Why I am Not Using OPNSense

[@evanbaker6375]

I love how you tell why you do or don't do things and not try to force your opinions upon others! Keep up the great work.

[@LAWRENCESYSTEMS]

Thanks

[@ShaferHart]

it's the kind of clarification that's only needed in the age of snowflakeism where everyone seems to live with their "heart" on their sleeve ready to get offended over meaningless stuff.

[@Shocker99]

It's the same difference, just phrased differently. Both phrasings tells the viewer the KZbinr's opinion on x and why they should think about using/not using it.

[@apalrdsadventures]

I'm sure the most recent comments at you are a direct result of Netgate dropping CE downloads from the website, which probably would have gone over fairly well if they didn't double down posting 'CE users are not customers' on Reddit.

[@shephusted2714]

they pull crap like that all the fscking time - horrible

[@bertblankenstein3738]

It is this sort of stuff where I feel pfSense will eventually not have a CE (free) edition. It has been moving towards that direction for some time., which is a real shame. This turns me off pfSense since they may just pull the rug out from CE. Currently quite happy with the product, less excited about the company.

[@jimthompson971]

@@bertblankenstein3738I’ve consistently said that we’re not taking CE away and we’re keeping it free. We still work on it. The ISOs can still be downloaded without registering. This is widely known.

[@mitchellmnr]

@@bertblankenstein3738 You can just build from source can't you?

[@apalrdsadventures]

@@mitchellmnr The downloads currently point to the Netgate Installer, which requires you to setup a WAN connection so it can download the correct version (CE/Plus). The 'old' install images are still on the server, and their links have been shared around the internet, but there are not plans to continue building those in the future. Apparently 'customers' can create a support ticket to request an offline Plus installer, but CE users aren't customers so they can't.

[@rayr86]

I appreciate you making this video Tom. I’ve watched your other videos with the detailed comparisons, heard about the “controversy” between PFSense and OPNSense and had decided to stick with OPNSense on that alone. But your argument to support the product that benefits the community more is enough reason for me to consider trying PFSense and see where I land after giving them both a fair shot. Thanks again and may I also say, I love your content!

[@ti4go]

pfSense requiring signup to download the ISO just made me switch to OPNSense... this is just a dumb move...

[@davidg5898]

Same. I actually preferred pfSense. Oh, well. At least it's an easy transition to OPNsense.

I have official hardware and pfSense plus, but tried to download the CE version to use in a virtual environment. It was not easy, tried to sign up, but I got the non-ce version. However the sha256 hash for the iso.gz is in the official documentation, so it's easy enough to find mirrors and verify. This is a lot harder than it should be though.

[@Darkk6969]

The old school download links still work from Netgate.

[@-tineidae]

Netgate is a bit to shady for me, the long release cycles for community does not look like they care much for that edition. Past few month is almost looked like they stop developing community and want to push everyone to Plus. With all the US shitshow with Cisco and Juniper placing backdoors in their product does not really speak for US Security Products :(

[@slipknottin]

Man when the hell did they add that stupidness

[@talbech]

Been on OPN for years since retirering the last Soekris box running PF years ago. OPN never let me down and I'm pretty sure PF wouldn't have either. Just recently replaced a Juniper SRX as our data center edge router with an OPN and it has been performing great.

[@kingwing5963]

PF has let me down repeatedly. TNSR isnt bad tho.

[@Secretly-Based]

I feel that Netgate has an adversarial view of their own users, and it will be their downfall. Just look at VMware....

[@gregf3021]

Everyone is free to make their own decision. For me the stuff pfsense did at the start to try to interfere with opnsense left a very sour taste in my mouth. I can't support them again.

[@BillLambert]

I switched from PF to OPN a few months back, mostly on a whim because my homelab FW got corrupted somehow and needed to be rebuilt, so I gave OPN a shot. To me it feels like mostly the same functionality behind a slightly redesigned UI. I like the fact that it has a REST API for common stuff, which I use for monitoring DHCP leases and a few other simple things. In PFsense I had to build my own API backend in order to get data in and out, whereas in OPNsense I just wrote a trivial script to consume the API and feed into my dashboard. People have been asking for REST functionality in PFsense for many, many years, and Netgate's answer was always "soon", but then TNSR happened and any hope of a PFsense API completely evaporated.

[@vogtm]

Fair point!

[@whatareyousaying339]

If that corruption happens again just run fsck. One of my installations a few days ago got corrupted when simulating a power fault. Fsck fixed it right up. Was able to boot again!

[@MelroyvandenBerg]

OPNsense is just better.

[@demanuDJ]

That is fair video, I'm an OPNsense user, but reasons why you're using pfSense are reasonable

[@androbourne]

Lawrence I just have to say I appreciate you take the time to create and upload these videos. Even myself as an MSP Network/Systems Engineer (I mostly do commercial hardware like Watchguards, Ciscos etc...) it is very nice to have a reliable unbiased knowledgeable person such as yourself on the OpenSource community. I learned a lot about OpenSource from you and even implemented some at my own home to continue my education on the platforms. Thank you and keep up the good work!

[@glynnetolar4423]

The reason I don't use pfSense is because the pfSense team appears to behave like children. Look at the way they initially treated OpnSense. And then the way they handled the licensing recently seems to back that up. Maybe we need a third option, I don't know. I also don't like the pfSense interface. I'd feel a lot better if all the children on pfSense left. Just my $0.02.

