There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

Pfsense, Opensense and OpenWRT - what's the deal?

Hiya, just getting into networking and recently completed my Tp-link Omada stack, which I’m very pleased with. Have heard great thing about all three mentioned services above, but struggle to understand which to go for. Do they have different use cases? Is one easier than the other? Which one is recommended to begin with?

chronicledmonocle ,

pfSense = Firewall and router system based on FreeBSD. Has both open source and commercial versions. Built for SMB to Enterprise uses. Extremely powerful with all of the bells and whistles you’d expect from a professional firewall product.

OPNSense = Basically pfSense with a different UI. It’s a fork of pfSense. Much of the same capability, but is built by a smaller company.

OpenWRT = Replacement firmware for embedded devices (as well as x86). It’s open source WiFi router firmware that runs on tens of thousands of devices. Many vendors will even base their custom firmware on OpenWRT and put a different skin on it (GL.iNet, for example).

Sunny OP ,

Perfect, thanks for summing it up for me! <3

TCB13 ,
@TCB13@lemmy.world avatar

That explanation is misleading because:

  1. OpenWrt does firewalling and routing very well;
  2. If you’ve a small / normal network and OpenWrt will provide you with a much cleaner open-source experience and also allow for all the customization you would like;
  3. There are routers specifically made to run OpenWrt, so it isn’t only a replacement firmware.
Gerbils ,

pfSense and OPNsense are firewalls. OpenWRT is router firmware. They’re all open source - to varying degrees - and they all have overlapping features and functionality.

Quick breakdown:

  • OpenWRT: originally developed as a replacement for the firmware on Linksys wireless access points. It has grown into a full Linux-based networking OS with extensible features and broad hardware support. The target devices are still mostly wireless routers/access points and the use cases it services are still mainly about wireless networking.
  • pfSense: Originally a fork of m0n0wall, it’s a BSD-based firewall distribution. Designed primarily for firewall use cases, it can be loaded on bare metal or in VMs, but it’s generally deployed “upstream” from wireless devices - typically it’s the device that all of your network traffic passes through on the way in/out of the LAN. Extensible architecture and a rich ecosystem of plugins means that pfSense can also serve as a caching proxy, load balancer, intrusion detection server and logging host.
  • OPNsense: a fork of pfSense. Almost identical use cases. OPNsense has a more usable/modern UI, but lags slightly in support for new features and plugins.

So the question of pfSense or OPNsense is either/or - you’d typically pick one or the other. Note that I’m staying away from the political comments that will invariably come up around this comparison. It’s enough to know that both have commercial offerings in addition to their open source versions and people have strong opinions one way or the other.

Either one of either pfSense or OPNsense in conjunction with OpenWRT is common, with OpenWRT on the wireless devices and pfSense/OPNsense at the egress to WAN. In your case, Omada already does what OpenWRT would do - along with some very limited versions of what you could do with pfSense or OPNsense.

It’s worth noting that folks often deploy these three open source tools as a method to regain control rather than using a third party cloud based solution like Omada. No judgement, just saying that Omada is the polar opposite of the ‘selfhosted’ esthetic.

Sunny OP ,

Just fyi; I am using the Omada system without using the cloud option, it is also selfhostable :) But thanks for the info/writeup!

possiblylinux127 ,

You are using the cloud though. They control it not you. If they push a bad update or decide to start selling your data there is nothing you can do

kinetic_donor ,

They what and what?? Generally the Omada-stack devices are just on-premises hardware that you control. If you enable automatic firmware updates, then yeah, “if they push a bad update” and all (similar to a Linux distro with auto updates enabled). To improve operations, and enable certain features, there is the “cloud-based controller” software (appliance), which is named weirdly, because it generally does not live in the cloud - you can self-host on-premises, though its core software component is a black box and not (F)OSS (also available as an actual hardware appliance). There have been instances of the devices “phoning home”, though you might be able to limit that to some extent with firewall rules.

possiblylinux127 ,

My point is that you do not control it. If you want full untethered control, go with OpenWRT and possibly OPNsense as a firewall

downpunxx ,

Clap clap clap. Great explanation

anamethatisnt ,

pfsense and opnsense are very similar. The pfsense devs has acted like jackasses towards the opnsense gang. They are both great for a router/firewall/vpn device. I would use external access points with them.
I think there are more addons to pfsense than opnsense.

OpenWrt is great when it comes to WiFi, but I find it much less intuitive to use for router/firewall parts. Could be that I am used to the way pfsense and opnsense do things.

Neither do switching from what I know, so pair the router with a switch of your choice.

aseriesoftubes ,

The pfsense devs has acted like jackasses towards the opnsense gang.

And toward their users. Ask the wrong question on the pfSense subreddit or forum and expect to get lit up. The Opnsense community is much more helpful and inviting in my experience.

BlueEther ,
@BlueEther@no.lastname.nz avatar

Yeah, that was the reason I switched from pfsense to opnsense about 4 years ago

carzian ,

Also worth noting that pfsense was ready and intending to knowingly ship a broken and insecure wireguard integration

possiblylinux127 , (edited )

Open vs closed solutions

I also like how OpenWRTs implementation of 802.11r doesn’t require any central controller

Edit: the closed solution I’m referring to it TP-link

4am ,

What’s closed about OPNSense?

possiblylinux127 ,

My bad I was talking about TP-link

ubergeek77 ,
@ubergeek77@lemmy.ubergeek77.chat avatar

Are there any “open” solutions to mesh networking that can compare to TP-Link Omada? I don’t think any open source hardware or software can come close, especially not for the newer Wi-Fi standards.

