Slashdot Mirror
pfSense 1.0 Firewall Released
Chris Daniel writes, "pfSense, a FreeBSD-based firewall LiveCD distribution, has reached its official 1.0 release. Based on m0n0wall, pfSense offers firewalling, traffic shaping, VPNs, load balancing, and a nice package-management system for adding extra functionality, among many other useful built-in features. The project has been ongoing for two years, and pfSense has already been in production use in a number of locations well before the 1.0 release." Find a download mirror here.
Why Freebsd 6.1-CURRENT, I wonder? STABLE is bleeding edge enough for most, and I quite imagine that they could just use base 6.1.
What's the best copper-gig network card to use with this?
So why do they release a new distro, instead of contribing to mWall?
Have a look at SmoothWall at http://www.smoothwall.org/
It's based on GNU/Linux and provides at par or better features and it is there for almost 4-5 years now.
Sorry, I'll take my Linksys WRT54GS (v3) running OpenWRT or dd-wrt. Small, quiet, and wireless!
How many simultaneous connections can this handle? I suppose it might be really dependant on the NICs instead of the software.
I know routers like the WRT54GL v1.1 choke after 64 or so connections.
You only get the better features in Smoothwall if you pay for the corporate version.
You could try IPCop instead, a fork of smoothwall.
I use IPCop instead of pfsense for some installations as it has support for the Bewan PCI ADSL modem.
If it weren't for the rocks in its bed, the stream would have no songs.
But, no. The minimal ("Do not even attempt to use it on anything less !") hardware is beyond my means (and beyond my expectation, even for traffic shaping and stuff):
All platforms: 128 megabytes of ram
Embedded: 128 megabyte compact flash card
Full installation: 2gb hard drive or larger
LiveCD: USB Keychain for configuration storage
That's simply a tiny little bit too much. I surely get the similar setting with OpenBSD on boxes with lower specs.
Okay, let's get it going. I love compact flash. Alas: "Larger flash sizes can be used but pfSense will not use the space over the 128 MB limit".
... .
"The Snort package requires a LOT of memory, only install this when the sytem has 1 GB ram or over."
Any need to go further ? To me, at least, not. I rather move on
pfSense is an amazing product that does without hiccups what firewalls costing hundreds or even thousands of dollars do. But it has a limitation: it can't handle more than one simultaneous PPTP pass-through session to the same server. Plenty of cheap routers (based in Linux) do this. But granted, that Linux PPTP masquerading kernel module is a little beauty.
Keep in mind that most light embedded systems will choke while attempting to filter much less than 50 mbit traffic. When speed matters you'll need a full PC or a high performance embedded board.
As best as I can make out, this is a general purpose unix with the packet filter from OpenBSD grafted onto FreeBSD and an interface adapted from a linux firewall; An interesting combo. pf is a superb firewall but OpenBSD is not exactly optimised for speed and I'd personally never dream of using a web GUI to configure a firewall. Rather I'd remove the httpd and possibly any CGI script host, however the curses interface looks like it could simplify admin duties.
This is definately on my "to try" list, it may make a good base system for server deployment.
"No firewall can keep all hackers out." With these words, security consultant Bob Toxen began his sermon, or workshop, on the "seven deadly sins" of Linux security. Any IT manager who commits one of these sins will "get nailed sooner or later,"
"Let me introduce you to the six dumbest ideas in computer security. What are they? They're the anti-good ideas. They're the braindamage that makes your $100,000 ASIC-based turbo-stateful packet-mulching firewall transparent to hackers"
'"Enumerating Badness" is the idea behind a huge number of security products and systems, from anti-virus to intrusion detection, intrusion prevention, application security, and "deep packet inspection" firewalls'
davecb5620@gmail.com
I'd actually like to see more systems like this provide plugins exposing options for setting up configurations to simulate unreliable network connections. I used monowall quite extensively a few years ago, and it exposed a traffic shaper option to delay packets a defined amount of time, but that alone isn't sufficient for a proper simulation. And why anyone would set that to anything other than 0 when using it for firewall purposes is beyond me.
If you're going to try to shape traffic in manners like that, it would have been useful to have other options as well such as random packet dropping, packet corruption, packet reordering, and random packet delay.
I recall a few years ago that some company came up with a hardware device specifically for simulating unreliable networks with the intent of selling them primarily to game developers. I don't recall the product name though. In any event, it would be nice to see either pfSense or monowall support an official plugin to provide access to that sort of functionality. I'm not sure if *BSD has the network hooks to support all of the necessary features though.
DD-WRT has some trouble, at least on my setup. It intermittently bugs out in certain things, for example I can't get my port forwarding to work. I have set it as a DMZ in my modem/router but some forwarded ports will work while others won't. Too bad, it really is an excellent piece of equipment (or would be, if it worked).
Send email from the afterlife! Write your e-will at Dead Man's Switch.
After months of regular use I can say pfSense is a great firewall. One minor problem (and the only one) I encountered is the inability to work with the Kademlia p2p network: the client appears as always firewalled even after days though all other ports are correctly routed and the mule client gets a high id. The problem disappears as soon as I route the same ports through a different firewall.