[@Akimbo711]

Don't forget the drama when Netgate tried to ram in a botched and vulnerable WireGuard implementation into BSD Jason Donenfeld was absolutely appalled

[@OT-tn7ci]

Same, they are pretty much the same, if you are the sort of customer that needs dual WAN, you are better of with a pain firewall honestly.. I don't see a customer segment for pfsense, I even tested the wireguard throughput heavily on my 2G WAN with a single client, I didn't see any difference between opnsense and pfsense but my hardware is old.

[@espressomatic]

@@OT-tn7ci Why would there be a difference? OPN is a skin on top of pf. If pf goes away, there is no OPN. It's that simple.

[@mikeandersen8535]

When I was deciding between opnsense and pfsense, I ended up choosing opnsense because of what I had read about really bad behaviour from the people behind pfsense. So no technical reason, just that I would not support such behaviour. Pure and simple.

[@EmongTimothy]

would be nice to have some reasons listed my good sir.

[@mikeandersen8535]

@@EmongTimothy It is easy to find, if you are interested in searching yourself. But the domain dispute (WIPO Case No. D2017-1828) is a good start, especially the story on how Netgate used the domain (OPNsense also has a page about it). That one alone was enough for me to not consider Netgate. But there are other stories worth checking out too, if you are interested to do some work searching and evaluate the sources, "my good sir".

[@romangeneral23]

@@EmongTimothy How bout them putting the CE download behind a sign up and billing information. Is that a good enough reason for you ?

[@Shocker99]

CE = community edition, for anyone wondering. I believe they combined the installer of the community edition and the paid option.

[@espressomatic]

I did the opposite. Ignored remarks from pundits on both sides and actually installed and used both systems. With a deep look into both in real use as "daily-drivers" on my network, it didn't take long to decide which one was for me. I chose what I believed to be the far better engineered effort, pfSense. I can see why OPNsense was created, but it's frankly a mess and I can't abide any of their UI decisions. Sure pfSense has issues too, but it's a far cry from the OPN mess.

[@ziggo0]

Used pfSense for at least 10 years. Wanted to give OPNSense a go. Still running it 2 years later. For my use case at home...the router OS doesn't matter as long as it's at least pf/OPN based.

[@peetersbjorn]

yes, netgate has stuff in the *bsd code. yes, opnsense pulls some of it... but from what i can tell, most of it: - was not created by netgate (but now maintained) - is no longer maintained by netgate - was created by someone else and they just assigned a portion of netgates money(?) in the credit - or has not been changed in over 3 years so saying opnsense relies on pfsense is a bit... oversimplified ? on top of that, it's code inside of *bsd, meaning it's not really "opnsense uses netgate code" but "opnsense has a *bsd base", so you could say both netgate & opnsense "depend on every single contributor to *bsd" that being said, my main reason for using opnsense are mostly because i like the interface much more and second because of how netgate "bullied" opnsense like a toddler when they forked.

[@OT-tn7ci]

Exactly and a comparison of companies paying developers for OSS is stupid imo cuz there will always be someone else to do it if you don't

[@jhboricua]

Not to mention opnsense devs also contribute code to bsd and in some instances have fixed bugs in netgate's contributions. It's a silly argument by Tom.

[@OT-tn7ci]

@@jhboricua agreed. Plus, from what I see, negate seems to do it only to get patches in sometimes, and if negate didn't exist, another company would do it. It's not really an argument.

[@BackwoodsTinkerer]

Considering his company and the services he provides "relies" on PFSense I'm sure theres quite a bit of bias behind his opinions. But like you pointed out, he's over simplified the explanation but also purposely left out a LOT of facts, and it makes me wonder WHY he chose this route. After coming across his videos last year when starting to build my own router/firewall his anti-OPNsense videos were actually the reason WHY i went with OPNsense because his reason didnt seem genuine, and indipendant research found his opinions against OPN had no factual backing. I'm glad I chose what I did because shortly after the PF crap went down with subs and CE and all that nonsense. I honestly do not trust anyone who backs corporate greed like Netgates.

[@jamesegg9005]

I think there's real demand for high quality OPNSense videos on KZbin, and when people like the videos you make, they want to see you make high quality videos about the topics they want. I think the issue is that they don't notice that this channel is mostly in depth videos about the software Tom uses professionally, and occasionally a video about comparable products, but nothing in depth. One of the best things about VMWare imploding was the influx of videos doing a survey of lots of different solutions. As varied, interesting, and niche IT solutions can be, this is not the channel for lots of videos about lots of different software.

[@enonu]

In particular, I'd like an OPNSense version of the buffer bloat video.

[@SpeZi-tr6gr]

Thanks, Tom! Especially as an OPNsense user, that's exactly what interests me. It's not a religion, it's just facts and here are some facts I didn't know and I'm grateful for that.

[@outboundrules]

I just want to tell you many thanks for your tutorials ..I learn a lot from your pfsense tutorials. I managed to have a better job like firewall admin and was easy to understand after that also the Sophos firewall. Thank God for people like you exist and know how to explain this. Greetings from Germany

[@theatlastech8792]

Tech can be worse than religion at times.

[@Jamesaepp]

Come to the church of emacs to avoid the cultists of vi. /s

[@LAWRENCESYSTEMS]

:q!

[@EmperorTerran]

well considering Tom is deleting comments that link to articles what pfsense did and point out some issues in his presentation.. yeah..

[@Jamesaepp]

@@EmperorTerran I doubt that's tom. KZbin never lets through any of my comments when I include links. I think it is an (overly aggressive) anti spam measure.