I haven’t bought them yet, but I’m seriously thinking about some Omadas. I imagine I can prevent them from phoning home, and the management software can run locally in a Docker container. Running it like that would be good enough for me even though they’re not “open.”

I’m planning a rework of my home Wi-Fi, and my current plan is an OPNsense box from Protectli, and a few EAP772’s:

www.tp-link.com/us/business-networking/…/eap772/

If there’s something comparable/better that’s more of an open ecosystem, you definitely have my attention while I’m shopping around for different options.

possiblylinux127 ,

802.11s + 802.11r

ubergeek77 ,
@ubergeek77@lemmy.ubergeek77.chat avatar

Ok… sure. But what physical devices would I use, and what software would they run?

anamethatisnt ,

Software: OpenWrt - openwrt.org/docs/guide-user/network/wifi/roaming
Devices: Supported devices found here - openwrt.org/toh/start?toh.filter.supportedcurrent…

possiblylinux127 ,

openwrt.org/docs/guide-user/network/…/80211s

poVoq ,
@poVoq@slrpnk.net avatar

Lets not forget www.ipfire.org which is also great.

Sunny OP ,

Thanks for sharing, had not heard of this one 👍

dukatos ,

Did they add Wireguard yet?

poVoq ,
@poVoq@slrpnk.net avatar

Not yet, but it has OpenVPN. I think they plan to add Wireguard in the upcoming 3.x release.

rtxn ,

They all offer more or less the same network services with different UIs.

OpenWRT is specifically designed to work as a lightweight system running on consumer-grade routers. If you want this, you’ll have to check the website’s Table Of Hardware to determine if your hardware is compatible.

OPNsense and pfSense are general-purpose FreeBSD-based operating systems that you can run on discrete computers or in VMs that act as network gateways. All three are free/gratis, but you have to make an account and go through the store page to download pfSense.

I personally use OPNsense in a VM.

Sunny OP ,

Thanks for the info :)

possiblylinux127 ,

OpenWRT is a iot operating system. It can run anywhere and everywhere. You can totally run it on enterprise gear and x86 machines. It can work as a firewall or a operating system for a light bulb. It also has the advantage of being very extensible and you can build custom images that have only the stuff you need.

The downside is that even though the wiki is fairly good it still requires a good amount of networking knowledge to use. It isn’t bad and it ships with sain defaults but if you want to get advanced you need to know what you are doing.

It also lacks a mechanism for automatic security patching. You need to manually update it which is easier with attended upgrades but it still requires button pushing and downtime.

Mikelius ,

Lots of comments already mentioning the differences. I have tried these, including the mentioned ipfire, and decided on the end to use opnsense plus openwrt on two different devices.

I chose opnsense at the time many years ago because it supported wireguard out of the box, where as pfsense required some weird install process I didn’t want to deal with. Plus I liked the UI to opnsense more.

My moden has been literally replaced by my firewall so I have the ONT connected to it and then use it to do all the heavy lifting for… Well, firewall stuff. It connects to a VPN so my entire network routes through the VPN. Then my openwrt device is connected to that. It also handles firewall stuff, but more at an internal level (keeping network devices only permitted to communicate with devices I say are okay, blocking internet access, etc) and also hosts my nginx setup to route to various servers.

While I could do everything on one machine with opnsense, I’ve got a particular setup that allows me to have multiple devices at the firewall level, truly isolated from the rest of my internal network (for a couple of internet open port services). And it gives me peace of mind that if someone found a zero day in opnsense, I’m not totally screwed unless they also got one in openwrt.

To answer “which is better to begin with”, I personally find opnsense way more flexible and robust than the other 2 options. Has a lot more capabilities and upgrading is super easy without requiring jumping through weird hoops and such like openwrt does.

Decronym Bot , (edited )

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters More Letters
HTTP Hypertext Transfer Protocol, the Web
SMB Server Message Block protocol for file and printer sharing; Windows-native
VPN Virtual Private Network
nginx Popular HTTP server

3 acronyms in this thread; the most compressed thread commented on today has 10 acronyms.

[Thread for this sub, first seen 28th Jul 2024, 07:15] [FAQ] [Full list] [Contact] [Source code]

snekerpimp ,

The newer Omada routers are pretty good, and their software is getting better. Personally I use Opnsense on a Chinese fanless router from eBay. Paid for an n100, got an i3-1113 with dual channel memory does everything I need no issue, and it has helped me learn ALOT. However if I had the $200 just laying around today, I would stick with Omada just for simplicity.

trilobite ,

This thread has reminded me that I have Ruckus APs that mesh. But support had been dropped because they are “old”. Presumably there is no open source solution that I can flsh these with, still allowing me the meshing?

anamethatisnt ,

OpenWrt with 802.11r and 802.11s configured will work as a mesh network with roaming functionality.
openwrt.org/docs/guide-user/network/…/80211s
openwrt.org/docs/guide-user/network/wifi/roaming

Not many Ruckus devices that are supported though:

Brand - Model - Supported Version
Ruckus - ZF7025 - 23.05.2
Ruckus - ZF7321 - 23.05.2
Ruckus - ZF7341 - 23.05.2
Ruckus - ZF7343 - 23.05.2
Ruckus - ZF7351 - 23.05.2
Ruckus - ZF7352 - 23.05.2
Ruckus - ZF7363 - 23.05.2
Ruckus - ZF7372 - 23.05.2

openwrt.org/toh/start?toh.filter.supportedcurrent…

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • [email protected]
  • lifeLocal
  • random
  • goranko
  • All magazines
    •