I use pfSense. I do not use the IPS features mostly because of the reasons you present. However pfSense is also a very capable router, which is why I use it.

Are there other ways to solve this problem? Of course, most problems in tech have a large number of solutions, each with their own trade offs. If I were to set my network up again, I would probably go with an edgerouter pro or similar - but since I already had a low power server I could repurpose as the router, it was $0 vs $400.

That makes sense. If that's why most people use these things --- to repurpose old hardware in their basement rather than ordering a new router --- then pfSense makes some sense to me.

Doesn't have to be just re-purposing old hardware for it to make sense IMHO.

I started using pfSense on old hardware to get rid of Verizon's router, however I plan to replace it with a brand new box that will likely be $250-500.

I have gigabit FiOS coming into the ONT outside, and from there I get an Ethernet port that comes straight to the pfSense box. No Verizon router present at all.

Besides pfSense, what other open source options do I have to run a firewall that can handle gigabit ethernet with VPN? DD-WRT? Tomato?

Sure, I can setup a Debian box with iptables in my sleep, but pfSense is much nicer.

I’m in a similar boat (ATT fiber) and really curious as well. I’ve considers pfsense with dual gigabit nic but honestly I’d rather have a dedicated box that can handle the routing and firewall features.

OpenWRT is standard for routers, you can even run it on x86 just fine, and unlike PFSense it won't shit a brick and sit in a broken state at console just because a secondary ethernet interface disappears.

PFSense really is targeted at the prosumer market. If your happy to haul a screen out on every upgrade or minor hardware change, PFSense is fine. Otherwise, going Openwrt is a solid choice as you can actually debug it remotely.

Nice, first post and all I get is downvotes. Screw this place!

I once tried out pfSense, about 8 years ago. I was looking for a VPN solution for a small startup. I had used pf on OpenBSD, and really liked it as a firewall, so having "pf" in the name made pfSense sound good to me. My hope was that pfSense would provide an easy out of the box VPN setup, without me having to configure a RADUIS server to talk to LDAP, and have easy user provisioning.

What I found was a mess of PHP and poor quality plugins. The init scripts were written in PHP, and the plugins modified the init scripts. So plugins could, and did, break the init process, preventing the firewall rules from loading.

I don't think people are using pfSense in production environments, I see this class of solution being used by IT at small companies. Think about big corporate networks, where you might have a device from Palo Alto Networks, or a Cisco ASA for a remote access VPN. Then imagine you are at a 20 person company, a decade ago before SaaS really took off, and you think you need a VPN, but can't afford something from a big company, and don't want to glue together a bunch of open source tools. I think that is when people reach for pfSense.

I don't think it makes much sense these days. Small companies can use much dumber (and better) gateway devices. With SaaS and things like Google IAP and Cloudflare Access there is little need for VPNs. As for IPS, I have trouble imagining IPS being needed or even working at a small company. Big companies can have sophisticated detection systems and teams to deal with them. Hopefully big companies were never using pfSense.

>What I found was a mess of PHP and poor quality plugins. The init scripts were written in PHP, and the plugins modified the init scripts. So plugins could, and did, break the init process, preventing the firewall rules from loading.

Really, really, not my experience and I've been using it for 7~ years.

>I don't think people are using pfSense in production environments

I was running 1% of all internet traffic through dual pair of pfSense firewalls running on some HP 2U servers during Christmas 2011.. (interface was slow as shit with that load though to be honest).

I wouldn't discount it's power. Mostly when you buy something like a Juniper SRX it's similar underneath. It's not like there are common ASICs for firewalls.

You need to use pfSense now.

Its come a long way since you did.

People are using pfSense in production too.

(though I have my quibbles with NetGate, who owns pfSense).

> Suricata on a dedicated firewall box with a PHP interface? What problem is this solving?

The same as every other feature bullet - checking off a box so the product doesn't get "out-checked". Only this time it involves tinkerers, who might set the thing up because it sounds cool, before really asking why. Presumably the package was already in some repo, and it tickled someone's fancy to do the little bit of integration work. But that doesn't mean these types of packages are driving the adoption of pfSense. That said, I don't really need MRTG graphs but if I can get them by clicking a few boxes, I just might.

As other people have said, the main driver is (NAT) routers. Soon in need of a faster router, I'm personally considering trying out the pfSense route rather than straightforward (for me) Debian+iptables. Both for a bit of kernel diversity, and sometimes it's nice to just click away.