[@girogiacomo]

​​@@EmperorTerran Do you even know how youtube's spam filter works? Links ar nuked everywhere for no reason.... EDIT: And not only links

[@icaroslbc]

Used pfSense for 10 years, but recently switched to OPNsense. The main impulses were packages (Xen guest tools, Zerotier) and many automation features (like in Wireguard - when you define allowed networks, it automatically creates the routes unlike in pfSense; or HAProxy integration and config). So overall it is the automation and packages that make the difference for me.

[@espressomatic]

OPN is pretty much a skin with a few user scripts. If they hadn't completely shit the bed on the UI/UX, it might be worth running for the scripts. By supporting OPNsense, people are helping to destroy the base project. And if pfSense CE goes away, do you think anyone at OPNsense can actually maintain, let alone develop a firewall/router?

[@GSCNSFC]

I picked OPNsense because it has better driver support for all my devices.

[@andreas7944]

This was due to the newer BSD base version used by OpnSense compared to PfSense. PfSense changed that a while ago, and therefore it is no longer a problem. But there is hardware I would avoid with both :D

[@Darkk6969]

Latest Pfsense+ now uses FreeBSD 15.0 which is a few versions ahead of Opnsense so it's not an issue anymore in terms of providing hardware support.

[@acadiaCyberSec9865]

Another significant advantage OPNsense has, compared to other NIPS open source projects, is that it only blocks the traffic that matches the NIPS signature. Some solutions block the source/destination IP for a while, which can cause a lot of issues in a false positive case.

[@walter_lesaulnier]

I LOVE how much actual data and info are in each of fairly short videos - no annoying pointless filler. Networking in general has always been a big weakness of mine, even though I've been building and tinkering with computers for almost 50 years. I've learned a LOT going through your videos.

[@christophrechtlehner]

When I wanted to start using pfsense, the realtek chip of my nic was quite new and a FreeBSD driver was available. However, it was not integrated into pfsense. Op sense on the other hand did already support it. I was and still am very grateful for that

[@TeslaMaxwell]

been using pfsense 2 years now as both edge fw and another internal fw for my homelab... its been great so far. had to chance to help a friend of mine spinning up their opn instance and had no issues with it, felt pretty similar to pfsense.. personally i think both are great and solid, ill stick with pfsense for the time being for one of the reasons mentioned in your video! thx for sharing your experience!

[@_sneer_]

I went with Open on my router, but OpenBSD and never looked back. I would never use an OS that depends so much on corporate greed like pfsense. Tried pfsense, opnsense, Linux and OpenBSD. OpenBSD had everything I needed in the default installation, is the most secure of those by default, with the smallest attack surface and most independent, with very easy updates. I almost forgot how to use OpenBSD since installation, as it is maintenance free for me. I log in once in a while to check the logs and system parameters just in case, but that’s it. Documentation is quite good, online guides are excellent and tools available in the default installation are the ones that make the most sense to me.

[@DigitalMirrorComputing]

It's because of videos like this, that this channel is one of my favourites on KZbin and it has also inspired me to start my own KZbin channel this year! I love how Tom always rises above mediocrity without ever sounding obnoxious and always provides compelling (dare I say scientific at times) data for his choices. Everyone is free to have their choices, but it's also ok to have an opinion and without being afraid to share it! Thank you for inspiring us mate and never stop doing what do!

[@ddorbuck]

Thanks Tom. Appreciate your comments

[@mihaibob7902]

Ok.. it is a bit cherry picked. The 100% more speed of wireguard in pfsense is because of BSD kernel. The same speed will be available in openSense when they go with kernel 14.x. And there are some specific improvements for pfSense Plus only, aka that is closed source, so after both are on kernel 14, if you have the pfSense plus you will have some extra speed because of the closed source code. Not defending anyone I used only pfSense but let's not sweeten the deal to much...

[@crankbrochad71]

It's definitely cherry picked, with a good dose of lying. Tom states that the wireguard speed difference is due to poor implementation. Any integrity he had left is now gone.

[@jhboricua]

@@crankbrochad71 Indeed that was a dumb thing to say.

[@MrBobbybrady]

Just tossing my two cents in for the algorithm. It was here on your channel where I learned about and got started with PFSense. I have since switched to OPNSense and prefer the interface. I'm glad we have choices and appreciate the work Netgate has put into the project and the work they have contributed to FreeBSD. I believe what soured me on PFsense was the corporate culture in their direction and the lackluster performance of their hardware. Literally, the only major issue I have ever had was from their hardware. I will say in their defense, their support was probably some of the best I have ever seen. So Let's all just be thankful for these two projects for their hard work and the great firewall software they provide. à chacun le sien

[@scottylans]

Pfsense has demonstrated horrific behaviour in regards to opnsense, spreading misinformation, hijacking domains and subreddits etc. There was a big controversy with the wire guard code too. That being said, your reasons seem sound, so if you're comfortable with them. Fair

[@espressomatic]

Former president of the US is a rapist and convicted felon. Half the US wants to see him back in office. Go figure. At least that stuff is true. The pf stuff not so much.

[@julian.morgan]

For me it's really simple I use pfsense because there are plentiful video based beginner level tutorials - there are some for OPNsense, but nothing like the same breadth and depth. Bottom line is that whether you're a home user like me or a professional network engineer my guess is that you want to spend as little time as possible fixing broken stuff, which means setting things up correctly in the first place. In my case I want to spend as little time as possible thinking about pfsense altogether!

