I migrated to OPNsense during the wireguard fiasco. It was an extremely boring migration, and I mean that as compliment.

It's been quietly doing its job ever since, with a minimum of fuss.

I have thought about moving from pfsense to opnsense but in my test install I had a feeling it has fewer features (and messy UI).

For example something I use pretty heavily is pfblocker that automatically geo-blocks ips from different countries that most attack my homelab (Russia, USA, china ,etc..) from accessing my homelab

Is there something like this on opnsense?

OPNsense supports blocklists in Unbound: https://docs.opnsense.org/manual/unbound.html#blocklists

However what you're saying doesn't make any sense. All incoming connections, from anywhere, are blocked by default. That's true in both pfSense and OPNsense.

Are you saying that you allow all incoming connections, but then block specific countries? Because that's mad, and given the existence of VPNs, pointless.

No, there is a feature in Pfsense with Pf-Blocker-NG where you can open a port to a service as usual, say a web-server, then use an alias for the source address to only allow incoming connections from, say, your own country.

Useful for if you're roaming around and need access to that service from your laptop/mobile without a VPN, but also prevents attacks from countries you're unlikely to access it from.

I use it on OPNSense and it seems to work fine. There may be a Megamind (edit: MaxMind, not Megamind) account plugin setup out something to get it going, but if I worked it out, then you should be right.

I use it to flat out block all incoming and outgoing connections to a certain small group of countries. More out of curiosity than necessity.

It's also got a Crowdstrike interface for more dynamic blocking.

This is important for me too. From my searching, they have "GeoIP aliases" which is supposed to be their alternative to PfBlocker-NG; I have no idea if/how it functions as I haven't made the mode yet, but this is a deal breaker if it doesn't work the way I need.

It works as far as I can tell. I use it, and the logs show that it blocks connections to and from IP addresses associated with the selected countries.

Excellent, thanks for the confirmation.

Aliases can consist of one or more countries (tick boxes) pulled from MaxMind's GeoIP DB. Doesn't use ASN-based sources unfortunately. Can be used in source and destination networks, IPv4&/IPv6 , just like pfSense.

Got any tips for the migration? I've been meaning to do it for a while, but I really need to limit down time or my wife and kids will bury me; preferably need to do it over an evening while they're all asleep.

I only have the one piece of hardware so I need a record of the configs somehow to refer to as I do the migration. Perhaps also some sort of backup so I can restore it in a pinch if I can't get OPNSense set up quick enough.

When switching from pfsense to opnsense, I had to move everything to opnsense manually (and I do mean manually, not just updating terraform). It only took about 20 minutes to put things back on both members and have my tunnels up and going again, even counting my very specific customizations.

It was anti-climactic and worked so well as to be boring, which is the absolute highest compliment that a replacement and cutover can have.

Thanks for the info; I tried OPNSense originally but I had an issue with PPP on my old internet provider I never could get working so I switched to pfSense reluctantly and it just worked.

I doubt I have anywhere near the networking knowledge you have, so some of the more complex things I have set up; like my BGP routes for my Kubernetes clusters and my VLANs/trunks etc, that have taken a lot of tinkering might take me quite some time. I expect the way they're configured will be different, terminology might be different, and of course the UI will be different, so I can't just do it by reference.

I have no problem taking my time, so long as we have the basic networking we need for family and working from home.

With regard to bgp, vlans, subinterfaces etc.

Those things work the same way in opnsense. Most of my conversion was just data entry of the particulars.

I try to keep my main fws as simple as I can, for the benefit of the household, but I do get carried away with home automation and IaC/CM to my firewalls.

I'm afraid I did it the slow way, and just nuked the router and set up OPNSense from scratch.

In older versions it was possible to import a PfSense backup - with a few glitches, but they're too different now. I think the slow way is the only way.

That's kind of what I was expecting; but do you have any tips? Did you just do it from memory? I was thinking I'll screenshot the major config screens and interface layouts, my BGP configs etc, then work from them.

Yes, screenshot things.

But also export your config because you will inevitably forget to screenshot a thing or seven and you can poke around the config export for that port number or IP address.

