45
Addressing Changes to pfSense Plus Home+Lab
(www.netgate.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 26 Oct 2023
45 points (94.1% liked)
Selfhosted
40359 readers
197 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 1 year ago
MODERATORS
And nothing of value was lost. Opnsense is still free and open source, and doesn't start petty drama insulting its competitors.
https://teklager.se/en/pfsense-vs-opnsense/
Update: I went and had a look and there's a Terraform provider for OPNSense under active development - it covers firewall rules, some unbound configuration options and Wireguard, which is definitely more than enough to get started.
I also found a guide on how to replicate pfBlocker's functionality on OPNSense that isn't terribly complicated.
So much of my original comment below is less-than-accurate.
OPNSense is for some, like me, not a viable alternative. pfBlockerNG in particular is the killer feature for me that has no equivalent on OPNSense. If it did I'd switch in a heartbeat.
If I have to go without pfBlockerNG, then I'd likely turn to something that had more "configuration as code" options like VyOS.
Still, it's nice to know that a fork of a fork of m0n0wall can keep the lights on, and do right by users.
I did end up setting up my new Protectli appliance today. As i said below, I ended up with OPNsense and I have been able to replicate 97% of pfBlockerNG's functionality on OPNsense. I've been able to load all of my previous DNS blocklists (including my own personal blocklists on Github), set up cron jobs (in the GUI) to update these lists every week and and whitelisted some sites too. The only thing that sucks is that regex isn't supported. Instead they do wildcard domains (
*.ampproject.org). Not nearly as good as regex but it's better than nothing.I also used pfBlockerNG for hardcoded ip address blocks (like Roku hard-coding 8.8.8.8). For that, I used the alias function in the firewall and just set up floating rules for that. Definitely not as convenient as a list, but they don't change very much. Also, for IP addresses for security, OPNsense has a whole IDS section that pfBlockerNG used to handle.
pfBlockerNG made everything clean and easy but I've been able to get 97% of the functionality in pfBlockerNG in OPNsense. The 3% deficit is lack of regex support.
Edit: I saw the article you were referring to. That's how I set up IP blocking. But Unbound in OPNSense supports blocklists (it's even called DNSBL) and that is much easier/quicker to set up than using aliases IMO. Just make sure you toggle on
Advanced Mode. That's how you quickly load the custom blocklist urls. Just remember to seperate the urls with a comma. I forgot the first time and nothing worked.