Hacker News Reader

Comment by WarOnPrivacy | Hacker News Reader

I've been waiting for pfSense+Wireguard for a while. OpenVPN has been very good to me but I'm psyched to trade up.

The opnsense fork has supported wireguard for a while, and has far less restrictive licensing. I highly recommend having a look.

OPNsense is criminally underrated. My main routers for my office are virtualized OPNsense VM's in high availability with CARP, DHCP, DNS, VPN endpoints, inter-vlan routing, gateway policies, outbound nat... I could go on. It all works extremely well I can't fathom why people still choose pfSense with all of the community shenanigans and closed source versions.

My only gripe with it over 3 years has been the documentation on their API's for programatically updating firewall rules/aliases could use some more examples, or just mention "use browser's network requests developer mode to see what calls you need to make".

I did LOTS of research on what firewall/router distro to install to my new router a few months ago. See my comment history for considering different options.

I have to say choosing OPNsense has been a great choice. All the things you said I can agree on, but I have to add one more thing:

That quick search bar on the top-right corner where you can quickly type where you want to go. That thing is just super nice when jumping through places in the router.

Now if I'd need to build a new router, I'd like to try my luck with NixOS. Would be great if I could just build a new router from a reproducible configuration.

Same here but I've concluded that there is nothing better than a simple install of pure OpenBSD or FreeBSD and setting the rules on /etc/pf.conf. Its safer, faster, lighter and I could argue that is also easier to admin with just SSH and no web code in between.

For example, in the latest version of OpenBSD which has a Wireguard kernel implementation, the management tool has been basically included in the ifconfig command.

  ifconfig wg0 create wgport 5180 wgkey ...

And then you are set. For persistence you create a /etc/hostname.wg0 file containing the commands to bring the interface up.

I run openbsd virtualized on proxmox and it’s fantastic and not that difficult to set up (I’m a casual tinkerer at best). I’ve got a gigabit connection and can saturate that without any significant stress on the single core that it runs on.

Agree. I run openbsd, its simple.

> OPNsense is criminally underrated.

When I came into FW distros, my practical choices were MonoWall, SmoothWall and pfSense. IPfire wasn't even on the scene yet. pfSense won me early. I figure there are a lot of similar stories of pfSense being there for us when not much else was.

Only if BBCan177 jumps ship. He's my hero.

Assuming you're referring to pfblockerng, you can have DNS blocking and IP blocking in OPNsense without the need for any plugins.

pfSense has the only friendly admin GUI for OpenVPN that I know of, besides the proprietary Access Server. Will they do the same for Wireguard?

Wireguard is already in the latest version (2.5). UI is ok but you need to understand how wireguard works what the fields mean.

Reply on news.ycombinator.com