[@slipknottin]

I chose pfsense for the same reason. Tried OPNsense a few months ago when the pc I was using for pfsense broke, but I’m not in IT, I can follow tutorials online but mostly I don’t know what I’m doing. Pfsense has far better online guides.

[@nick-dogg]

Just use what you like, the internet seems hell bent to get you to stay away from products they don’t like.

[@float_sam]

As a home user.. OPNsense is goat

[@starfoxBR77]

I second you. And I'm particularly happy with Zenarmor on it as well.

[@TheLuxeon_]

@@starfoxBR77 Same!

[@Pewpew7788]

Opnsense has a freaking API. Just that was enough for me. Sure it might not be super extensive but it's better than a wannabe API that pfsense has

[@UltralifeTech]

What are some good apps that use the API?

[@RbNetEngr]

How do you use the API?

[@MNaka-uf9yz]

@@UltralifeTech Home Assistant for instance, to monitor your hardware or fw rules...

[@Pewpew7788]

@@UltralifeTech I use curl to modify some policy based routing rules. I have a button on home assistant that when pressed will route the traffic of the chromecast through a specific country. I also use the API to perform queries to search for the IPs of different mac addresses in my network. Another one that is really useful is a script that modifies an alias to add another host. That alias is used for very specific accesses in my network. Possibilities are endless.

[@timothygibney159]

@@UltralifeTechThe issue is the build set for pfsense build process is proprietary and not updated frequently. The API means its build able

[@ranakanth]

Thanks for providing a grounded perspective on the topic!

[@linuxpirate]

Just migrated my home network off of a Firewalla box to my DIY router VM. PFsense was never considered and I’m very happy with OPNsense thus far.

[@Joel-xf9tl]

I considered going to Firewalla from Opnsense. You don’t recommend?

[@Jpeg6]

Well you got my head all in a pretzel now Tom. I used pfsense for several years, then eventually switched to opnsense recently. Those are some compelling arguments to go back to pfsense. There are certainly things I like about both pieces of software, but I also have some major issues with both as well. I think the one thing I can say for certain is there isn't a wrong choice, and its better than most home users firewalls that never get updates.

[@Prophes0r]

EDIT: Tom has good reasons but doesn't acknowledge opposing ones. :EDIT Okay...but that completely ignores the 'problem'. And ignoring it is de facto support. It doesn't really matter if Joe's Used Car Lot has the highest quality cars at the lowest price. They engage in slimy business practices that are not only bad for everyone involved, they are also bad for completely uninvolved people because the practice becomes normalized. I enjoy Chick-fil-a food, and unlike almost every other fast food chain I can even eat almost everything on their menu, but their company loudly and proudly supports some VERY bad/abusive stuff. So I don't give them my money. I don't use OPNSense because it's BETTER than PfSense. I use it because PfSense isn't a valid option for me, because they keep doing things that I refuse to support. Is it more work to do things like this? Yeah OF COURSE it is! That's why these companies/organizations are able to get away with doing bad shit. People will excuse them because they provide convenience. If you know someone is doing something shady, you are no longer a neutral party. Period. Continuing the status quo IS participation. It IS contributing to the problem.

[@TheBaldOne]

I 100% agree with you. I've been running pfsense for 5/6 years now at my home and I'm this close of shutting it all down and move to opnsense. I still have a bad taste in my mouth regarding the licensing issues, I can't really pay 140 dollars A YEAR to get the plus license. I do not need the support, I just want the updates. Heck, this is coming from a guy that bought the Lifetime plex license. I even considered buying a router from them, but not only all my hardware is rack mounted and they don't really sell a rack mounted prosumer appliance, but also for the money they're asking I can build something much more powerful.. I'll stick around until the end of the year IF a new update to the free version comes around, but probably I'm going to switch over sooner rather than later.

[@justinooms6419]

@@TheBaldOne Really? $140/yr is nothing... My biggest issue is speed via PFsense and routing using an L3 switch. IE can't do DHCP on another subnet. IE I want my internal stuff to be on my L3 switch, but it doesn't do authoritative DHCP, so some devices will not connect, and again PFSense cant do DHCP for a network it isnt managing. Odd. This has been brought to PFsenses attention over a decade ago, and they still have not implemented standard features for DHCP. At home I have 100Gbps backbone and I want to utilize that. So off to TNSR or VyOS it is and both are much more expensive.

[@rickevans7941]

Engaging with a bad actor is tacit approval of their bad acting, agreed. Have to make a principled stand but I give Tom a break here because it's not that serious and he's got a duty to his clients.

[@TheBaldOne]

​@@justinooms6419for me it is, it's not just 140 a year, it's 140 EVERY year, it's too much. I really want to support but I can't afford that every year. Slash that to 50% off or more and I'll consider paying for it just for the updates. I'm not making money with pfsense, I'm using it as my normal home router for stuff like split tunneling and firewall. I get that if I was making money creating my own appliances and slapping pfsense onto them, 140 dollars is an adequate price to pay.

[@daelra]

@@justinooms6419 $140 is nothing for a business. It can be a lot for a home user that just needs something better than the crappy router their ISP gives them.

[@pest86]

They push to bsd not because they care of opensource. All their actions starting from pf/opn split and continue up until now (with recent home licence and CE scandal) show they do not csre about open source community. The only reason to push this code is that they can use it better then anyone else

[@_clownworld]

He’s paid to have bias. Love Lawrence and his channel but this is the reality of the world.

