pfsense community 2.8 just released

OFaceSIG

OFaceSIG

Supreme [H]ardness
2FA
Joined
Aug 31, 2009
Messages
4,588
If you're a PFsense holdout like I am, 2.8 community edition was just released. As always it was a flawless upgrade for me. I was getting ready to move to Opnsense this summer with a new build, but I just prefer pfsense at this point due to familiarity. They seem to have nearly identical capabilities. This gives pfsense a stay of execution for at least another year for me. We'll see what happens next summer lol.
 
What does "community edition" mean? Or is that just the version that isn't bound to overpriced hardware from Netgate?
 
Out of curiosity what do everyone elses builds looks like? Mine is getting a little long in the tooth. I was going to replace it when I moved from Pfsense to OPNsense.

Intel Core i3 7100T (w/ Stock Intel Cooler)
4GB DDR4 (not even a Gig of memory used)
128GB NVME
Dual Port Intel PRO/1000 PT NIC
Onboard Intel NIC (used with a Wifi Bridge to use Neighbor's WiFi as backup)
PicoPSU DC to DC ATX power supply adapter and external 12v power supply. (I love these for small low wattage builds)

CPU sometimes gets over 30% for a few seconds when I'm saturating my 500Mbps fiber from Frontier.
 
I'm using a Dell Optiplex 3010 SFF system

Intel Core i5-3470
8GB DDR3
500GB Mechanical Hard Drive (set to turn on once each evening to backup data from RAM)
Intel I340-T2 Dual-Port Gigabit adapter

I see CPU usage at about 15% if I fully utilize my Gigabit connection.
 
OFaceSIG said:
If you're a PFsense holdout like I am, 2.8 community edition was just released. As always it was a flawless upgrade for me. I was getting ready to move to Opnsense this summer with a new build, but I just prefer pfsense at this point due to familiarity. They seem to have nearly identical capabilities. This gives pfsense a stay of execution for at least another year for me. We'll see what happens next summer lol.
Click to expand...
Do you jump on it when released or wait a bit? I know some past versions had some booboo's that left you reverting if you took a backup. I'm a hold out because it just works. I'm not in it deep with all the fancy settings but it keeps working making it easy for me to ignore it :)
OFaceSIG said:
Out of curiosity what do everyone elses builds looks like? Mine is getting a little long in the tooth. I was going to replace it when I moved from Pfsense to OPNsense.

Intel Core i3 7100T (w/ Stock Intel Cooler)
4GB DDR4 (not even a Gig of memory used)
128GB NVME
Dual Port Intel PRO/1000 PT NIC
Onboard Intel NIC (used with a Wifi Bridge to use Neighbor's WiFi as backup)
PicoPSU DC to DC ATX power supply adapter and external 12v power supply. (I love these for small low wattage builds)

CPU sometimes gets over 30% for a few seconds when I'm saturating my 500Mbps fiber from Frontier.
Click to expand...


Little ole VM
2 core E3-1240 v5
4GB DDR4
20GB SSD
 
Outlaw85 said:
Do you jump on it when released or wait a bit? I know some past versions had some booboo's that left you reverting if you took a backup. I'm a hold out because it just works. I'm not in it deep with all the fancy settings but it keeps working making it easy for me to ignore it :)



Little ole VM
2 core E3-1240 v5
4GB DDR4
20GB SSD
Click to expand...
I usually update pretty quickly. I have some custom settings for backup WAN, I have an internal gateway for a OpenVPN connector. Never really had an issue personally.
 
I was using a N150 soft router from AliExpress with 8GB RAM and a 128GB SSD running bare metal. I dabbled with pfSense, but ended up installing OPNsense. I would get more RAM usage, but that's because I was running ZFS, Zenarmor and surricata.
 
GotNoRice said:
What does "community edition" mean? Or is that just the version that isn't bound to overpriced hardware from Netgate?
Click to expand...

They have a paid version you can use on your own hardware (pfSense+), which gets more frequent updates. Basically pfSense+ is what pfSense used to be like. The CE version is just getting the scraps and may get updated once a year at this point.
 
kirbyrj said:
They have a paid version you can use on your own hardware (pfSense+), which gets more frequent updates. Basically pfSense+ is what pfSense used to be like. The CE version is just getting the scraps and may get updated once a year at this point.
Click to expand...
I'll try it out like I always do, but I just never been that impressed with the performance and layout of the web gui. And like all of these pre built router OS I always had to modify code to get the best out of it.
 
kirbyrj said:
They have a paid version you can use on your own hardware (pfSense+), which gets more frequent updates. Basically pfSense+ is what pfSense used to be like. The CE version is just getting the scraps and may get updated once a year at this point.
Click to expand...
I was under the impression that Plus was only on their hardware.
 
kirbyrj said:
They have a paid version you can use on your own hardware (pfSense+), which gets more frequent updates. Basically pfSense+ is what pfSense used to be like. The CE version is just getting the scraps and may get updated once a year at this point.
Click to expand...
It gets security updates as released, remember those updates are under a different tab now than before.
 
cyberblogger said:
I'll try it out like I always do, but I just never been that impressed with the performance and layout of the web gui. And like all of these pre built router OS I always had to modify code to get the best out of it.
Click to expand...
Everytime I've had a custom routing need or desire, w/in a few minutes of Googling I've found a post somewhere that someone has already figured it out on Pfsense. Then I've always been able to replicate what I needed w/ little issue.
 
OFaceSIG said:
I was under the impression that Plus was only on their hardware.
Click to expand...

