I say goodbye to pfSense, welcome opnSense - Page 1
Forum section: electronics / general

author: Zucca
author_rank: Unknown
timestamp: September 09, 2024, 01:32:08 pm
content: Long pfSense user here.My CE pfSense box was always reporting 2.7.0 as the current and last version. After more than one year with the same message (no need to update) I did some digging.So the current version is 2.7.2 and there is a way to let pfSense detect there is a new version.Only problem is that the update failed for a wired EFI BIOS no space error.Then I read this.So next week I will try to ditch pfSense out of the window and move to opnSense.comments and suggestions are welcome

author: woody
author_rank: Frequent Contributor
timestamp: September 09, 2024, 02:50:29 pm
content: I use pfSense for more than a decade, in my own environment and at a couple of clients.I like pfSense a lot. In comparison with IPCop that preceded it for me, it is another world in which I never found anything I could not do with it, networkwise. It is stable, fast, versatile and, at least AFAICS, secure. The one reason for me to search for an alternative would be when Netgate decide to ditch the community version in favor of a subscription based model. Which in this world of SAAS and subscription-based business models inevitably will happen. I sincerely hope that will be after I retire

author: Zucca
author_rank: Unknown
timestamp: September 09, 2024, 02:57:22 pm
content: https://www.zenarmor.com/docs/network-security-tutorials/why-migrate-from-pfsense-to-opnsense

author: ejeffrey
author_rank: Super Contributor
timestamp: September 10, 2024, 02:24:04 am
content: I've been using OPNSense for a couple years now. My use case is fairly straightforward, although I do use VLANs for a guest network and untrusted devices. It's done everything I needed to and mostly I just forget about it.

author: Halcyon
author_rank: Unknown
timestamp: September 10, 2024, 07:28:17 am
content: Both pfSense and OPNSense are good choices.pfSense is more aimed at the commercial/enterprise market however, so you won't get the bleeding edge features (unless you add them on yourself).I use the former at home and also manage it in an enterprise environment.

author: Zucca
author_rank: Unknown
timestamp: September 10, 2024, 01:19:01 pm
content: Quote from: Halcyon on September 10, 2024, 07:28:17 amDo you use pfSense+ in the enterprise environment?

author: Halcyon
author_rank: Unknown
timestamp: September 10, 2024, 10:30:03 pm
content: Quote from: Zucca on September 10, 2024, 01:19:01 pmYep. Comes with the Netgate appliances. I also have pfSense+ at home.There isn't a huge difference between that and the free version.

author: Zucca
author_rank: Unknown
timestamp: September 11, 2024, 01:53:09 pm
content: interesting the more I dig into it, the more is like talking about religions online. Very polarizing topic.pfsense+ is much better than pfSense CE in the sense Netgate is relying on it for $ income.So it is polished and loved like a sweet baby in mother's arm... CE is not a Netgate priority, I read, so you get a class B product compared to pfSense+.The above is what Google/Youtube says, no idea about how much is true.Also in pfSense the lack of API, and the less driver compatibility is disturbing to me.

author: bson
author_rank: Unknown
timestamp: September 16, 2024, 12:09:15 am
content: Quote from: Zucca on September 09, 2024, 02:57:22 pmBrought to you by Zenarmor, with a competing product to sell...

author: Zucca
author_rank: Unknown
timestamp: September 16, 2024, 01:35:12 pm
content: Quote from: bson on September 16, 2024, 12:09:15 amExactely... so take everything with a pinch of salt...Anyway I am facing other problems with opnSense currently:https://forum.opnsense.org/index.php?topic=42828.0