[@39zack]

@@_clownworldno he is not 😂

[@raphaelma2976]

The reason I prefer Netgate over OPNsense: If you work with different companies, sooner or later the technician you have to collaborate with will ask which firewall you use (when you have to install a IPsec tunnel for instance). When you answer that you use OPNsense (or even pfSense) with some low-quality third-party hardware (sometimes you can't even name the hardware), you get very strange looks. This is not what you want in a professional business setting when working with other companies. For that reason, I've been using only original Netgate hardware with their pfSense for the past two years.

[@fwiler]

There's nothing pfsense could do at this point to make me want to use it. Why don't you report on their behavior, or list both sides of the isle? This video wouldn't be necessary if there weren't issues, but here we are. Even if opnsense went away I would find something else besides pfsnese. Already burned that bridge.,

[@djmcwill1010]

Happy OPNsense user here (former pfSense user), but I do appreciate you sharing this well-considered perspective. Thanks.

[@AnFr33]

I like interface of OpnSense, but i like PfSense too

[@RocketsPocket-u2r]

I gave OPN a go for a good few months shortly after the pfSense+ shenanigans.. i found it to be "okay". I found the GUI easy enough to get used to as most things are the same just a little different way around... But... Having 1Gbit PPPoE fibre i was strugglung to get over 650mbps up or down with OPN, I exhuasted every possible option in the "tunables" section.. CPU was pegging at 75/85% a lot of the time and temps were way outside of my comfort zone. Moved back to pfSense CE last month and everything "just works" full speed up and down no tunables needed.. CPU now down to 5% idle with temps in the 40c area.. No faffing about.. pfSense gets the job done. Thank you for the content

[@BenState]

That sounds like a user issue to me.

[@atomycal]

Still undecided between pfSense CE and OPNsense for home use (home lab). Probably going to go with OPNsense due to the update frequency. Netgate forgot about pf CE, they're all about that flashy bling-bling now :(

[@TheBaldOne]

I'm in the same boat with a slight difference, I'm already using CE. It's been ages since the last update (I think it was last year), I'm pretty sure I'm falling behind. Every now and again I think about getting an appliance from them, but within my budget there's nothing rack mounted (obviously), and then I look at my current router and think what would I do with it.... I'll stick around with ce until the end of the year, if 2.8 isn't released by then, I'll change to opnsense.

[@LAWRENCESYSTEMS]

The last pfsense CE 2.7 update was released Dec of 2023 and 2.8.0 will be out soon.

[@atomycal]

​@@TheBaldOne I feel your pain. To me it seems like Netgate is pulling a "vmWare", they'll probably end up killing pfSense CE to "streamline and simplify their portfolio". This blinded haste for cash disgusts me to the core. Won't touch vmWare, and at this rate won't touch Netgate either. - which is funny because it might seem unimportant due to me using it "just at home", but the sentiment will carry on in my professional career.

[@jimthompson971]

@@LAWRENCESYSTEMS Tom, if you tell them this then it makes their claim of “no updates” seem like a deliberate lie. That might make them angry. 😂

[@atomycal]

​@@jimthompson971 the only problem with your statement is that I'd gladly use pfsense, if the updates would be say once per quarter. pfsense CE seems closer to a bottom priority for Netgate, than a top one. I've been around long enough to see this shift in a company's attitude towards open source, for me to embark on a journey with a platform that *may* be soon dying. (not saying it *is* dying, but the track record doesn't show me much hope)

[@anthonyyu2722]

Loving my virtualized OPNsense in Proxmox. Think I bloated it too much with Zenarmor and plugins. Computer runs a lot hotter and fan spins up a lot more than normal (after installing Zenarmor). Learning a lot from it though, breaking things and then fixing them. Great start to a sweet homelab setup. Getting more serious and involved in networking.

[@maxdiamond55]

great video Tom very informative. thanks

[@KieronConnolly]

Great video Tom, thanks

[@leesouthworth]

I like this analysis and my take away is the need to reevaluate FOSS from time to time, which often gets mist because, you know, FOSS.

[@comp20B]

Appreciate the opinion. But I love OPNSense.

[@cureheal]

Very valid points for enterprise environements. Appreciate your insights.

[@jaffarbh]

I use pfsense too on a couple of VMs, one with Ipsec VPN. There was a learning curve to optimise things (especially TCP fragmentation and offloading), but once that's done, it's working like a charm. Actually, I forgot it's there and this video's reminded me.

[@mcury85]

Almost forgot.. I use arch btw

[@nick-dogg]

I 100% agree with your opening statement. I see it a lot with other things as well, Intel and AMD is a good example.

[@fresh-thyme]

I used pfsense for sometime in my home network and I generally liked it. Its great basic firewall out of the box. However when getting into traffic inspection, IPS/IDS, etc, its not a good experience. Its UTM functions are lacking and requires 3rd party packages. For home its great but I would never recommend it in an enterprise environment.

[@magnus33john]

Both have advantages and disadvantages so it's use what works best for you. Opnsense tends to have better driver support for new hardware and pfsense has better code support. I think what hurts pfesense more then anything else is some of their behavior and the forums where it can turn sour quickly with ego's running the show at times. In many ways pfsense is its own worst enemy not opnsense and its own actions have hurt them more then anything else.

[@LAWRENCESYSTEMS]

Since pfsense has moved to FreeBSD Main they are ahead of OPNSense and now have the better driver support.