You just get a "free" subscription to plus when you use their hardware. You can be a plus user on your own hardware AFAIK (unless they changed something in the last 6 months).
 
uOpt said:
Why not learn FreeBSD or OpenBSD instead?
Click to expand...
When I went through my computer science minor, everyone in the class had to make routers in Unix, Linux, and FreeBSD using C, C++, and perl along with server packages and I really don't see anyone making things any better than what I made in class. The only things I see that is different is how well or not a hardware driver works and how they package things to the end user.

But if you want to know, FreeBSD is really no different than Linux. They took in everything Linux produce and vice versa. Linux is a little bit easier to set up because some things in freebsd you have to recompile the kernel to change some IRQ and other system parameters. But all of them you have to alter for that application of a router. The only thing that I can see that is different is FreeBSD has concurrent execution but the threads are not memory safe even when all practices are followed. Linux doesn't have that issue and you can force inline execution and memory safe practices always work. Another level you can do with Linux is signing the programs and kernel with an SSL cert so no one can build and execute a script out of the signing. Which is another layer of malware and rootkit protection.
 
uOpt said:
Why not learn FreeBSD or OpenBSD instead?
Click to expand...
At least for me, the answer is, what little free time I have as a middle aged father of two, working full time, four days a week in the office is already taken. Learning those OS's isn't more important at this point.
 
Last edited:
cyberblogger said:
When I went through my computer science minor, everyone in the class had to make routers in Unix, Linux, and FreeBSD using C, C++, and perl along with server packages and I really don't see anyone making things any better than what I made in class. The only things I see that is different is how well or not a hardware driver works and how they package things to the end user.

But if you want to know, FreeBSD is really no different than Linux. They took in everything Linux produce and vice versa. Linux is a little bit easier to set up because some things in freebsd you have to recompile the kernel to change some IRQ and other system parameters. But all of them you have to alter for that application of a router. The only thing that I can see that is different is FreeBSD has concurrent execution but the threads are not memory safe even when all practices are followed. Linux doesn't have that issue and you can force inline execution and memory safe practices always work. Another level you can do with Linux is signing the programs and kernel with an SSL cert so no one can build and execute a script out of the signing. Which is another layer of malware and rootkit protection.
Click to expand...

Oh I wasn't asking about Linux as Linux doesn't have a firewall similar to pfsense. The pfsense software is based on FreeBSD and the actual packet filter software is PF, which comes from OpenBSD originally.

As for threads, there are some subtle difference is what mutexes default to being recursive on FreeBSD and Linux. But of course FreeBSD has fully functional POSIX threads. FreeBSD also has signed executables, it's just lacking documentation.
 
uOpt said:
Oh I wasn't asking about Linux as Linux doesn't have a firewall similar to pfsense. The pfsense software is based on FreeBSD and the actual packet filter software is PF, which comes from OpenBSD originally.
Click to expand...
Back in early 32 bit linux, iptables was the program equivalent to PF but it was brought in and rewritten in the kernel so it doesn't impact cpu usage compared to a program that could be destabilized and bypassed. It gain several advantages being brought into the kernel level.

I haven't seen BSD make an effective signed system, because I haven't seen all the tools to make a script removed out of the BSD signed systems I've seen, and BSD base router systems have been lacking a signed systems when I look further into them.

I give everyone a chance and I will try out the new PFsense in my test lab this weekend and see how it handles a 10Gb network.
 
Last edited:
OFaceSIG said:
Out of curiosity what do everyone elses builds looks like? Mine is getting a little long in the tooth. I was going to replace it when I moved from Pfsense to OPNsense.

Intel Core i3 7100T (w/ Stock Intel Cooler)
4GB DDR4 (not even a Gig of memory used)
128GB NVME
Dual Port Intel PRO/1000 PT NIC
Onboard Intel NIC (used with a Wifi Bridge to use Neighbor's WiFi as backup)
PicoPSU DC to DC ATX power supply adapter and external 12v power supply. (I love these for small low wattage builds)

CPU sometimes gets over 30% for a few seconds when I'm saturating my 500Mbps fiber from Frontier.
Click to expand...
https://hardforum.com/threads/share-your-pfsense-opnsense-builds.2024759/
 
OFaceSIG said:
Out of curiosity what do everyone elses builds looks like? Mine is getting a little long in the tooth. I was going to replace it when I moved from Pfsense to OPNsense.
Click to expand...
I have a Supermicro X10SLH-N6-ST031 +Intel Xeon E3-1275L v3 2.7GHz LGA 1150 4-Core 45W 32MB ram in a shorter 2U that I gutted out of one of these for my home test lab (six built in 10G/1G/100 and a trendNET 10G/2.5G/1G/100 card for WAN):
https://www.theserverstore.com/supermicro-1u-firewall-server-w-x10slh-n6-st031.html
and put it in a shorter 2U front facing Chassis that I had to land some more standoffs in it.
2Urouter.jpg


Will be looking forward to playing with PFsense This weekend.

If I was building a new one, I would use a Supermicro A2SDi-H-TP4F
This would be another one I would consider: Supermicro X14SAV-TLN4F
 
Last edited:
In preparation to eventually be forced to gigabit by Frontier/Verizon I swapped my Intel Pro1000 dual port gigabit NIC on my pfsense box. Booked some generic Intel i226 dual port 2.5gig NIC off eBay. I saved my config prior to the swap in case everything blew up and I could just put the gig NIC back and reboot. Repointing the interfaces was an easy affair. The thing that I thought was a bit crappy was one of the VLANs on the box lost all it's firewall rules. I don't exactly understand why. Luckily, of the three VLANs on the box, two have nearly identical rules so they were easy to recreate. After that, all was well. The LAN port is solid at 2.5Gbps and now I'm ready for a 2.5gig handoff from the ISP.
 
You must log in or register to reply here.
Back
Top