I migrated to OPNsense during the wireguard fiasco. It was an extremely boring migration, and I mean that as compliment.
It's been quietly doing its job ever since, with a minimum of fuss.
It's been quietly doing its job ever since, with a minimum of fuss.
For example something I use pretty heavily is pfblocker that automatically geo-blocks ips from different countries that most attack my homelab (Russia, USA, china ,etc..) from accessing my homelab
Is there something like this on opnsense?
However what you're saying doesn't make any sense. All incoming connections, from anywhere, are blocked by default. That's true in both pfSense and OPNsense.
Are you saying that you allow all incoming connections, but then block specific countries? Because that's mad, and given the existence of VPNs, pointless.
Useful for if you're roaming around and need access to that service from your laptop/mobile without a VPN, but also prevents attacks from countries you're unlikely to access it from.
I use it to flat out block all incoming and outgoing connections to a certain small group of countries. More out of curiosity than necessity.
It's also got a Crowdstrike interface for more dynamic blocking.
I only have the one piece of hardware so I need a record of the configs somehow to refer to as I do the migration. Perhaps also some sort of backup so I can restore it in a pinch if I can't get OPNSense set up quick enough.
In older versions it was possible to import a PfSense backup - with a few glitches, but they're too different now. I think the slow way is the only way.
But also export your config because you will inevitably forget to screenshot a thing or seven and you can poke around the config export for that port number or IP address.
Worst case scenario, you can spin up a VM of pfsense quickly and reimport the config if you have to.
There's going to be a point soon where I have two fiber providers (and thus two WAN links) for a little while, I'll try move the existing pfSense off of my Protectli box to a VM, keep everything up for the family while I configure OPNSense on the Protectli, then if I do it right, I can move everything over with minimal reconfiguration.
It was anti-climactic and worked so well as to be boring, which is the absolute highest compliment that a replacement and cutover can have.
I doubt I have anywhere near the networking knowledge you have, so some of the more complex things I have set up; like my BGP routes for my Kubernetes clusters and my VLANs/trunks etc, that have taken a lot of tinkering might take me quite some time. I expect the way they're configured will be different, terminology might be different, and of course the UI will be different, so I can't just do it by reference.
I have no problem taking my time, so long as we have the basic networking we need for family and working from home.
Those things work the same way in opnsense. Most of my conversion was just data entry of the particulars.
I try to keep my main fws as simple as I can, for the benefit of the household, but I do get carried away with home automation and IaC/CM to my firewalls.