undefined

points

[-]

But what if you don't want to tinker? I switched to OPNsense as a direct replacement for our Asus "WiFi routers", and it has been phenomenal, reliable, and does everything needed - when you just want it to work, it really just does. But when you want more advanced functions, there are tons of plugins and stuff that you can run natively, while still having a true CLI.

I suppose it comes down to what you said - "if you intend to run other stuff on the same hardware." Is it a good idea to run all sorts of extra stuff on your literal firewall/router? And if you did, I'd assume using a hypervisor is safer anyway? That way you can have the GUI and reliability of OPNsense but have a Linux distro beside it.

You also said that Linux has much better performance vs BSD, which seems rather far fetched. Got any data for that?

One other thing: OPNsense comes with a ton of helpful rules to eliminate bot traffic, allow IPv6, different NATs, VLANS, etc which you'd have to add manually. Not the end of the world, but worth considering.

by drnick11 days ago|

parent|

[-]

> Is it a good idea to run all sorts of extra stuff on your literal firewall/router?

I don't see any reason not to. I run dozens on services, both bare metal and containerized (Podman) on my router/firewall. It doubles as an all-purpose home server with plenty of headroom to spare. It's just a computer that sits at the edge of my network, and running services meant to be exposed to the Internet on it is natural.

> You also said that Linux has much better performance vs BSD, which seems rather far fetched. Got any data for that?

I should have worded this more carefully. What tends to happen is that BSD has worse (or no) drivers, that's when BSD's performance can noticeably degrade vs. Linux. From memory, people online were reporting issues with Realtek chips. With Intel NICs, the routing performance should be broadly equivalent .

by inventor777722 hours ago|

parent|

[-]

Ah, I see. Well, that does make more sense now. I guess just have a surplus of mini PCs so for me it makes more sense to run one routing box and one server box, but I know how much use cases vary.

I agree about Intel vs Realtek to some extent. My Lenovo M73 OPNsense actually has a 2.5G Realtek mPCIe NIC on the LAN side and it has actually been pretty great and reliable so far! Transmit maxes out early at 2.28Gbps-ish but receive is 2.47Gbps (Jumbo). However, the other week it glitched out and reported UP but was actually unresponsive. I'm still looking for an mPCI Intel i226-V version of the same thing...

The only downside to your solution is that most people (me included) would rather have auto generated configs so that you don't accidentally expose everything to Internet or break everything with an iptables rule, but that's down to experience I'm sure.

by 1 days ago|

parent|

prev|

[-]

deleted

by julkali2 days ago|

prev|

[-]

Please support your claim about (networking) performance of BSD-based systems and Linux with some source(s). It surprised me. Thank you.

by kalleboo1 days ago|

parent|

[-]

Anecdotal, but I was never able to get FreeBSD (TrueNAS CORE, OpnSense) to get anywhere near 10 Gbps. Using Mellanox or Intel NICs. The Linux equivalents (TrueNAS SCALE, OpenWrt) handled it fine on the same hardware.

by miladyincontrol1 days ago|

prev|

[-]

Thats more or less what I did, and nix just made sense for the job. For 99% of people I'd say no its not worth it to tinker, just go with opnsense virtualized so you get at least some the benefits of the better linux drivers. By that I mean NBASE-T on various intel chips and while intel's igb is fairly solid on unixes many other vendors' drivers are less so. However if you're willing to figure out configuring per your needs you definitely can get a lower latency router with all the same capabilities and more, with it's components more sanely isolated via containers.

by tapper1 days ago|

prev|

[-]

Some people want a webinterface tho.