> Especially since I'd have to park it behind my ISP's prem box, which is the thing that is actually going to get owned up on my home network.

Your ISP's equipment is not part of your home network - you're better off viewing its ethernet port as the service demarc. In fact, given the straightforward business interest in say enumerating the devices on your home network, I'd characterize it as a persistent attacker. Protocol wise, there's little drawback to just lumping it with the ISP's overtly-hostile DPI gear. About the only trust I'm willing to grant that thing is that it's unable to draw untoward amounts of power say mining crypto coins, and if it's already fed by fibre that it won't create its own electrical surges.

If you read this site you are probably well above the target audience in terms of skill. By numbers, I'd guess small/mid size business IT personnel dwarf the higher end multi-tier {dev,eng,ops,sre,sec} of tech companies. And these IT folks generally need a push-button appliance experience due to education/skills. Think Microsoft products, and control panels and wizards on Linux like cPanel.

If you go walk the floor of a commercial data center, you will see tons of sonicwall, Ubiquiti, etc. Basically these are an open source version of those.

Now a subset of these projects might have some serious implementation smells, but I wouldn't really pass judgement on the users of any of those things. Just about any business can benefit from technology, not everything is well suited for services/hosted approaches, and there is clearly a need for simplified IT equipment.

Sure, I get that, but my point isn't that I would do what pfSense/OPNSense does in a better, more elegant way; it's that I wouldn't do them at all. Isn't that even easier than installing one of these thingies?

Say you have a single static IP at a small office and need to set up a network of systems behind a NAT with DHCP, and maybe a few PAT forwarding rules to a server. It would basically take the time to burn a USB stick and boot it, and 30 minutes of following the UI prompts for even low skilled folks. What would you recommend said folks do instead?

Isn't that a problem almost every wifi router that costs more than $150 already solves? I might just not be understanding your requirements. Also: you just described a problem that requires something like 2% of all the crud OPNSense brags about running.

I’ve been using pfSense for about 5 years. The past 10+ years I’ve been on either 1x1Gbps or 2x1Gbps symmetric up/down links via fiber (no isp boxes), no consumer/semipro router in the $150-400 range have been able to keep up with these links (tried a few at different times) and especially not handling IPSec-tunneling at these speeds. So I use my old Nehalem/supermicron server (8c/24GB ram, multiple intel pro nics). Used to run FreeBSD+pf then NetBSD+npf manually configured but around 2013 my hard drive broke in a move so I just threw pfSense onto an old disk I had laying around as a temporary solution to get up and running quickly, at that point I never had time/got around to actually set up npf again so I just keep running pfSense and still am.

This server costed me about $100 since I salvaged most parts from a broken server I bought of some company back in 08, been running really solid and tried to replace it with highend prosumer routers a few times when I were upgrading my Wi-Fi but they never kept up, I’m now using UniFi Ac PRO for Wi-Fi since my last tplink router/ap broke.

> every wifi router that costs more than $150

Price does not matter. Botnets are created on consumer grade routers, of any price range. Asus, Netgear and the like. None of them are x86 based, and most run outdated busybox linux on low power SoC chips.

Botnets are created on internet of things and printers, rarely on routers. A small business trying to setup and administer a Unix server as a router is more likely to go wrong than buying a dedicated appliance.

Uhhhh... https://arstechnica.com/information-technology/2018/06/vpnfi...

My point is I don't trust consumer grade stuff.

> Unix server as a router is more likely to go wrong

That is exactly why you install pfSense/OPNsense.

I’ve actually trivially rooted my mothers Asus two times when she had network problems and I had to find a way of debugging it remotely. One time I could inject an RCE via some kind of network connection testing tool they had which were supposed to take an uri but happily accepted something like "google.com$(whoami; nc...&)"

I don't know why people use it either.

I looked pretty seriously at using it when I was considering building a outgoing firewall product, when people could share blocklists for IoT devices and things like SmartTVs.

It's pretty well suited for building things like that on top of.

Maybe people are building things like site blockers for schools on top of it?

Maybe it's just a hobbyist/prosumer play?

> I don't know why people use it either.

I'm shocked this is a common statement on this.

Because its great. Its a fast firewall and router. Its perfect for not overpaying for something like a Cisco ASA.

But in what circumstances? How big is your business?

If you are running a SME office, then there are plenty of decent firewall appliances which are much cheaper than Cisco ASA, and have much lower support overhead than Sense.

