So I’ve been using OPNsense for a few years. I have an extensive config inclduing vlans, plugins, policies, suricata, VPN, routes, gateways, HAProxy, etc.
Over the past few months, I’ve noticed certain bugs, weirdness, and slowness within OPNsense. I recently watched Tom Lawrence’s video on the licensing changes and he touched on the openssl vulnerability that OPNsense has yet to remediate.
The Plus license cost (per year) which entitles you to some limited support options is also appealing. Every time I get stuck figuring out something complex in OPNsense, I have to hope someone else has tried to do the same thing and posted about it so I can troubleshoot.
I also don’t like having to constantly update. A more “stable”/enterprise focused cycle like pfSense has seems like my pace. It broke on me last year with one of the upgrades and I had to clean install.
Don’t get me wrong, I love the UI (mostly), plugins, etc. in OPNsense, but these past few months have got me thinking.
I’ve also heard that people don’t like Netgate as a company, so that could definitely factor into not switching.
What are everyone’s thoughts?
You must log in or register to comment.
I moved to VyOS from OPNSense, I like VyOS a bit better, because of Ansible integration etc + it’s Linux not FreeBSD
VyOS is very good. It’s a fork of Vyatta which was sold to brocade and sold again to ATT. Ubiquiti products use a fork of Vyatta as well (EdgeOS on their edge routers for example). I used to work with Vyatta and Brocade so I was a big fan of the Edge line for home and SMB. Since Ubiquiti shelved EdgeOS and stopped putting meaningful updates out I switched to VyOS rolling on my home router with one of those Beelink mini PCs with dual nics.
Is there anyway for us home labbers to get more recent versions of VyOS without having to build it? It used to be easily accessible, now, not so much.
Without paying you need to use the rolling / nightly iso.
They have step by step instructions in their documentation. They even give you the commands to run so you only have to copy and paste.
You literally git clone their repo, cd into the cloned directory, run a docker container and build the iso using the docker container. Took me 5-10 minutes using a single alder lake P core to make the .iso.
I’m using VyOS in my work environment now, got free licensing because we are a non profit. It’s been great.
I use pfsense CE. I am a bit worried that Netgate will be less interested in maintaining the community edition now, but it just works. I don’t need a lot of bells and whistles. So I’m staying put until I see a decent reason to switch.
IMO, no. I don’t use pfsense on a daily basis (MikroTik FTW), but netgate will use CE as a testing ground. They’ll keep putting out updates; but advanced functionality will be paywalled.
Do it. OPNSense is starting to not make sense anymore. I had the same conflicts as you. But PFSense has more support and features.
I use pfSense for the stability of it.
Netgate as a company has certainly done a few things which have had me looking at other router options but at the moment, pfSense CE works, is stable, and I don’t need to faff with it, so I’m happy staying put.
Used both, from pf to opn maybe 15months ago. Never had issues with either but I’ve had issues with how pf is managed and just seems to get another reason to dislike every so often.
Depends on your issues but go raise bug report with opn. If opn started to cause me issues then I’d be more likely to goto openwrt I think,rather than pf.
Yes
Edit: pfSense shill bots in the comments? Something is super sus here
Most of the comments are just shitting on OPNsense, without even given a valid reason why they don’t use it or they moved away from it.
Very sus indeed.
Opnsense does not work well with my set up. A lot of bugs and instability especially vpn and load balancing. I never had a problem with pfsense CE
I went from pfsense to opnsense about a year ago after an attempted settings change completely broke my pfsense install (again). I’ve been debating going back because I cannot get load balancing to work on opnsense, no matter what I do. Currently it’s just using a single gateway, and if that goes down then everyone is SOL until it comes back up or I manually switch it.
pfSense is what happens when you take OPNsense and put a chick in it and make her gay and lame. Always go with open source.
OPNSense is far more willing to add “experimental” features and as a result you get a firewall that has more features out of the box, but is less stable.
pfSense is very slow to add new functionality, but the platform is rock solid as a result.
It all comes down to what you want. Do you want to play around with an appliance that has all the knobs, but also some eccentricities, or do you want an appliance that may not have bleeding edge features, but is far less prone to error.
If you like support and stability then going for pf over opn is a choice you can make. I just don’t like how netgate has been shitting on the competitor with that ridiculous site.
I went from pf to openwrt. So far, so good. I’m sure it’s not as powerful as a pure firewall device, but it suits my needs.
If you have a home lab, offshore what you can from your firewall. The less it does the more secure it is. Once you’ve watered it down to maybe DHCP and suricata then there’s almost no difference in pfsense and opn.
I have an extensive config inclduing vlans, plugins, policies, suricata, VPN, routes, gateways, HAProxy, etc.
When you have an extensive config, you should always test the upgrade on a “lab” machine before applying them to your “production” environment. You don’t just apply the update blindly and hope nothing breaks.
If stability is what you’re after (both in terms of versioning and in the sense of as few unscheduled reboots as possible), then neither is a good option. Both update quite often and go with an “introduce feature now, worry about stability later” and end up having to constantly patch a bunch of stuff.
If you’re comfortable with a CLI, then I’d recommend Vyos and then going with the stable branch. It’s had 3 service patches since 1.3.0 released in 2021. The last being in june and before that, you have to go to september last year. Ofc, downside is that you’ll miss out on a lot of features. Like I don’t think stable has wireguard support yet, and not certain it will be ready for when 1.4 goes stable either (it’s currently in 1.4 rolling). You could implement some of it yourself because it’s built on Debian, but anything you do like that is tied to your current image. So if you upgrade, you have to do it again so I don’t recommend it.
Point is, if you need features, don’t, but if it’s the most stable you’re after, I can highly recommend at least having a look. Though I always recommend getting a proper router above any router os on amd64. You’ll get more out of it, cheaper, with less power consumption and lower latency.