Goodbye PFsense, Hello Opnsense
Goodbye PFsense, Hello Opnsense
After having issues with my Netgate 4100 (see this post) and knowing all the crap Netgate has pulled the last few years, I decided to build a new Firewall capable of 10 gig routing. Hopefully this fixes my issues. If not at least I no longer have to support PFsense.
Pictures:
Hardware:
X11SSH-F Motherboard
Xeon E3-1240 v5 CPU
32GB 2400mghz RAM
ZFS Mirrored 128gb SSDs
350W Gold Rated PSU
Connect X3 Dual SFP+ NIC
Should have it production ready by next week. Really not looking forward to reconfiguring all the HAProxy/ VPN stuff, but so far already found quite a few Aliases/Rules I can cleanup.
Thanks for stopping by!
Once you start, you'll find the conversion and resetup goes by quickly. I migrated to a dedicated supermicro box as well, in hopes that PFSense could do 10gig without issues. I eventually moved my 6+ year old PFSense build from a VM over to the dedicated box..... and was disappointed. Then PFSense pulled their stunt and I finally just said F-this and rebuilt it.
1 hour - it took me 1 hour to wipe PFSense, figure out the new menus of OPNSense and get everything back online. What I had dragged my feet on for so long, turned out to be a big nothing burger. Zero issues, 10gig speedtests just fine, zero trouble with the NIC and great performance overall.
I'll leave with this - fuck PFSense, what they pulled was rediculous and an insult to homelabs and folks who like to bring production tech into their homes. They turned a great product, one I've implimented into many commercial setups, into a joke - who could ever trust them again?! I'll never recommend them and I won't be looking back.
2What Supermicro box did you go with?
I have a recently acquired a SYS-5019A-FTN4 for pretty cheap as a primary network box: running things such as NUT, DNS, Wireguard, TailScale, Zabbix, Wol, etc., and It’s done great, but for some reason has an issue with the 6.2+ kernels. So I’m thinking of replacing it before I run into maintenance issues over time, and maybe use it as a new opnsense server.
Would this be able to handle 10G+, or would something else be better?
Specs:
https://www.supermicro.com/products/system/1U/5019/SYS-5019A-FTN4.cfm
Motherboard: https://www.supermicro.com/en/products/motherboard/A2SDi-8C-HLN4F
Cpu (embedded):
Added:
128 GB RAM - SK Hynix 64GB 4DRx4 PC4-2400T DDR4 HMAA8GL7AMR4N-UH Server RAM
2x10GB SFP+: Mellanox ConnectX-3 Pro MCX312B-XCCT CX312B 2-Port 10GbE SFP+ Ethernet Adapter
128 gb so Hynix ssd (from factory) - boot, os
4x 1 tv samsung 980 ssd (storage, etc).
1I used to sport pfsense decals on my back truck window for years. Like you, had deployed them commercially for years before that, and proudly.
After all the bs, I'd look at those stickers with combo of nostalgia and remorse.
Had a local lawn company out to do our yard last summer and they managed to wing something into that back window and shatter it, requiring me to replace it. (Lawn company paid).
Realized I was really happy with the new window cause the stickers were gone.
Fuck pfsense.
1
I’ve done the same as well, can’t say it’s been any issue and I’m just as happy with opnsense as I was with pfsense.
Pfsense behaviours recently made me decide to look elsewhere.
2This post is an automated archive from a submission made on /r/homelab, powered by Fediverser software running on alien.top. Responses to this submission will not be seen by the original author until they claim ownership of their alien.top account. Please consider reaching out to them let them know about this post and help them migrate to Lemmy.
Lemmy users: you are still very much encouraged to participate in the discussion. There are still many other subscribers on !homelab@selfhosted.forum that can benefit from your contribution and join in the conversation.
Reddit users: you can also join the fediverse right away by getting by visiting https://portal.alien.top. If you are looking for a Reddit alternative made for and by an independent community, check out Fediverser.
2I've made a tool that can convert your pfsense configuration to an opnsense configuration. It's not perfect, but it can do a majority of the legwork for you.
You can pull the site via docker:
docker run --name pf2opn -p 4200:80 -d mwood77/pf2opn
Or use it on the web here:
- https://www.pf2opn.com/
- The conversion happens 100% on your machine; there are no network requests / cookies / or any kind of tracking on the site.
As always, please try the converted configuration in a test image before you apply it to a production environment. If you find any bugs, please reach out.
2Nice, OP. My pfsense config is large and complex, but I'm currently working on migrating it to OPNsense this week too. I'm glad to not be putting up with Netgate's crap for much longer. Since I have a few Dell R240s, I've even been thinking of doing HA.
1Complete overkill in my opinion, but I like spending money, so I'll allow it.
Mine runs on an i3 and generally gets around 10-30% CPU usage, never anything even close to taxing.
1Agreed. OP should install pfsense on that thing and run opnsense vitually on this. I do this on a Lenovo Tiny with a 10g NIC and it works perfectly
1
I wonder how long pfsense will be able to stay in business, everyone in my little circle dumped them a while ago and I see constant posts on here of people switching.
1I made the switch from pfsense to OPNsense but I was having insane ping issues so I switched back to Pfsense and poof all better…. No idea why
1What supermicro case is that if I may ask? I'm also going to set up and build a dedicated firewall. Something similar specs to yours.
1Anyone know if the pppoe speed limits of pfsense are also present in opnsense?
Can't get more than 700mb/s from my 1gb/s service on my netgate box.
1I max out my pppoe FTTH install on pfsense with no issues
1
I’m in a similar boat. Have a Netgate 7100 and it’s garbage. My network is mostly 10gb with a few 25gb devices. The 25gb is on the same VLAN so the router doesn’t come into play there, but it does a bunch across the 10gb devices. The netgate can’t handle it. Just bought an r230 and started setting up vyos. If opnsense can handle the traffic I might just go with that. Having a GUI is nice and I’m already familiar with pfsense.
1If pfsense can't do it I doublt opnsense can on the same hardware.
You can get pretty close if you throw more powerful hardware at it. I managed to route at least 1.4 million packets per second (~16.8Gb/s, 1500MTU concurrent upload and download summed together) using 4 alder lake P cores on pfsense+ 22.05.
1
Yeah I swapped pfsense for opnsense last saturday because local dns was shitting the bed. I'm not completely satisfied with opnsense but whatever.
1