Worst case scenario, you can spin up a VM of pfsense quickly and reimport the config if you have to.

I have off-box backups of my configs. Thanks for the VM idea; sometimes I forget to use VMs to do things "embedded" devices usually do for me; switches, routers, etc!

There's going to be a point soon where I have two fiber providers (and thus two WAN links) for a little while, I'll try move the existing pfSense off of my Protectli box to a VM, keep everything up for the family while I configure OPNSense on the Protectli, then if I do it right, I can move everything over with minimal reconfiguration.

I did as well and started running it in a vm. It is so nice to just make a snapshot, update and revert if it breaks.

Here we go again.... I've been resisting the change from pfSense to OPNsense for a while now but I start to really think I should just move on and get it done. All these f*ups with licensing and bs* from Netgate starts to be annoying. Just make a 50 or 100 license for home users who need / want to deploy a better router / firewall and get done with it! I moved from CE to this PeshPlus thing because supposedly CE was going to cease to exist... Now the PeshPlus is actually the one being discontinued! Wtf Negate!!! Get a grip.

I briefly used pfSense before replacing it with a plain Arch installation (any distro would do just as well - I just use Arch for everything else so it's an easy choice).

In a moderately complex home setup with wireguard to access my home network remotely, multiple VLANs/SSIDs (including one to firewall off IoT things and one that routes wan traffic to a vpn, again via wireguard), my own DNS server, a filtering web proxy for the kids, etc., I haven't encountered anything pfSense or similar would have made any easier for me. It's all achievable by editing relatively straightforward config files. The most complex bit is the firewall, but I have a terse, straightforward nftables config that does what I need and that I understand fully. I didn't really see the value in putting a layer of GUI stuff on top of it and then having to keep up with changes to that layer, and in the process obscuring what's actually going on.

Home+Lab was always there to placate those users bent out of shape when Plus started diverging from CE, apart from just support. Now they're just applying the next step to limit those pesky freeloaders.

Has Netgate provided any meaningful new features to pfsense over the last 5-10 years? Or is it just “support” for essentially what pfsense was a decade ago?

They added boot environments to pfSense+. I think they use ZFS snapshots. You can take a snapshot, set it as the default boot environment, do some updates, and if things go bad you can reboot to get back to the snapshot you set as the default.

I’d like to see some kind of more resilient upgrade process where a pre-upgrade snapshot is taken, the firewall updates and reboots, some kind of watchdog tries to hit a well known endpoint, and the whole thing automatically rolls back to the known good config if it goes X minutes without being able to connect after the update. That would mitigate the riskiest part of updating remotely.

As for new features, once you have a reliable firewall, what more do you want? I wouldn’t complain about a better traffic shaper experience, but OpnSense did that and the “easier” traffic shaper in OpnSense isn’t as flexible IIRC.

For licensing, I don’t hate the TAC-Lite approach. They could make it more clear it’s a lifetime thing (I hope I’m right about that) and I hate begging for installers, but at least they aren’t forcing subscriptions yet. I fear that’s coming one day since it would force us to switch to something else and pfSense is working ok for us ATM.

> Or is it just “support” for essentially what pfsense was a decade ago?

"Just"?

I'm sure all of use nerds and geeks on HN think commercial support is often not important, but there are plenty of SMEs that need to de-risk some things when running their infrastructure.

Yes, I didn’t say there wasn’t value in support.

“Is this contractor responsible for the whole house or just the garage?” does not imply the garage isn’t important or that it’s trivial.

every large org I've been at pretty much requires escalation contacts and vendor support. is one of the reasons we pay for RHEL and Docker licenses, etc.

I'm glad that my simple plastic OpenWrt router is sufficient right now, and I don't have to deal with changes/problems from Netgate, Ubiquiti, and other brands of fancier gear that once seemed appealing.

This seems like Netgate management is using Home+Lab as a scapegoat rather than acknowledging their own shortcomings.

I'd like to see Netgate and OPNsense both thrive. The competition is good for the product and users.

Massive influx of users to OPNsense

Sadly, pfSense lost me a long time ago.

