Slashdot Mirror
pfSense 1.0 Firewall Released
Chris Daniel writes, "pfSense, a FreeBSD-based firewall LiveCD distribution, has reached its official 1.0 release. Based on m0n0wall, pfSense offers firewalling, traffic shaping, VPNs, load balancing, and a nice package-management system for adding extra functionality, among many other useful built-in features. The project has been ongoing for two years, and pfSense has already been in production use in a number of locations well before the 1.0 release." Find a download mirror here.
Why Freebsd 6.1-CURRENT, I wonder? STABLE is bleeding edge enough for most, and I quite imagine that they could just use base 6.1.
That card is neither Gigabit (it 10Gbps) nor Copper (it's fiber). Hardly what he asked for. But true, the question wasn't very specific.
monowall is just a firewall, this does traffic shaping/QoS, lots more services.
Have a look at SmoothWall at http://www.smoothwall.org/
It's based on GNU/Linux and provides at par or better features and it is there for almost 4-5 years now.
> So why do they release a new distro, instead of contribing to mWall?
Because they have "radically different goals" than monowall. This is in the second sentence in http://www.pfsense.com/
Sure.
Mind you, the "target market" leans a little more toward small/mid-size office than home office.
Though I'm sure the hobby-minded with lots of spare older PCs will give it a shot.
Myself, for hy home network, I'm stickin' with mah Linksys.
You only get the better features in Smoothwall if you pay for the corporate version.
You could try IPCop instead, a fork of smoothwall.
I use IPCop instead of pfsense for some installations as it has support for the Bewan PCI ADSL modem.
If it weren't for the rocks in its bed, the stream would have no songs.
But, no. The minimal ("Do not even attempt to use it on anything less !") hardware is beyond my means (and beyond my expectation, even for traffic shaping and stuff):
All platforms: 128 megabytes of ram
Embedded: 128 megabyte compact flash card
Full installation: 2gb hard drive or larger
LiveCD: USB Keychain for configuration storage
That's simply a tiny little bit too much. I surely get the similar setting with OpenBSD on boxes with lower specs.
Okay, let's get it going. I love compact flash. Alas: "Larger flash sizes can be used but pfSense will not use the space over the 128 MB limit".
... .
"The Snort package requires a LOT of memory, only install this when the sytem has 1 GB ram or over."
Any need to go further ? To me, at least, not. I rather move on
m0n0wall is based on FreeBSD 4.x, it has little wireless support, it can not do load balancing for multiwan , neither can it do machine failover with carp.
There are currently over $2000 bounties posted on the m0n0wall list for the first person that makes it work with FreeBSD 6. Unfortunately for m0n0wall, we see people switching to pfsense instead.
Yes, pfSense _is_ based on m0n0wall
No, pfSense _is not_ m0n0wall
pfSense is an amazing product that does without hiccups what firewalls costing hundreds or even thousands of dollars do. But it has a limitation: it can't handle more than one simultaneous PPTP pass-through session to the same server. Plenty of cheap routers (based in Linux) do this. But granted, that Linux PPTP masquerading kernel module is a little beauty.
So does firewall, it has even have a traffic shape wizard... I'm a big fan of Monowall bt I'm going to give this a go, if it has more support for hardware compared to Monowall, I might consider switching to it and use my useless wireless PCI card.
pfSense is quite capable of running on either Soekris SBCs or PC Engine WRAPs, which to use your phrase, are both "small, quiet and wireless!" ;) Granted, the WRT54s are cheaper, but both the Sokeris and WRAP boards offer more flexibility.
After months of regular use I can say pfSense is a great firewall. One minor problem (and the only one) I encountered is the inability to work with the Kademlia p2p network: the client appears as always firewalled even after days though all other ports are correctly routed and the mule client gets a high id. The problem disappears as soon as I route the same ports through a different firewall.
Is it only me, but... I always like to have a console (or otherwise called a terminal) accessible on the boxes that I own. I want to be able to SSH them and change configs, hack it up, or just play around. The reason why I'm still with IPcops is that it has a full Linux console accessible locally and also via SSH. M0n0wall doesn't. So how about pfSense, does it or doesn't it?
;-) and the upper right one is my storage server.
Any comments on it? I know that I'm not _supposed_ to install stuff on a firewall, but gosh, it's a full-blown computer that just there.
I'm currently using IPcops, but I've heard great things about BSD. The recent IPcops updates have been breaking things. But it's working out great in my environment. And, I guess I'll need to plug, but I even have a webcam which shows all my networking equipments and computers in my basement: http://thelab.servegame.com:8080/view/index.shtml
(The IPCop box is the lower-right one, the one to the left of it is a Windows box that's never up (Hey, guess why
The hip way to get your IP. No ads, ever.
Would love to see this on a downloadable VM. Any takers?
Lacking the knowledge of the internal workings of PF, I do have to say that I have never had a problem with SIP. My home phone is through Vonage behind pfsense and I routinely connect while on the road to a friends Asterisk box to make phone calls with a soft phone and bluetooth headset on my laptop. He has a pfsense router and all of his trunks are SIP. Several users are simultaneously connected using SIP from remote locations and properly routed out the SIP trunks. Not to doubt that you have had things that do not work; I am only relating my experiences. I must also state that the SIP traffic shaping appears to work beautifully there as I really don't have any call issues that are not related to the bandwidth available at my remote location(s).
"The strong will do what they want, the weak will do what they must."
-Thucydides
I don't know why they are doing a 1.0 release right now. While there are many nice things in pfSense, most of them are replicated in the much more stable m0n0wall on which it is based. The pfSense only features tend not to work too well.
For example, the traffic shaping is broken. I have a 10Mb/512Kb cable connecction (NTL) and have been totally unable to get traffic shaping to do anything. There are many more like me on the forums. It seems to work for some people on some connections, but is far from robust and universal. The rules that the wizard creates are not right either, and always need modifying. Hardly 1.0 standard I feel.
There are other issues too, like the fact that embedded web upgrades don't work, or that the queues display does not show accurate stats (particularly on drops).
I'm going to decomission my 650MHz P3 that is currently running pfSense and replace it with a much lower power Netgear Rangemax router. Really, the only things that the pfSense box has over the Netgear one is traffic shaping and the ability to handle a larger number of connections. The former doesn't work and the latter is irrelevent.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
This has been gone over numerous times in both the pfsense forums and the mailing lists. The short answer is hardware support and that bsdinstaller is only available on freebsd and dragonfly at this time.
The underlying pf seems to have more flexibility than the interface on top then.
I suppose you mean something like the following?
# XXX: hardwire SIP and RTP source ports
nat on $ext_if inet proto udp from $asterisk port { 5060, 10000:20000 } to any -> ($ext_if) static-port
nat on $ext_if inet from $int_net to any -> ($ext_if)
rdr on $ext_if inet proto udp from any to ($ext_if) port { 5060, 10000:20000 } -> $asterisk
Which means that traffic from an internal Asterisk that has source ports 5060 and 10000-20000 leaves NATed but with the source ports intact. Together with the ability to let Asterisk enter arbitrary IP addresses in SIP messages[1], this makes it look like it was directly connected and not behind NAT at all.
All other traffic - even HTTP from the Asterisk server for example - gets the source port replaced as usual.
[1] Who TF thought that entering layer 3 addresses in application layers was a good idea anyway?
Of course it runs NetBSD. BTC: 1NT7QvbetmANwaMzhpVL6