![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
where is Untangle in that list ?
Yes
IMO, this is a perfect example of what is wrong with pfsense. This is a firewall we are talking about...not an all-in-one wonder machine. The more services you put on your firewall the less secure it becomes, period, end of story. A firewall should be a firewall and that's it. I think every other service you just listed should be handled outside the firewall duties on a separate piece of hardware. This is why I liked m0n0wall over pfsense, m0n0wall is just a firewall (yes, it can do a few other things like dhcp and dns forwarding) and that's it. It doesn't try to do it all, thus giving you a much more stable and secure firewall. (I'm sure someone is going to chime in a say their pfsense box has been up for XXXX days
)IMO, this is a perfect example of what is wrong with pfsense. This is a firewall we are talking about...not an all-in-one wonder machine. The more services you put on your firewall the less secure it becomes, period, end of story. A firewall should be a firewall and that's it. I think every other service you just listed should be handled outside the firewall duties on a separate piece of hardware. This is why I liked m0n0wall over pfsense, m0n0wall is just a firewall (yes, it can do a few other things like dhcp and dns forwarding) and that's it. It doesn't try to do it all, thus giving you a much more stable and secure firewall. (I'm sure someone is going to chime in a say their pfsense box has been up for XXXX days
pfSense is actually based on Monowall codeIMO, this is a perfect example of what is wrong with pfsense. This is a firewall we are talking about...not an all-in-one wonder machine. The more services you put on your firewall the less secure it becomes, period, end of story. A firewall should be a firewall and that's it. I think every other service you just listed should be handled outside the firewall duties on a separate piece of hardware. This is why I liked m0n0wall over pfsense, m0n0wall is just a firewall (yes, it can do a few other things like dhcp and dns forwarding) and that's it. It doesn't try to do it all, thus giving you a much more stable and secure firewall. (I'm sure someone is going to chime in a say their pfsense box has been up for XXXX days
IMO, this is a perfect example of what is wrong with pfsense. This is a firewall we are talking about...not an all-in-one wonder machine. The more services you put on your firewall the less secure it becomes, period, end of story. A firewall should be a firewall and that's it. I think every other service you just listed should be handled outside the firewall duties on a separate piece of hardware. This is why I liked m0n0wall over pfsense, m0n0wall is just a firewall (yes, it can do a few other things like dhcp and dns forwarding) and that's it. It doesn't try to do it all, thus giving you a much more stable and secure firewall. (I'm sure someone is going to chime in a say their pfsense box has been up for XXXX days
PFSense came from m0n0wall.
And you don't have to install and enable all those components. I use it for its superior QoS traffic shaper feature. I can play online games....while the wife surfs...while the kid is downloading, and not have my ping affected. I've sat there and downloaded 4x huge files at the same time..fully pegging out my 6 meg cable...I then fired up Battlefield 2 and played on my usual server with my normal awesome ping. The kid fired up his Battlefield 2 and also did the same. No other router would allow this smooth of an experience.
I forget when I put it in...back in Feb I think...uptime..since then!
) up till about a month or two ago, when I moved my home to a Cisco ASA for my firewall, I am very familiar with the two projects. pfSense is actually based on Monowall code
The fact that it does multiple duties doesn't suggest it is less secure in anyway. If it was, i'm sure a warning or notice of some sort would be given to suggest that.
I've worked with a Sonicwall 3060 Pro in a school and it is running multiple VPN tunnels, DHCP, DNS, and serves as a firewall. Still secure while doing other tasks.
While what you say is good security practice, unfortunately, most home and small business users cannot justify having 10 systems running to each do a dedicated task like firewalling, vpn access, dns, dhcp, etc. Even with virtulization (vmware, xen, jails, etc), the additional headache of maintaining those additional installations is a waste of time and resources. You'll be running the same software (with the same vulnerabilities) on those additional machines that you are running on pfsense (or m0n0 or smooth, etc...), and the only advantage you may have is a quicker response time to known vulnerabilities. (if you really want a fast response, you'd be patching and recompiling on your own anyway, rather than waiting for your distro to throw down the latest updates into it's repositories. You can have your own pfsense build environment to do just that. It's no different than any BSD or Linux.)
If someone is able to exploit one of my internet facing services, it doesn't matter what my firewall is, I've got a problem. If someone is spoofing traffic coming into my firewall, it doesn't matter what my firewall is, I've got a problem.
Properly configured firewall rules, and properly secured services mitigate many of the "security risks" of running multiple apps on a gateway machine. The same can be said of checkpoint, watchguard, sonicwall, pix, and any other "dedicated" firewall solution.
And yes, my pfSense box has had uptimes of several months between power outages or upgrades.
what do you think the percentage is of guys that have more than one system? All I'm saying is let your firewall be your firewall, setup a separate machine that can handle the rest.Right, there are lots of sorry setups out there but you're arguing that it's ok to replace "not up to par" with "not up to par". The worse of two evils??? I have a problem with companies that won't pay for the basics of their network. Yes, as admins some times you inherit these situations and you gotta do what you gotta do but I really don't think pfsense is ever the answer. I'd rather use m0n0wall or ipcop before putting in pfsense.
IMO, this is a perfect example of what is wrong with pfsense. This is a firewall we are talking about...not an all-in-one wonder machine. The more services you put on your firewall the less secure it becomes, period, end of story. A firewall should be a firewall and that's it. I think every other service you just listed should be handled outside the firewall duties on a separate piece of hardware. This is why I liked m0n0wall over pfsense, m0n0wall is just a firewall (yes, it can do a few other things like dhcp and dns forwarding) and that's it. It doesn't try to do it all, thus giving you a much more stable and secure firewall. (I'm sure someone is going to chime in a say their pfsense box has been up for XXXX days