If people are doing it for fun or as a hobby great. But given that you can get perfectly good appliances at $500/$1000/$2000 pricepoints, where is th price tradeoff where is makes sense to use Sense?

The thread is too deep to reply direct, but you appear to be more or less agreeing. There are low powered x86 systems at that price point. pfSense has offered a software upgrade path for over a decade, and takes security advisories seriously, so how many store bought routers can boast anything close to that? pfSense also scales up to 10gbit forwarding performance. I can't really comment on the cruft, AFAIK you don't need to run an IDS and that is all in packages.

One case where I would use pfsense. Let's say you are a system admin of an small private school, you get an alert email from Comcast saying that copyrighted content was downloaded using torrents. You deploy pfsense and with 30 clicks you have snort configured and set to block torrent connections.

Can you please comment why installing IPS in a production environment in 2018 is silly? (genuinly want to know)

Also, when or where would you recommend installing an IPS product? As part of a corporate firewall?

I would more or less never recommend installing an IPS. In the past dozen or so years I've spent lots of time (months at a time) working on the networks of F500s that have fleets of IPS systems, alongside their security teams, and I have never once seen an IPS do anything but generate alerts that get bucketed in a SEM and forgotten about.

I completely agree but think this shows a failing of "blue team" culture and education. I now started work in a massive project with half a dozen companies sharing massive AWS VPCs. They have limited security team oversight and coordination. Wouldn't it be nice of they had sufficient levels of access to Snort Suricata data and could learn what normal operations looks like and educate themselves to look for poorly documented systems that are not hooked up to SIEM or even the APM correctly or are failing to talk to different EC2 instances correctly and help? Inventory and ops is sexy and not security but why countless times I see younger SOC kids know absolutely nothing about what their environment looks like. That data would not help them even if they are allowed out if the kiddie sandbox and only allowed to read baked queries and alerts.

The reason this stuff is useless is bc I have never met someone with sufficient experience to act on it for any context, bc people think the tools magically bring educated talented people.

I've used pfSense several times to have a (semi-)pro grade router/firewall at an entry level price. For me it strikes a nice balance between power and ease of configuration. Even though personally I don't care too much about most advanced features, I like how there are no arbitrary limitations, and it's good to know that the underlying technology is solid and inspectable/tweakable if needed. And yes, I do buy new hardware for it without hesitation; the PC Engines APU is very well-suited. This way $200 can get you a better solution than $600–$800 off-the-shelf.

Maybe we're doing it wrong, but we use IPS for the same reasons that we use signature-based antivirus---as a backstop. Ideally, they wouldn't do anything, but we live and work in a less-than-ideal world with imperfect information security policies (and configurations), mobile users and visitors and students, and IT staff who aren't all infosec pros like you. And in that less-than-ideal world, both intrusion prevention systems and antivirus software mitigate enough risk to make their procurement, deployment, management, monitoring, and maintenance worth my while.

Here[0] is a series of videos showing what a small IT company does with pfsense.

[0]: https://www.youtube.com/user/TheTecknowledge/search?query=pf...

Huge number of answers, but I'll give mine. At work I would use a Ubiquity or untangle or Mikrotik or something, but for home use yeah, for less than the cost of one of those that will do gigabit you can get an old server (small), put PfSense on it, and have something far more flexible than an Asus or Netgear. For instance:. Try setting port 80 only coming IN from certain IP with one of those? Not even sure you can do that on a Ubiquity. Try to find something that can do that AND do UPNP so you kid can play Black Ops 3...

PFSense does provide a free GUI interface to OpenPVN. That's useful in many small business applications. Also, don't discount that you can't buy one at BestBuy, that lends (for non-technical peeps) a veneer of credibility.

> What are people doing with these things?

With Suricata, or with pfSense?

Suricata is used when you want to block internal clients that do something suspicious (like join a botnet), or to notice something unwanted (like using a banned application, such as dropbox).

> but Suricata on a dedicated firewall box with a PHP interface? What problem is this solving?

Ease of use with out overpaying for the same feature seat. I'm surprised you think there isn't a problem its solving, to be honest.

> What are people doing with these things?

home routers ?

PfSense is very popular in the SMB market where there is little to no IT staff or budget but requirements beyond what can be satisfied with a home router.

PfSense is also popular as a firewall appliance in cloud deployments. Demand for running pfSense was one of the drivers for Microsoft to add FreeBSD support to Azure.

