Hacker News Reader

Comment by muppetman | Hacker News Reader

Please use Opnsense now, or something else entirely (Vyos is great but CLI based).

I was a big pfSense fan, telling myself that the odd stuff Netgate did was normal/justified.

Until the attack on Wireguard's Jason A. Donenfeld. Then I realised - it's all true. They are bordering on insane in that organisation. I regret suggesting my old workmate purchase some of their hardware now.

Opnsense is a great replacement. I'm sure it's not perfect, but they're open, friendly, responsive and don't make you question every comment you write on their forum for fear of being banned.

View on HN

> Until the attack on Wireguard's Jason A. Donenfeld. Then I realised - it's all true. They are bordering on insane in that organisation. I regret suggesting my old workmate purchase some of their hardware now.

This sounds fun. do you know where I can read more?

edit: think i found a good start https://www.reddit.com/r/networking/comments/m6zjie/wireguar...

HN thread: https://news.ycombinator.com/item?id=26475519

Events in chronological order:

- zx2c4 points out the brokenness of the Netgate implementation and his efforts to fix it: https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649...

- ... which ends up being published by Ars: https://arstechnica.com/gadgets/2021/03/in-kernel-wireguard-...

- Netgate throws a fit, zx2c4 responds: https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649...

- FreeBSD maintainer of the WireGuard implementation announces Netgate's implementation will be removed: https://lists.freebsd.org/pipermail/freebsd-hackers/2021-Mar...

- Netgate's damage control / copium response: https://www.netgate.com/blog/painful-lessons-learned-in-secu...

- FreeBSD dev steps down from further involvement with WireGuard-in-FreeBSD: https://lists.freebsd.org/pipermail/freebsd-hackers/2021-Mar...

> zx2c4

is Jason (Wireguard creator).

I just found these tools that help with migration. They pretty print the configuration XMLs such that one can transfer the settings manually through the GUI step by step and finally verify with the second tool.

https://github.com/TKCERT/pfFocus

https://github.com/AndyX90/OPNReport

https://www.reddit.com/r/OPNsenseFirewall/comments/masujb/ti...

But don't use these if your configuration is simple enough that you can manually recreate it, on the completely-impossibly-rare chance that pfSense has managed to subtly bork itself and you're switching to OPNsense to get a more reliable device....

I highly recommend implementing the firewall rules form scratch.

Firewall rules tend to aquire "cruft", especially in domestic settings, where you add rules to "fix something", and there is rarely any review of existing rules.

Personally i keep a spreadsheet of the firewall rules i need, including inter VLAN communication, with source/destination ip/port as well as a link to any article describing why this port needs to be open (like Sonos across VLANs, etc).

It sounds cumbersome, but it doesn't change frequently, and reimplementing it in a new firewall takes 30-60 minutes.

> (Vyos is great but CLI based)

The best firewalls/routers i've ever used have been Vyos (or Vyatta) based.

Point & Click has it's charms, but its a crutch. With Vyos you can "replay" you entire configuration over a serial port, as well as make changes to it in a regular text editor.

It does have a learning curve though :)

I'm also on the UniFi line of things for now, but i really wish somebody would make a decent Vyos based appliance (low powered ARM device) like the Ubiquiti Edgerouters of old.

Are you aware of any trustworthy, free VyOS builds? I'd be interested in trying it out at home, but I'm not interested in paying $6k/year or using an unstable nightly. I tried building it myself once but didn't have time to get it working locally.

Yeah. $6k/year is just waaaay too much to get into it.

You'd be amazed at how stable the 1.3 builds are.

Do you mean the 1.4 rolling builds? The 1.3 ones require a support contract.

You can get monthly snapshots free of charge which receive some testing compared to rolling builds. They currently have 1.3 RC builds https://vyos.net/get/snapshots/

I wasn't aware of that. Thank you

Yea, my home router is Vyos now (running under Proxmox virtualisation) and it's just 100% rock solid. Uptimes of 120 days until I reboot it etc. I used to use pfSense but migrated when I hit a pfSense CPU bug. I also find I get better performance (less CPU usage) running "Linux under Linux" instead of "FreeBSD under Linux" was I was with pfSense (it was virtulised too)

Long live the CLI :)

What "pfSense CPU bug" are you talking about? Do you mean the Intel C2000 bug[0] that had nothing to do with pfSense and also affected dozens of other vendors, including Cisco among others?

[0] https://www.anandtech.com/show/11110/semi-critical-intel-ato...

I similarly am running openbsd as a home router under proxmox and it’s rock solid. I had more time on my hands when I set it up than I do now, but thankfully it’s without issue and just seems to always work so there isn’t really any maintenance other than point upgrades to openbsd when I remember.

I've considered virtualizing my current hardware Opnsense router, mostly to save on electricity. But I fear the situation of needing to do maintenance or troubleshooting on the Proxmox host without internet. What fallback do you have?

I have a cluster of 3 Proxmox hosts, mostly to teach myself about clustering. I have two Vyos instances running VRRP between them. If the primary fails, the secondary sees the VRRP state change, runs a small script to bring up the PPPoE interface and we're away laughing. It syncs state, so people notice ~8-10 seconds of packet loss and everything just keeps going.