author: PlainName
author_rank: Super Contributor
timestamp: October 05, 2024, 09:35:45 pm
content: Quote from: Zucca on September 09, 2024, 02:57:22 pmHave to say I am not impressed with that site. As a typical example of the issue, consider the steps to move from pfSense to OPNsense:QuoteCool, there is a link to migrating your settings, and that plus the offhand way they tell it suggests there might be a util to do the conversion, if not a trick or hack to just import a pfSense config. And, indeed following the link produces:QuoteIt's bollocks. They take a full page to walk you through firing up the web configurator and then manually entering whatever rules you might have set.Next, they go on about how Zenarmor NGFW is a great replacement for pfBlockerNG. So far as I can tell, NGFWjust uses DNS to prevent outbout connections, whereas pfBlockerNG works on incoming IP addresses to actually block undesired stuff. I am sure I must have missed something because they don't seem at all equivalent to me, so maybe someone who knows could point it out.I've thought about migrating several times, but this kind of thing seems to be par for the OPNsense community - noting how much better it is by glossing over details - and each time I've stuck with pfSense. Hey, I loath Microsoft but still run Windows because it's the better thing for what I do. Netgate may be shits, but I'm not their friend and judge the product on what it does.

author: Zucca
author_rank: Unknown
timestamp: October 07, 2024, 06:40:25 pm
content: Just to inform that I decided to stay on pfSense.Once pfSense becomes a $$ subscription I will jump off the boat.

author: PlainName
author_rank: Super Contributor
timestamp: October 07, 2024, 09:30:26 pm
content: Why upgrade to that version? Unless there are security cockups (and it seems to be pretty robust in that regard) all you get are new toys you managed to do without so far.

author: David Hess
author_rank: Super Contributor
timestamp: October 07, 2024, 10:52:31 pm
content: I have been using OPNSense since about 2020 when I purchased a PC Enginesapu4d4. Before that I used PFSense on Pentium II desktop hardware for 10+ years, and before that m0n0wall for 10+ years.I only changed hardware because PFSense dropped support for 32-bit hardware, and since I had to reinstall, I figured I might as well make the change to OPNSense which has better VPN support anyway.

author: PlainName
author_rank: Super Contributor
timestamp: October 07, 2024, 11:23:33 pm
content: I decided not to do VPN on the firewall and simply pipe the ports through to SoftEther running in a VM. Similarly stuff like DNS and DHCP are offloaded to one-function apps that do the job well. But I realise that if you don't want to go that route then having it all work nicely in a single box is cool.

author: Zucca
author_rank: Unknown
timestamp: October 08, 2024, 01:48:55 am
content: Quote from: PlainName on October 07, 2024, 09:30:26 pmThe API is a sexy thing to have

author: PlainName
author_rank: Super Contributor
timestamp: October 08, 2024, 09:45:36 am
content: Usually, sexy things need a condom

author: David Hess
author_rank: Super Contributor
timestamp: October 08, 2024, 12:23:38 pm
content: Quote from: PlainName on October 07, 2024, 11:23:33 pmI am still trying to get OpenVPN, and now Wireguard, working on my OPNSense router so that I can direct traffic from specific sources on my network to specific VPN endpoints, with the router acting as the endpoint.

author: PlainName
author_rank: Super Contributor
timestamp: October 08, 2024, 12:55:26 pm
content: Is that trying as in not succeeding? VPN can be a right pain when it decides not to work...

author: Zucca
author_rank: Unknown
timestamp: October 08, 2024, 01:09:53 pm
content: Quote from: PlainName on October 08, 2024, 09:45:36 amThe API is a good thing to have, happy now?

author: PlainName
author_rank: Super Contributor
timestamp: October 08, 2024, 02:02:51 pm
content: Sure, I'm not trying to put you off or steer you one way or another. It was a throw away tongue in cheek comment.

author: David Hess
author_rank: Super Contributor
timestamp: October 08, 2024, 05:39:43 pm
content: Quote from: PlainName on October 08, 2024, 12:55:26 pmSo far it has not worked at all, but it is difficult to diagnose what is going on because it pretty much either works or it does not. Periodically I mess with it and try to get some kind of result.After some problems, I recently made the change from using OpenVPN on each machine to connect to my VPN provider to using WireGuard. This went so well that I will be revisiting using my OPNSense router as a VPN endpoint.