Is it only me, but... I always like to have a console (or otherwise called a terminal) accessible on the boxes that I own. I want to be able to SSH them and change configs, hack it up, or just play around. The reason why I'm still with IPcops is that it has a full Linux console accessible locally and also via SSH. M0n0wall doesn't. So how about pfSense, does it or doesn't it?
;-) and the upper right one is my storage server.
Any comments on it? I know that I'm not _supposed_ to install stuff on a firewall, but gosh, it's a full-blown computer that just there.
I'm currently using IPcops, but I've heard great things about BSD. The recent IPcops updates have been breaking things. But it's working out great in my environment. And, I guess I'll need to plug, but I even have a webcam which shows all my networking equipments and computers in my basement: http://thelab.servegame.com:8080/view/index.shtml
(The IPCop box is the lower-right one, the one to the left of it is a Windows box that's never up (Hey, guess why
The hip way to get your IP. No ads, ever.
Would love to see this on a downloadable VM. Any takers?
http://uptime.netcraft.com/up/graph?site=http%3A%2 F%2Fnews.netcraft.com%2F
I have played quite extensively with PFSense because I wanted some of the traffic-shaping features but I had to come to the conclusion that PFSense NAT does not work with SIP (VoIP).
The symmetric NAT of PF is simply a pain - most SIP VoIP things do not work. Anyone who considers to use SIP should not use symmetric NAT and should go for fully coned NAT.
IPCop does fully coned NAT. Traffic shaping features are also available as add-ons.
In short: PFsense is a nice idea but unfortunately useless for SIP users.
Cheers
GeeJay
Some of us got rid of the proprietary and obsolete x86 platform years ago. FreeBSD runs on SPARC64 which is the perfect platform for this kind of application. x86 is a joke at best.
I don't know why they are doing a 1.0 release right now. While there are many nice things in pfSense, most of them are replicated in the much more stable m0n0wall on which it is based. The pfSense only features tend not to work too well.
For example, the traffic shaping is broken. I have a 10Mb/512Kb cable connecction (NTL) and have been totally unable to get traffic shaping to do anything. There are many more like me on the forums. It seems to work for some people on some connections, but is far from robust and universal. The rules that the wizard creates are not right either, and always need modifying. Hardly 1.0 standard I feel.
There are other issues too, like the fact that embedded web upgrades don't work, or that the queues display does not show accurate stats (particularly on drops).
I'm going to decomission my 650MHz P3 that is currently running pfSense and replace it with a much lower power Netgear Rangemax router. Really, the only things that the pfSense box has over the Netgear one is traffic shaping and the ability to handle a larger number of connections. The former doesn't work and the latter is irrelevent.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
That was the main piece missing in monowall.. ( that and a nice installer for PC hardware users ).
---- Booth was a patriot ----
It is now official. Netcraft confirms: *BSD is dying
One more crippling bombshell hit the already beleaguered *BSD community when IDC confirmed that *BSD market share has dropped yet again, now down to less than a fraction of 1 percent of all servers. Coming on the heels of a recent Netcraft survey which plainly states that *BSD has lost more market share, this news serves to reinforce what we've known all along. *BSD is collapsing in complete disarray, as fittingly exemplified by failing dead last in the recent Sys Admin comprehensive networking test.
You don't need to be the Amazing Kreskin to predict *BSD's future. The hand writing is on the wall: *BSD faces a bleak future. In fact there won't be any future at all for *BSD because *BSD is dying. Things are looking very bad for *BSD. As many of us are already aware, *BSD continues to lose market share. Red ink flows like a river of blood.
FreeBSD is the most endangered of them all, having lost 93% of its core developers. The sudden and unpleasant departures of long time FreeBSD developers Jordan Hubbard and Mike Smith only serve to underscore the point more clearly. There can no longer be any doubt: FreeBSD is dying.
Let's keep to the facts and look at the numbers.
OpenBSD leader Theo states that there are 7000 users of OpenBSD. How many users of NetBSD are there? Let's see. The number of OpenBSD versus NetBSD posts on Usenet is roughly in ratio of 5 to 1. Therefore there are about 7000/5 = 1400 NetBSD users. BSD/OS posts on Usenet are about half of the volume of NetBSD posts. Therefore there are about 700 users of BSD/OS. A recent article put FreeBSD at about 80 percent of the *BSD market. Therefore there are (7000+1400+700)*4 = 36400 FreeBSD users. This is consistent with the number of FreeBSD Usenet posts.
Due to the troubles of Walnut Creek, abysmal sales and so on, FreeBSD went out of business and was taken over by BSDI who sell another troubled OS. Now BSDI is also dead, its corpse turned over to yet another charnel house.
All major surveys show that *BSD has steadily declined in market share. *BSD is very sick and its long term survival prospects are very dim. If *BSD is to survive at all it will be among OS dilettante dabblers. *BSD continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, *BSD is dead.
Fact: *BSD is dying
if the broken features in pfsense gets on your nerves check out http://www.endian.it/en/community/about/
stateful firewall, mail security, web security, vpn, console ssh access.
Fact: *BSD is dying
Elegy For *BSD
I am a *BSD user
and I try hard to be brave.
That is a tall order
*BSD's foot is in the grave.
I tap at my toy keyboard
and whistle a happy tune
but keeping happy's so hard,
*BSD died so soon.
Each day I wake and softly sob
Nightfall finds me crying.
Not only am I a zit faced slob,
but *BSD is dying.