If you need a GUI, just use something like Halon's SecurityRouter.

Is it free to use? Is it open source?

Depends / it's source available AFAIK.

Some time ago I looked at this sort of thing (simple management + status GUI for a router), and pfsense & friends are just huge, bloated pieces of mess that I really don't want on critical infra. Securityrouter OTOH came across as one of the very few frontends actually designed for security (see their docs). (Also it doesn't include a the full B/S suite)

In the end I didn't choose any GUI and just put a Debian on a box. I don't really know any of the BSDs and it certainly wasn't worth more of my time to fool around with a small piece of infra that's going to be ignored >99.99 % of the time.

> it's source available AFAIK

AFAIK it is not.

Halon pivoted away from this market. Last I looked it was a secure email play.

Wasn't SR always a side project for them? Still gets releases, though.

Why do I want my home router to be really good at detecting Windows Server attacks from 2013? Especially since I'd have to park it behind my ISP's prem box, which is the thing that is actually going to get owned up on my home network.

Not sure what is your problem, honestly. Custom home router on small form factor machine to replace buggy Netgears. Just put your ISP's box in Bridge mode.

That didn't address either of my questions/concerns.

For someone claiming to be an expert, you appear to be completely ignorant about the products you're judging.

What does "detecting a windows server attack from 2013" have to do with ANYTHING? The primary purpose of the OPNSense and PFSense projects is to be a better home router replacement. Now PFSense has "moved up" if you will into the SMB space, and has further ambitions in the routing space, but the basics still come down to that goal.

Suricata and Snort aren't even installed by default, much less required. So why do you keep harping on that functionality? It's irrelevant. These are ROUTERS that can be extended to do IPS if you so choose, but is in no way required.

Is the page we're commenting on just a really bad description of the project? Because it does not say that OPNSense is simply a ROUTER, and besides "we switched to the fastest PHP framework"† the IPS capabilities are basically the only technical comparison the article makes.

OPNSense describes itself as a firewall. A firewall is generally something you deploy along with a router. Does the term "firewall" just mean something else among the community of people repurposing old Dell towers to build complicated home networks?

† smdh

Blame the industry? Every home router you can by today is a "firewalL" by their definition, because it does NAT and blocks all inbound traffic by default. I think it's silly to debate whether or not that's a fair description, but they're using the terminology their target market is used to hearing.

Some vendors have moved towards calling their SPI functionality the "firewall" portion, but that debate is about a decade too late.

I want to monitor and/or optionally block outgoing traffic. How do I do that with my airport extreme? which router should I get. One network administrator type friend recommended pfsense on a netgate device. is that bad advice?

I don't think so at all (not bad advice that is). I run PFSense and am happy with it. Things like QoS tend to be difficult to get working right, but just straight blocking isn't a big deal.

I'm not sure you need to do the netgate device unless you want support, you can use literally any x86-64 box you have lying around. Another good option if you're looking for an "all encompassing" solution would be ubiquiti. If you went that route you'd likely want to dump the airport extreme though and just go all-in on ubiquiti.

It's a page to describe what they do differently than PfSense, and that happens to be a) the web frontend and b) the choice of IDS/IPS. There is little reason to describe the "boring" standard stuff that's routing, firewalling, VPN server role that's the core of both projects. Have a look at the comparison table at the bottom for a better idea of the feature sets.

> A firewall is generally something you deploy along with a router. Does the term "firewall" just mean something else among the community of people repurposing old Dell towers to build complicated home networks?

That's an unfair characterization IMHO. In the commercial market, there are tons of "firewall appliances" that are used as router/firewall combinations: Sophos UTM, Watchguard boxes, Fortigate, ...

pfSense and OPNsense play in roughly the same space: a box you plug your WAN interface in that will do (primarily static) routing, firewalling with multiple zones, act as a VPN server. And typically have some amount of security checkboxes a la IDS, WAF, ..., although the commercial ones with the opertunity to sell subscriptions emphasize this more.

I'm no fan of php, but you realize the home routers you recommended earlier typically have CGI UIs written in _C_ by people that don't really understand strings and pointers?

Why does the linked article prominently feature suricata if it's irrelevant?

Also, the word ROUTER doesn't even appear on the linked page.

Because it is talking about what they do differently from PfSense, and thus are not covering the basic router/firewall/VPN server functionality both have had forever. The table at the bottom gives a bit better impression of what they are about.