I'm happily on my 2nd OPNsense business license on Deciso embedded Ryzen-based hardware with 10 GigE optical links. Even takes care of PKI and has 2FA. I'm happy and I don't have to worry about massive, arbitrary license changes or big corporate enshitification.

Just couldn't get IPv6 working with pfSense, as they had really limited support.

Moved to OpenWRT a few years ago and been quite happy since.

The Deciso hardware is really nice! I also have a couple. Expensive but worth it.

"Home+Lab has been installed thousands of times in 2023 alone."

This seems to indicate that nearly nobody was using it, even counting the illicit activities of the multiple appliance vendors.

If I have a modest lab automation with solid bracketing of fw release versions on some network scenarios, I could easily account for thousands of on-install telemetry entries per week.

I can imagine Hetzner alone would account for thousands upon thousands of installs.

Just based on their phrasing, I doubt there will be a massive influx to opnSense.

I just installed my first last weekend.

I'm pretty happy with the experience and the end result.

Happy user of opnsense for two years. Using a box from Protectli, no issues.

Well, I was still using pfSense over opnSense due to a bit more polish and having proper Tailscale integration.

As soon as Tailscale has proper integration on opnSense, I'm definitively moving on. The CE version of pfSense has very outdated packages and that probably has an impact on security, which, for a Firewall, is a big no.

BTW: Does anyone know why Tailscale doesn't provide a proper package (with graphical interface) for opnSense, like it does for pfSense? I was under the impression that it would need very few changes for it to work.

it's just 6 lines in the shell, I set it up yesterday

  opnsense-code ports
  cd /usr/ports/security/tailscale
  make install
  service tailscaled enable
  service tailscaled start
  tailscale up

source: https://www.wundertech.net/how-to-set-up-tailscale-on-opnsen...

Thank you for the told you so, Netgate. And they knew they were going to do this the very moment they conceived of the idea of Plus but sure, if you must accompany this with a multiparagraph BS ridden sob story, go ahead. Expect nothing less from you lot.

I've been using pfSense on 4 private sites for years by now. Luckily I've not upgraded from CE. I think what pisses people off is the rugpull of them pushing people to get a free upgraded license and then removing it soon after.

As for "but its free". I think its reasonable to expect the free offering to be promotional. I know I have bough Netgate HW and license for work because I was familiar with their free offering at home. But stuff like the recent move might make me reconsider.

I mean, after what they did to OPNSense with the domain plus defamation, I don't know why would you trust a company with such behavior.

I am really happy with IPFire on my home network. It doesn't have all the advanced features that PF/OPNSense have, but it's suitable for my needs.

I use a Linux box with at least two fast NICs - why not try it out?

The setup can be rough if one isn't that familiar/has high requirements... but making a router and so on is pretty basic stuff.

Basic in the sense that it's easy to do both well and terrifyingly incorrectly.

I'm curious about home users who truly need an interface because they're in there fiddling so much

I use Ansible to manage the config of mine, but that's more for rebuilding. I look at the thing maybe twice a year

I tried pfSense recently but I didn't love configuring my network through the UI. An API or something would make it amazing. But maybe that's the DevOps in me talking. I've been mostly happy with VyOS since then.

OPNsense is working towards that vision. They're rebuilding the car while it's driving down the road, so while some things aren't supported, many things can be done through the REST API. See https://docs.opnsense.org/development/architecture.html and https://docs.opnsense.org/development/api.html

What did Home+Lab have that CE didn't? I've been using CE for years now and it seems like it's got all the enterprise bells and whistles except support...

I believe the only feature is “boot environments” at the moment. In fact they've diverged so little that, according to various sources online, one should be able to take a working 23.05.1 config (read: pfSense plus) and install it on 2.7CE without issue.

In the Netgate world, it now seems that the CE edition is the most stable, inheriting changes/fixes after they've settled into the plus channel.

My pf.conf files tend to be like 30-50 lines and easy to change so I never understood the allure of having a front end for it.

Informative and unfortunate. The only reason I upgraded from CE to plus home was because of boot envs.

What kind of hardware do you run it on?