So I’ve been using OPNsense for a few years. I have an extensive config inclduing vlans, plugins, policies, suricata, VPN, routes, gateways, HAProxy, etc.

Over the past few months, I’ve noticed certain bugs, weirdness, and slowness within OPNsense. I recently watched Tom Lawrence’s video on the licensing changes and he touched on the openssl vulnerability that OPNsense has yet to remediate.

The Plus license cost (per year) which entitles you to some limited support options is also appealing. Every time I get stuck figuring out something complex in OPNsense, I have to hope someone else has tried to do the same thing and posted about it so I can troubleshoot.

I also don’t like having to constantly update. A more “stable”/enterprise focused cycle like pfSense has seems like my pace. It broke on me last year with one of the upgrades and I had to clean install.

Don’t get me wrong, I love the UI (mostly), plugins, etc. in OPNsense, but these past few months have got me thinking.

I’ve also heard that people don’t like Netgate as a company, so that could definitely factor into not switching.

What are everyone’s thoughts?

  • cspotme2@alien.topBEnglish
    1·
    10 months ago

    Your extensive config is probably your issue and not opnsense. You said you’ve been running it for a few years but seemingly 4 months ago, you couldn’t figure out a basic rule to block internet for a single ip.

    • cjchico@alien.topOPBEnglish
      1·
      10 months ago

      My config probably does factor into some of the issues. To be fair, I’ve never had to block Internet from a single device before, and the rule seemed backwards compared to my thought process.

      If I remember correctly, I started using OPNsense in 2020. Since then, my lab and network has evolved tremendously.

      • djgizmo@alien.topBEnglish
        1·
        10 months ago

        ‘Sense’ uses interface to base their rules around. You could use the vlan interface or the wan interface for this.

      • Gutter7676@alien.topBEnglish
        1·
        10 months ago

        Yes, that is how networking rules work.

        Just an FYI, “your way of thinking” doesn’t apply to pretty much anything. Try learning how things actually work and not assume “your way” is the right way.

        I can’t believe I have to explain that.

        • cjchico@alien.topOPBEnglish
          1·
          10 months ago

          Not sure why you’re being rude for no reason - maybe you need a cup of coffee. I am learning how things work hence the incorrect thought process. Just because you think you know everything doesn’t mean you have to put everyone else down for not.

          FYI on Fortigates (that I am used to working with opposed to *Sense), there is an incoming (source) and outgoing (destination) interface for the rules, so that’s where that thought process originated.

    • TheHellSite@alien.topBEnglish
      1·
      10 months ago

      I second this. No offense to OP!

      I never noticed any “slowing down issues” since any of the recent updates. Running OPNsense with a similiar setup to yours “vlans, plugins, policies, suricata, VPN, routes, gateways, HAProxy, etc”. Again no issues on 8+ sites, including SiteToSite WireGuard VPNs and with large corporate networks. Some systems running perfectly stable and performant since version 20.x (installed) and now running the latest update.

      Therefore I highly think your issues are user error / misconfiguration. Yet, I don’t mean to judge but it seems to me that you switching to pfSense will just bring your OPNsense issues with it.

      I can’t tell how much experience you have with networking/firewalls in general but a lack of that won’t bring you any further by switching to pfSense.