Hacker News Reader

Comment by 8fingerlouie | Hacker News Reader

> (Vyos is great but CLI based)

The best firewalls/routers i've ever used have been Vyos (or Vyatta) based.

Point & Click has it's charms, but its a crutch. With Vyos you can "replay" you entire configuration over a serial port, as well as make changes to it in a regular text editor.

It does have a learning curve though :)

I'm also on the UniFi line of things for now, but i really wish somebody would make a decent Vyos based appliance (low powered ARM device) like the Ubiquiti Edgerouters of old.

View on HN

Are you aware of any trustworthy, free VyOS builds? I'd be interested in trying it out at home, but I'm not interested in paying $6k/year or using an unstable nightly. I tried building it myself once but didn't have time to get it working locally.

Yeah. $6k/year is just waaaay too much to get into it.

You'd be amazed at how stable the 1.3 builds are.

Do you mean the 1.4 rolling builds? The 1.3 ones require a support contract.

You can get monthly snapshots free of charge which receive some testing compared to rolling builds. They currently have 1.3 RC builds https://vyos.net/get/snapshots/

I wasn't aware of that. Thank you

Yea, my home router is Vyos now (running under Proxmox virtualisation) and it's just 100% rock solid. Uptimes of 120 days until I reboot it etc. I used to use pfSense but migrated when I hit a pfSense CPU bug. I also find I get better performance (less CPU usage) running "Linux under Linux" instead of "FreeBSD under Linux" was I was with pfSense (it was virtulised too)

Long live the CLI :)

I've considered virtualizing my current hardware Opnsense router, mostly to save on electricity. But I fear the situation of needing to do maintenance or troubleshooting on the Proxmox host without internet. What fallback do you have?

I have a cluster of 3 Proxmox hosts, mostly to teach myself about clustering. I have two Vyos instances running VRRP between them. If the primary fails, the secondary sees the VRRP state change, runs a small script to bring up the PPPoE interface and we're away laughing. It syncs state, so people notice ~8-10 seconds of packet loss and everything just keeps going.

It's quite nerdy though. And all it does is move the single point of the failure to the switch (required for the hosts to talk to each other for VRRP etc)

Proxmox is so reliable in my experience though, but I don't tend to fiddle with it, just set and forget.

This is my main issue with pfSense/OpnSense. Even the dedicated hardware appliances are quite power hungry compared to some of the rather capable Linux ARM boxes out there.

For comparison, an 8 Gbps capable pfSense appliance (like the Netgate 4100) requires 40W-50W (max 60W), where the UniFi Dream Machine Pro, also capable of 8Gbps, has a maximum power consumption of 33W, which includes a 3.5" harddrive for UniFi Protect. Mine uses about 18W without the harddrive, and 22W with a WD Red.

A difference of 25W over a year at current european electricity prices (€0.5/kWh) means a saving of 219 kWh (€109/year). Considering that electricity has been as high as €1.12/kWh this spring, it could be even higher.

As for virtualization, while it's a great learning experience, it's probably more trouble than it's worth. I greatly prefer appliances for network.

Yeah, I'm in the same boat, but I doubt its gonna save much electricity, and whenever I patch ESXi (or Proxmox) the entire internet connection is down.

I similarly am running openbsd as a home router under proxmox and it’s rock solid. I had more time on my hands when I set it up than I do now, but thankfully it’s without issue and just seems to always work so there isn’t really any maintenance other than point upgrades to openbsd when I remember.

What "pfSense CPU bug" are you talking about? Do you mean the Intel C2000 bug[0] that had nothing to do with pfSense and also affected dozens of other vendors, including Cisco among others?

[0] https://www.anandtech.com/show/11110/semi-critical-intel-ato...

> like the Ubiquiti Edgerouters of old.

Wasn’t EdgeOS a fork of Vyatta?

Yep.

Reply on news.ycombinator.com