[@droknron]

@@LAWRENCESYSTEMS They were behind for two years, which caused many people (like LTT on KZbin) to switch to OPNsense to gain access to 25Gb network drivers (as an example). Whether Netgate maintains using the latest FreeBSD releases needs time, trust is earned and they've lost a lot of it over the years with their various shenanigans.

[@Szydelski]

@@LAWRENCESYSTEMSWhat does „main“ in this context means? Is it rolling release, which matures into number releases, e.g. 13.2, 14.1 etc., like Sid in the Debian?

[@magnus33john]

​@@LAWRENCESYSTEMS On the surface that would seem so since its on the newer codebase. In truth its not quite that simple since pfsense updates far slower meaning things added to the codebase can take a long time to get added pfsense. This still gives opnsense an edge when it comes to drivers for new hardware. It's unlikely pfsense is going to change its update cycle. There also the fact that opnsense shall be on 14.1 next month which well put pfsense slower in the driver area again. In the end its pick what works both are good.

[@LAWRENCESYSTEMS]

@@magnus33john That is not true either as OPNSense is not adding new drivers with their updates and since pfsense is based on FreeBSD and are the one writing the drivers they will have them first and OPNSense has to wait on back porting of features and drives. See the last two links in my forum post for more details.

[@stephenxs8354]

Love this. I have wondered this for a long time. Contributing development of FreeBSD is a great reason to support the paid version. Only thing missing is a centrally managed point...maybe host your own relay server option one day.

[@mjmeans7983]

Zero Trust Networking. Let's assume I took the time to create a 99.99% zero trust custom compile of FreeBSD by doing an offline compile of that distro entirely from source code (no pre-compiled binaries), then compiled a compiler and libraries (also from source code only), then recompiled the distro using that compiler in order to verify that every element of the original distro was 'clean' and traceable to only source code without any precompiled binaries. In that zero trust environment, can either OPNSense or pfSense CE be compiled entirely offline and only from source code without any pre-compiled binaries?

[@derekp6636]

I'm still running pfsense in the lab but a tad concerned with the future of the CE availability. I was able to get the iso without the netgate installer but not really pleased with that moving forward. I'd considered giving opnsense a shot since my needs are not very complex.

[@EricavanHellsing]

Does it really matter for a home user with very basic network, MoDem. FW box, Router, switches, NAS, a few laptops and a couple WiFi devices ?

[@nauyv]

I’m still a little oblivious to some of the “political behind the controversies on both products, but did something happen with pfsense as far as why this video is being made? I didn’t think to look into OPNSense, but I saw there was so many pfsense videos and I set up a better router for the network I’m wanting to grow in my house and so far, it’s been a learning curve, but I got it down for the most part.

[@soldierofrome5374]

Netgate the developer of pfSense very recently but the ISO download of the free Community Edition behind an online store front that you have to sign into in order to get the download now. Not sure if that’s part of the reason for this video.

[@dancalmusic]

In recent months I have evaluated the transition from pfSense to OpnSense and I have been able to observe how Netgate is more punctual and precise in its documentation. The hardware part is also better documented (the CPUs are indicated, for example, while OpnSense does not say which CPUs it installs on its devices). Furthermore, pfSense is more explicit in indicating whether certain functions are or are not supported: for example Intel QAT Crypto. I also found that OpnSense is slower in implementing features than pfSense (for example in QAT support). For this reason I calmly decided to stay with pfSense, even if I had to agree to pay for the pfSense+ version. It's not a great price to have maximum speeds with QAT and IPSec and to have better and more reassuring management of ZFS boot.

[@PedroMorenoBOS]

Excelente Tom, yes I like both, if you manage pfsense you manage opnsene. I love the GUI of OpnSense, but if someone let me chose, i go with pfsense, why? I have more experience with, simple. But if some request opnsense no problem, lets doit. At the end, the customer has the Last decisión.

[@hquest]

Free vs OpenBSD. BSD vs Linux. Mac vs Windows. Android vs iOS. iptables vs netfilter Cisco vs Juniper Cisco vs PaloAlto AMD vs Intel AMD vs NVidia Democrats vs Republicans Azure vs AWS Blondes vs Brunettes Ferrari vs McLaren Ford vs Chevrolet Dogs vs Cats And the list goes on and on and on. Glad we are living in a free society where people can make their own choices. Yet I remember our long gone past when people respected others opinion.

[@NickyNiclas]

Hypothetically, as a thought experiment, if pfSense ceased to exist, would you then choose OPNSense or something else?

[@LAWRENCESYSTEMS]

Hmm... hard to say.

[@jaypines]

it would be something else because then the fork would not have happened.

[@NickyNiclas]

@@jaypines let's say Netgate went bankrupt and shut down, would the community keep developing it as another fork or would contributors move on to OPNSense? I've personally used openWRT, tomato, edgeOS and unifi, I still haven't learned pfSense and OPNSense but I am curious what the future will bring, since the future of FreeBSD is uncertain.

[@fedefede843]

Saying 'hard to say' lead me to think there is more to the history on opnsense that is not addressed in this video?

[@NickyNiclas]

​@@fedefede843 I feel it too, which is one of the reasons I was probing (other than being genuinely curious about alternatives). But one thing I think we can all agree on is that OPNsense exists for a good reason.

[@TantissTheEmperor]

Since you first pointed out the security fixes I went from OPNSense to PFSense. And I’m content with it.

[@mkhanapathan]

It's good to see reasoned arguments and also agreeing to disagree as it should be.

