Hacker News Reader

Comment by user3939382 | Hacker News Reader

You could also go with my solution for this use case, which is to use pf on OpenBSD. Firewalls don’t necessarily need a web interface.

View on HN

I've wanted to go that way for some time, the real problem is that it's basically impossible to hand that off to another net/sysadmin. Imagine walking onto a new job, and they hand you a yubikey and say "here's your keys, the old guy whiteboxed everything with Debian and BSD. Have fun!"

Unfortunately, the only time CLI wins out in networking is when there's a cert to dangle in front of people. As much as I want to do things the "right" way, part of that equation is handing projects off to other people to maintain...

Unfortunately, the only time CLI wins out in networking is when there's a cert to dangle in front of people.

I'm not sure what world you live in, but in the Cisco world I don't know anyone who does anything beyond the trivial in the various 'GUIs'.

part of that equation is handing projects off to other people to maintain

Yes, and I don't know anyone who would hire a Cisco engineer that wasn't fully conversant with the CLI. The idea that something we've been doing, successfully, for decades (handing a text Cisco config to the next engineer) is "basically impossible" is...interesting...and unsupportable in my experience. As is the implied "GUIs are always easier to understand and reason about".

I would actually argue that having a few config files with good comments/documentation would be more clear than deeply nested web UIs.

I switched to OpenBSD/pf from pfsense and I have more peace of mind needing to maintain a small handful of commented config files.

Could you share your config files or suggest a starting point for migrating from pfSense?

> "here's your keys, the old guy whiteboxed everything with Debian and BSD. Have fun!"

Can you elaborate how GUI will be better ?

At least with CLI and plain text configs I have "#" so all configs are self documented and committed to git repository.

Linux + nftables (nft) also isn't a bad choice. I just replaced all my iptables scripts with nftables equivalents and it was actually a pretty enjoyable experience. Some highlights of nft over bash scripts with iptables commands:

1.) Your firewall scripts are now atomic (if using nft as your interpreter instead of bash), so either the entire ruleset gets applied, or nothing does.

2.) There's a nice declarative form of the nft syntax which I prefer (vs a more imperative style which we're all used to with pf (in the BSD world), or iptables)...both forms are executed atomically when the nft interpreter is used.

3.) The presence of an actual 'include' statement makes it possible to break your fw scripts up into multiple files, for better organization and readability. This also all gets executed atomically.

Overall I found it to be an enjoyable experience.

Pfsense and opnsense do far more than just packet filtering

Of course. I wanted to move off of pfSense, but I wanted to roll my own. I tried to build something similar with NixOS but learning all the ins and outs of Nix got a bit overwhelming for a device whose config changes rarely. I ended up just grabbing OPNsense, installing it, copying my configs over, and it’s been a solid 48 hours since.

pfSense also allows for configuration of IPSec tunnels and VLANs etc etc. It’s not a WebUI for configuring pf

As does OpenBSD - VLANs and IPSec on the OpenBSD CLI are simpler than you think! Personally I think it's simpler and easier to use than even pfSense.

Point is still valid through. Especially compared to some overly-complicated implementations, the pfSense web UI for VLAN and IPSec can be a better alternative.

Reply on news.ycombinator.com