It's quite nerdy though. And all it does is move the single point of the failure to the switch (required for the hosts to talk to each other for VRRP etc)

Proxmox is so reliable in my experience though, but I don't tend to fiddle with it, just set and forget.

This is my main issue with pfSense/OpnSense. Even the dedicated hardware appliances are quite power hungry compared to some of the rather capable Linux ARM boxes out there.

For comparison, an 8 Gbps capable pfSense appliance (like the Netgate 4100) requires 40W-50W (max 60W), where the UniFi Dream Machine Pro, also capable of 8Gbps, has a maximum power consumption of 33W, which includes a 3.5" harddrive for UniFi Protect. Mine uses about 18W without the harddrive, and 22W with a WD Red.

A difference of 25W over a year at current european electricity prices (€0.5/kWh) means a saving of 219 kWh (€109/year). Considering that electricity has been as high as €1.12/kWh this spring, it could be even higher.

As for virtualization, while it's a great learning experience, it's probably more trouble than it's worth. I greatly prefer appliances for network.

Yeah, I'm in the same boat, but I doubt its gonna save much electricity, and whenever I patch ESXi (or Proxmox) the entire internet connection is down.

> like the Ubiquiti Edgerouters of old.

Wasn’t EdgeOS a fork of Vyatta?

Yep.

I switched before the WireGuard fiasco, when they announced they were EOLing the CE line, but weasel-worded to avoid having to use the phrase "EOL".

https://news.ycombinator.com/item?id=27775408

https://news.ycombinator.com/item?id=26479725

Their hardware has not been reliable. We've purchased 4 devices from them for our medium sized business - and 2 of them failed completely within 5 years. Maybe both failures were anomalies, but these were the only two commercial grade devices we've had that failed in that same period.

I'm not sure what these devices are based on, but there was a time when a lot of the Netgate lineup was using Intel C2000-series Avoton CPUs. Down the road it was discovered all of those were susceptible to a hardware big known at AVR54. Could it be why your devices failed? More info here: https://www.servethehome.com/intel-atom-c2000-series-bug-qui...

SG-8860 and a SG-4860 - which use the Intel "Rangeley" Atom C2758, and Intel “Rangeley” Atom C2558, respectively.

Not sure if they were impacted by the bug.

Just read the blog post from Netgate, sounds to me like they have decent values. Also them asking to keep safe disclosure procedures doesn't sound insane to me either. Beyond that it's a he said she said thing IMHO, and I don't have the time to get involved in any of that. Stuff happens between people, and them not managing to work it out doesn't per se mean they are evil or "insane".

I'm an Open Source user of pfSense (so they don't get money from me) but I still had an extremely helpful experience recently, when I had a feature request. Once I filed it, it was implemented quickly, MUCH better support than I could ever expect from a paid commercial firewall. Also the product runs reliably and is very stable since years. So I won't look for alternatives any time soon.

Netgate pissed off the open source absolutists, who mostly don’t give netgate money.

While I understand their complaints, I don’t understand the constant attacks and hate, as anyone who doesn’t want to support pfsense if there is a paid and a free oss version, is welcome to start a fork or work on other projects.

I recently switched to Ubiquiti’s Unifi line and am extremely happy, mostly for moral reasons, compared to how I felt being a pfSense user these last few years.

There is some bad bad shit in that kit.

The APs are good and the switches too in my experience. However the UDM-P is a troubled device. It’s buggy, things break or stop working and it loses its config every so often. The form factor is very compelling and the concept is great.

I’d pay more if the software quality were better.

> However the UDM-P is a troubled device. It’s buggy, things break or stop working and it loses its config every so often.

I've been running a UDM and UDMP for years, and have literally never run into any of those issues, despite having a somewhat complex network (for a home network anyway).

It runs 24/7 and only needs reboots when a software update requires it. Multiple VLANs, road warrior VPN. I run a site to site VPN between my UDMP at home and UDM at my summerhouse, and that has been rock solid as well.

In the latest EA version of the software, there is also some support for Wireguard (though UI's Teleport). I'm not sure if "raw" Wireguard is available (yet).

Latest version also implements policy based routing.

I’m looking forward to using WireGuard on the device (I already use it, but from within the network).

I’m in the latest stable version, as I updated after an outage last week where the controller was crashed.

The variability in user satisfaction suggests some sort of hardware issue or bugginess that hits a small portion of users.

Ubiquiti is also morally questionable. They do not contribute their modifications to the Linux kernel as required by the GPL.

Maybe that has changed but I'm not aware that it has.

There's also that time they slipped telemetry reporting into their software and hoped no one would notice.

https://www.theregister.com/2019/11/07/ubiquiti_networks_pho...

That, plus they try very hard to drive you to their cloud. It's not necessary, at least with older hardware, but their cloud has been breached and people should probably ask if they really need its convenience vs cost, privacy and security.

I just ended up resetting my network (switch, sec gateway, controller, and AP) and it's a little tricky without their cloud. You need to do some SSH'ing.

Caveats aside, the hardware is outstanding, the disk AP is solid as is the consumer grade cube one. It's a good prosumer and small business option despite the downsides.

I switched to openwrt a few years ago, after a brief stint of using an edge router from ubiquity. vyos is nice, but openwrt is surprisingly solid too!

Same here, always recommend openwrt when asked for home / office routers/firewalls.

Reply on news.ycombinator.com