[@frigidsoul69]

Thanks for taking the time to make this video Tom

[@richj946]

Thank you for the video!

[@glynnetolar4423]

I learned something valuable about 20 years ago with my experiences on a local blog I frequented.. It's not about facts or well reasoned opinions. It's all about how much crap you can stir up (they call it engagement). This means more ad revenue. Yeah, pretty much made me cynicle. I think the Internet pretty much killed reasoned thought. But then again, i could be wrong. Look where I'm posting this. Another possible form of click bait. But i admit it is hard to tell.

[@prashanthb6521]

I am a bit technically challenged w.r.t routers and networking so I cant comment on which is better. I had Pfsense earlier implemented by another person, after they left I could not make sense of it and tried OPNSense. After some circus I got it working fine. I am staying with it since it feels simple.

[@XSpImmaLion]

Yep, different situations, different requirements, and different pros and cons. I got a tiny router/PC type thing and put OPNsense in it just to experiment a bit, I have nowhere near the requirements (or knowledge) most people here have, so much so that I'm now just considering a regular Wi-fi router running a custom version of OpenWRT to do the same job. Probably in a way that I'll just understand what is happening better. It's like, right after I got this whole project going, I got myself a portable access point, started using it, and realized how much you can already do with OpenWRT alone. So I'm kinda scaling back, and then I'll use the tiny PC for something else. Different needs.

[@alzarpomario889]

OPNsense user at home and at work, never let me down, we even converted old checkpoint FWs to OPNsense and they never failed an update or suffered slowdowns. But I sometimes ask myself if BSD is really so much better for a FW OS...I would really love to see a pf/opnsense like FW OS based on linux. It would become the final boss, with easy virtualization through containers tha could offer features like FortiOS vdoms.

[@jainayrogeorge2924]

Great video Tom

[@dyeffsondorsaint6149]

the reason pfsense wiregaurd is faster was it was on freebsd 14 opnsense just moved to freebsd 14 we need to rerun the benchmarks

[@Darkk6969]

Ahem... pfsense is now on FreeBSD 15.

[@shanent5793]

​@@Darkk6969There is no FreeBSD 15. The latest release is 14.1

[@jhboricua]

@@Darkk6969 Which has not been released yet. Which begs the question why Netgate is using a bleeding edge codebase that is in constant development on a firewall device.

[@grtitann7425]

You are bias to PF, we get it. What I don't get is why the need for these hit pieces against OPNsense. Because this is not the first time you have done this .

[@aridhol22]

Next up, why I don't use proxmox #27

[@Traumatree]

It is quite simple: you can't really use OPNsense in a professional context with real businesses. You have no major players backing it, and if you are stuck, it is probably the pfSense guys that will help you in the end...

[@LAWRENCESYSTEMS]

As I said in the video, people leave comments on every pfsense video I do ask me why I don't make opnsense videos. And now this is my reply.

[@grtitann7425]

@@Traumatree clearly you haven't even bothered in visiting their site and look into their commercial support area plus their own hardware store. But it's ok.

[@grtitann7425]

@@LAWRENCESYSTEMS This is not the first time that you have created such a video with the same theme and reason. You also know better than needing to justify your actions to anyone on the Internet. So this extra effort in making OPNsense look inferior is sus.

[@ghost6813]

I personally prefer a plain Linux distro. You get better hardware compatibility and typically better performance, and you can run other software on the same hardware like game servers without having to virtualize anything (and increase latency). I get close to 20Gpbs of routing performance out of an old i7 that used to be in my gaming PC as measured by iperf3, that's close to saturating my SPF28 network card. I can copy multi-GB files almost instantly. Unless you really need a UI I don't see the point of any of these firewall distros over a plain Linux distro for firewall, routing, DHCP, DNS or software access points.

[@koijoijoe]

Tom, the intro confuses me. Are you saying I do NOT have to use Arch Linux? One thing I was wondering being new and not getting started with any of these firewalls yet, I saw you guys were talking about pfsense having third party plug-ins for some things, one of them being automatic updates, is that something you trust installing and using for your clients as a professional in the space?

[@timothygibney159]

Pfsense and opnsense run on FreeBSD Unix. They are whole images. I use them for virtual routers and switches on hyper-v and kvm with libvirt to set up labs to mimick work stuff or exams. You can use both on old pcs for home routers or buy a pfsense gateway or router with it running natively as well

[@SveinWisnaes]

Just one question: What version of each are you comparing? You do not say if you compare the free version of both or a different combination. It would not be fair to compare the free version of OpenSense with the paid version of pfSense. The experience so far is that pfSense CE is VERY slow with updates. How does this compare to the free version of OpenSense? I am currently using pfSense, but looking hard at OpenSense. I do respect your recommendations a lot, but I just want to make sure I know what you are comparing.

[@LAWRENCESYSTEMS]

pFsense CE has faster security updates as I noted in the video. OPNSene does have more updates....

[@SveinWisnaes]

@@LAWRENCESYSTEMS Sorry to bother you again about this. But there is something I do not understand. Commits in Github does not mean much unless it results in a new version being pushed out. It looks to me that as of today, the latest version of pfSense CE is dated Dec 7, 2023. And the latest OpenSense version is dated May 29, 2024. To me, this looks like OpenSense can be a few months slower to commit than pfSense and still be faster as the releases are more frequent. Is my logic sound? Unless you compile pfSense yourself 🙂But I guess the majority just click update in the web interface when something new is available.

