pfSense 1.0 Firewall Released

Chris Daniel writes, "pfSense, a FreeBSD-based firewall LiveCD distribution, has reached its official 1.0 release. Based on m0n0wall, pfSense offers firewalling, traffic shaping, VPNs, load balancing, and a nice package-management system for adding extra functionality, among many other useful built-in features. The project has been ongoing for two years, and pfSense has already been in production use in a number of locations well before the 1.0 release." Find a download mirror here.

Comments

Re:Based on mOnOwall?

[Anonymous Coward]

monowall is just a firewall, this does traffic shaping/QoS, lots more services.

SmoothWall

[mahesh_gharat]

Have a look at SmoothWall at http://www.smoothwall.org/
It's based on GNU/Linux and provides at par or better features and it is there for almost 4-5 years now.

Re:SmoothWall

[MattBurke]

Only if you discount firewalling as a feature.

The code behind iptables is disgusting. It doesn't even do a proper job of stateful tracking. Read and compare the source code if you don't believe me - There are many things which linux does in about 10 lines of code but run into hundreds or thousands of lines in the pf source because pf does the job properly

SmoothWall?? IPCop!

[PurPaBOO]

You only get the better features in Smoothwall if you pay for the corporate version.

You could try IPCop instead, a fork of smoothwall.

I use IPCop instead of pfsense for some installations as it has support for the Bewan PCI ADSL modem.

PPTP pass-through?

[pmsr]

pfSense is an amazing product that does without hiccups what firewalls costing hundreds or even thousands of dollars do. But it has a limitation: it can't handle more than one simultaneous PPTP pass-through session to the same server. Plenty of cheap routers (based in Linux) do this. But granted, that Linux PPTP masquerading kernel module is a little beauty.

Re:PPTP pass-through?

[Slashcrap]

Of course, let's discount the fact that it can act as a PPTP endpoint (feature from m0n0wall).

Yes I think we should, since it has no relevance to what the grandparent was talking about.

What he is pointing out is that if you have a lot of visitors behind your pfSense based corporate firewall and they want to make PPTP connections back to their corporate networks, it will not work. Because there is no support for multiple PPTP passthrough.

I would love to tell you all about a perfect example of this becoming a problem at a major event because of our choice of OpenBSD for a product. But I can't. Suffice to say you would be amazed how many companies actually use PPTP for their remote connectivity.

How would having it act as a PPTP endpoint help in this case?

Re:Uuh, no thanks, not convinced

[Anonymous Coward]

You probably want m0n0wall instead which is lighter and aimed at embedded systems. Having used both (along with ipcop and others) I can say they all are excellent products.

Re:Relies on a full-size computer

[beardz]

pfSense is quite capable of running on either Soekris SBCs or PC Engine WRAPs, which to use your phrase, are both "small, quiet and wireless!" ;) Granted, the WRT54s are cheaper, but both the Sokeris and WRAP boards offer more flexibility.

minor p2p glitch

[Anonymous Coward]

After months of regular use I can say pfSense is a great firewall. One minor problem (and the only one) I encountered is the inability to work with the Kademlia p2p network: the client appears as always firewalled even after days though all other ports are correctly routed and the mule client gets a high id. The problem disappears as soon as I route the same ports through a different firewall.

Re:VM?

[numbski]

The dev version already is.

I've installed into Qemu before without issues. This is actually a pretty common thing on the irc chans.

Re:Uuh, no thanks, not convinced

[Anonymous Coward]

I have difficulty understanding the problem. We are not aiming at the small embedded 35 euro router market here.

A cisco 851 has 64MB ram, a cisco 871 has 128MB ram. We are talking hardware that can at least do redundancy, balancing, failover and multiwan. Then you promptly enter the plus $200 market and this is the competition.

And you need memory for sufficient connection tracking, firmware upgrades, traffic shaping etc.

We point out that Snort (which we have no control over) requires a lot memory. That is there to prevent foot shooting. Then again the $200 routers do not do IDS/IPS.

Seems fine to me.

1.0 and it's still broken

[AmiMoJo]

I don't know why they are doing a 1.0 release right now. While there are many nice things in pfSense, most of them are replicated in the much more stable m0n0wall on which it is based. The pfSense only features tend not to work too well.

For example, the traffic shaping is broken. I have a 10Mb/512Kb cable connecction (NTL) and have been totally unable to get traffic shaping to do anything. There are many more like me on the forums. It seems to work for some people on some connections, but is far from robust and universal. The rules that the wizard creates are not right either, and always need modifying. Hardly 1.0 standard I feel.

There are other issues too, like the fact that embedded web upgrades don't work, or that the queues display does not show accurate stats (particularly on drops).

I'm going to decomission my 650MHz P3 that is currently running pfSense and replace it with a much lower power Netgear Rangemax router. Really, the only things that the pfSense box has over the Netgear one is traffic shaping and the ability to handle a larger number of connections. The former doesn't work and the latter is irrelevent.

Re:CURRENT?

[Philip K Dickhead]

pfSense Rocks hard.

I have been on the RC1, and replaced all my Linux/IPfilter machines with this.

Re:A mish-mash of other systems?

[DoXaVG]

This has been gone over numerous times in both the pfsense forums and the mailing lists. The short answer is hardware support and that bsdinstaller is only available on freebsd and dragonfly at this time.