Hacker News Reader

Comment by Jonnax | Hacker News Reader

I remember pfsense from them trying to merge bug ridden code into FreeBSD for Wireguard support.

The creater of Wireguard said it was bad with buffer overruns and they got angry for being called out.

https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice...

The software seems to be the default open source firewall / router network admins go to, but it seems like a ticking time bomb to me.

They also seem to be pivoting to a closed source firewall / router project so this will result in less work going in.

View on HN

I've been using pfSense for many years, generally happy with it. The wireguard fiasco made sense to me when I saw some former colleagues involved (including 1 I hired at a previous gig, and one I interviewed before he joined the co). Instead of taking their loss, admitting they screwed up, they tried FUD. This ... was in line with what I experienced in the past. Extremely unprofessional.

Thanks to them, several years ago I swore off FreeBSD. The tech may be ok/good, the baggage of personalities and egos is not worth it though. After seeing this, and at least the two of them associated with pfSense, I've now started looking for replacements for pfSense.

I've been thinking of OPNsense, though the whole FreeBSD bit bugs me (code/OS is fine, personalities/egos less so). Linux "equivalents" sort of exist, though reading through the various fora for them suggests similar ego/personality issues.

I'm not sure its bad enough to go back to dedicated firewall/router appliances (most are terrible and closed source). If there is a simple way to convert my pfSense config to a OPNsense config, this is likely to be the first step I take.

I'd love to hear other people's experience converting away from pfSense.

I don't follow; why would you swear off FreeBSD because a derivative product misbehaved? Would you swear off all Linux distros because Ubuntu did something bad?

The issue wasn't that the product misbehaved. The issue was the personalities/ethics of the people involved are grating/questionable at best. Having worked with them, I honestly question their judgements.

Since one or more of these people are or have been core committers on FreeBSD, this makes me question that project's judgement.

> If there is a simple way to convert my pfSense config to a OPNsense config

There is. You just back up your pfSense config, and then restore it into OPNsense.

Luckily, OPNsense is practically a drop-in replacement.

You could also go with my solution for this use case, which is to use pf on OpenBSD. Firewalls don’t necessarily need a web interface.

Pfsense and opnsense do far more than just packet filtering

I've wanted to go that way for some time, the real problem is that it's basically impossible to hand that off to another net/sysadmin. Imagine walking onto a new job, and they hand you a yubikey and say "here's your keys, the old guy whiteboxed everything with Debian and BSD. Have fun!"

Unfortunately, the only time CLI wins out in networking is when there's a cert to dangle in front of people. As much as I want to do things the "right" way, part of that equation is handing projects off to other people to maintain...

I would actually argue that having a few config files with good comments/documentation would be more clear than deeply nested web UIs.

I switched to OpenBSD/pf from pfsense and I have more peace of mind needing to maintain a small handful of commented config files.

Could you share your config files or suggest a starting point for migrating from pfSense?

> "here's your keys, the old guy whiteboxed everything with Debian and BSD. Have fun!"

Can you elaborate how GUI will be better ?

At least with CLI and plain text configs I have "#" so all configs are self documented and committed to git repository.

Unfortunately, the only time CLI wins out in networking is when there's a cert to dangle in front of people.

I'm not sure what world you live in, but in the Cisco world I don't know anyone who does anything beyond the trivial in the various 'GUIs'.

part of that equation is handing projects off to other people to maintain

Yes, and I don't know anyone who would hire a Cisco engineer that wasn't fully conversant with the CLI. The idea that something we've been doing, successfully, for decades (handing a text Cisco config to the next engineer) is "basically impossible" is...interesting...and unsupportable in my experience. As is the implied "GUIs are always easier to understand and reason about".

pfSense also allows for configuration of IPSec tunnels and VLANs etc etc. It’s not a WebUI for configuring pf

As does OpenBSD - VLANs and IPSec on the OpenBSD CLI are simpler than you think! Personally I think it's simpler and easier to use than even pfSense.

Point is still valid through. Especially compared to some overly-complicated implementations, the pfSense web UI for VLAN and IPSec can be a better alternative.

Linux + nftables (nft) also isn't a bad choice. I just replaced all my iptables scripts with nftables equivalents and it was actually a pretty enjoyable experience. Some highlights of nft over bash scripts with iptables commands:

1.) Your firewall scripts are now atomic (if using nft as your interpreter instead of bash), so either the entire ruleset gets applied, or nothing does.

2.) There's a nice declarative form of the nft syntax which I prefer (vs a more imperative style which we're all used to with pf (in the BSD world), or iptables)...both forms are executed atomically when the nft interpreter is used.

3.) The presence of an actual 'include' statement makes it possible to break your fw scripts up into multiple files, for better organization and readability. This also all gets executed atomically.

Overall I found it to be an enjoyable experience.

Of course. I wanted to move off of pfSense, but I wanted to roll my own. I tried to build something similar with NixOS but learning all the ins and outs of Nix got a bit overwhelming for a device whose config changes rarely. I ended up just grabbing OPNsense, installing it, copying my configs over, and it’s been a solid 48 hours since.

Can confirm. I recently set it up and ran into an issue with my ISP’s DHCP implementation. There was a pull request for PfSense from like 4 years ago that helped with the issue but remained open. The OPNSense developer I talked to merged a modified fix within a very short time and is even helping others test their broken PfSense systems.

Is there a way to import a pfSense Config into OPNsense? I would be happy to switch if I could import my existing settings...

Yup, backup on pfSense, then restore on OPNsense. Presto, it's that easy.

Doesn't seem like it is that easy anymore: https://github.com/opnsense/core/issues/2374

I switched to OPNSense (fork of pfSense) years ago and have been very happy with it. Consistent, reliable updates, and easy to understand interface.

Pfsense is NOT open source.

See https://news.ycombinator.com/item?id=25894420

Unfortunately this disqualified PfSense for me as well.

Reply on news.ycombinator.com