[@LAWRENCESYSTEMS]

Updates for the sake of updates doesn't make much sense to me

[@SveinWisnaes]

@@LAWRENCESYSTEMS Agreed. So you say that what is in the changelog of OpenSense is just for show and not real?

[@-Good4Y0u]

As bad as that Netgate situation was, I will say TAC is great and their enterprise support is very good. Both are good and to be honest I hope both do very well so people have options. Including myself

[@barneybarney3982]

idk for most stuff this opnsense vs pfsense is like fedora vs rocky. For the majority of cases they are the same, for some cases one is slightly better, but it doesn't make any of them better overall. i used both, both are basically the same for an average user. PPPoE was a bit worse on pfsense ( still way better than on microtik), now im on opnsense mainly because gui is more intuitive for me.

[@dsptchr]

Why is it not possible to define static leases WITHIN a DHCP range in OPNsense? Like, I don't understand, even the Windows DHCP Server does this and so do literally ALL other dhcpservices I know of.

[@appk5884]

I use OPN for their fair, short licensing terms and simple UI

[@LackofFaithify]

If you don't use VIM, your soul will burn for all eternity. This is a fact, don't be mad at me for telling the truth. /s Figured this video would need a non--pfsense/opensense joke to relieve tensions.

[@Thiccolo]

I am totally new to all of this, I was trying to setup a HomeLab on Hyper-V and could not get the ISO installer to work, all of the guides I see online dont go over this new ISO installer.

[@pvalpha]

I'm fortunate that in my home lab I have enough resources to play with both opnsense and pfsense ce in my environment. I use pfsense as my primary firewall router though because there are a number of features that work better than what opnsense offers at this time. While I do like the opnsense UI and interface systems better, PFSense has been a workhorse and keeps on doing things *better* for my use case. That can change if the features come over - which is why I keep an eye on opnsense. I've got no desire to stick with something just *because*. But I do have to see that I'm getting more with one than the other and all my decisions are based around that.

[@wojtek-33]

The GUI is what does it for me. I have tried, but that pfsense interface just doesn't work for me at all.

[@Amator_Phasma]

I use both :>

[@davidjwillems]

Your hair looks so pretty.

[@GlassDeviant]

So now that Netgate requires an account to -sell your personal data- download pfsense, are you still dead set against using OPNSense?

[@LAWRENCESYSTEMS]

OPNSense is still lagging behind in security, so yes.

[@GlassDeviant]

@@LAWRENCESYSTEMS Thanks for the response.

[@adancalderon8915]

Thanks for the video

[@oleksandrlytvyn532]

I believe there will still be plenty of people in the coming years who will "bash" other peoples over different text editors, pfsense/opensense, Linux distribution etc etc etc. For some reason some people think that if they use software X and other people use software Y - users of software X feel somewhat the need to go and to leave comments in other peoples videos or posts. Not sure why this is happening but it is a different topic

[@Mindflayer86]

4:07 Spon*s*ored 7:28 pfs*ne*se Did a dyslexic write this article?

[@TheFuzzyAmerican]

I gave up on the whole vpn thing and switched to splash top,makes it easier to remote into my home servers and network vs the vpn confusion on opnsense

[@Shocker99]

Why is your intro/outro music very much louder than the rest of the video?

[@LAWRENCESYSTEMS]

They don't sound that much different to me

[@Shocker99]

@@LAWRENCESYSTEMS I've just re-listened to the final minute of the video and i stand by my comment. To me the outro is significantly louder than the minute before it. And my bad, you don't have an intro, which is good; straight into the meat of the topic.

[@bober1019]

pfsense now has a package for patches in package manager..been like at least 6 months now

[@josephp1592]

Same, still running pf. Was never a fan of the OPNsense UI either

[@DaveHamdon]

I was using PFSense right around the time of Netgate holding OPNSense domain. Wireguard fiasco. Very immature. Regardless of there support for the OS, they don't deserve my support. After the flair up I switched. Will never switch back.

[@antaishizuku]

Sadly there was a dns bug that hasn't been fixed in years and i had to rebuild pfsense every 6-ish months. I kinda gave up on pfsense as much as i like parts of it over opnsense.

[@LAWRENCESYSTEMS]

We maintain many instances I have no idea what bug you're talking about

[@antaishizuku]

@LAWRENCESYSTEMS with pfblocker there is a weird bug that causes dns to drop. The dev of pfblocker talked about it years ago and how its an issue in pfsense itself or something. You cant use service watchdog because pfblocker has a special script to handle dns reloads. If service watchdog tried to start dns in the middle of a update it would be bad but apparently pfblocker has internal handling so i traced the code and pulled the function that should be safe. It worked for years pretty well as a small custom script addon with cron.

[@shanent5793]

Are the enchantments effective? Do they work better than runes, crystals, or blood sacrifice?

[@charlesholliday9112]

I started immediately looking for this comment specifically. Thank you.

[@BertramJoseph]

@@charlesholliday9112 me too! haha

[@cmdr_stretchedguy]

I have 20+ years in IT and Server Admin, I've tested and used most commercial and open source networking OS and equipment. In my opinion ever since Netgate bought pfsense, their quality and stability went in the trash. Closing off the source code while basing it on open source code that cannot be closed off is borderline illegal in the US.

[@LAWRENCESYSTEMS]

You are clearly confused, Netage did not buy pfsense, they are the same people that write the code and the source is available for the pfsense CE.

[@JasonsLabVideos]

Use what you like! Thats what i say !