hardware. With the pf box running in a vm I could just reference it while creating new rules.

I think someone made a script to load a pfsense backup onto an opnsense instance but I really think you’re better off with a clean slate.

I did the same thing, pulled up my pfSense config in a VM side-by-side with the fresh OPNSense install and manually ported everything over.

Kind of a pain, sure, but I felt better knowing it was a fresh build and everything was where it should be.

Reply on news.ycombinator.com