What do you run; Opnsense, pfsense, Smoothwall, maybe a WAF like wazuh?
Today was update/audit firewall day. I’m running a standalone instance of pFsense on a Protectli Vault FW4B - 4 Port - Intel Quad Core - 8GB RAM - 120GB mSATA SSD with unbound, pfBlockerNG, Suricata, ntopng, and heavily filtered. I did bump the swap to 8 GB as I’ve previously noticed a few ‘out of swap’ errors under load.
Before I signed off, I ran it through a couple porn sites to see if my adblocking strategy was working. Not one intrusive ad. Sweet!
Show me what you got.
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 124 users / day
- 1.05K users / week
- 1.3K users / month
- 4.58K users / 6 months
- 1 subscriber
- 4.19K Posts
- 106K Comments
- Modlog
OpenWRT.
Opnsense with unbound DNS here. Running on an old PC that got converted to dedicated firewall (with added NIC card for ports). Nothing crazy, just enough to control what communicates out of my network.
nftables. Deny all, start adding stuff until þings work.
My firewalls are simple, b/c I run a private VPN and just shut off all traffic except over WG. I’ve got one exposed VPS reverse proxying services from oþer VPSes over WG.
But: nftables, and only nftables. I’m a big believer in understanding how stuff works, and þe rulesets created by firewalld and ilk are convoluted - complexity adds risk.
Rock on!
Opnsense on protectlii. Nothing but love.
I love my Protectli. I tried Opnsense. Seemed to be a well put together piece of open source software by people really who care. There’s nothing wrong with it. Does what it says on the tin. I guess I just liked the flow of pFsense. They both acomplish the same thing. I am aware of the pro’s and the cons of each. pFsense just appealed to me more.
My firewall varies from installation-to-installation, as it’s always client-side with a custom DNS provider. Right now, I’m using YaST Firewall on my main machine, iptables on my old ThinkPad, and my other machines are currently between operating systems. In the past, I have also dabbled in ufw, pf, and awall.
In addition to that, I generally use NextDNS (though I also get excellent results with Mullvad DNS).
My policy is simple: reject all incoming connections, except for Torrent and Syncthing.
I hear a lot of good things about NextDNS.
Do you call your network Virgin, because that’s pretty tight.
Opnsense on dedicated device, several built in filters + several github backed filters for unbounddns.
Haven’t tested it heavily, but the times I am on an outside network not using VPN into my network, or using TOR, etc, i am inundated with ads… So i guess successful internally.
I swear I do not know how the regular Joe Schmoe internet user deals with all that clutter. Sometimes I am called by a friend to look at their computer for some issue they are having. It is mind bogglingly frustrating for me.
I run iptables on Debian, on a cheap aliexpress minipc with dual NICs. Been using more or less the same config for about five years. It’s simple, boring, and works great.
One cannot quibble with long term success. Admitidly tho, I am a sucker for a good UI. One of the first things I do when researching a piece of opensource software is to do an image search to see what it looks like. LOL
Same. Immeasurably disappointed whenever the repo for a GUI program does not include any screenshots.
We’re behind our firewalls of course 😋 I’m using a random no root android firewall but I’m probably just going to root it and use something good
OpenBSD pf
Edit: just home/hobby now, I’m not in tech anymore.
I’d never heard of it so I went and checked it out. It seems to have a lot of pFsense/Opnsense features just managed from the cli. Cool.
It’s the ‘pf’ in pfSense.
pf is developed as part of the OpenBSD project and is the built in packet filter/firewall.
Also this. On some unremarkable HP office PC that’s probably about a decade old. No ad filtering or anything as it interferes with others in the house. I’ve thought about trying a second unbound service with adblocking for me, but haven’t gotten around to it.
Pfsense with pfblocker in a VM. Works wonders. Pipe fail2ban to pfblocker for extra goodness.
The thought has crossed my mind on several occasions. If you don’t mind me asking and take up your time, how do you integrate f2b with pFsense? I’m running f2b on several VPS I have, and it just downright works. So, my thought was, what would f2b do to enhance pFsense’s capabilities, and how would you make that all homogenate?
Been a while since I set it up but as I recall it’s a 5-minute from job that runs a command that just dumps the pf block list fail2ban manages into a text file in my public_html directory. Then I just add a feed in pfblocker with the address of the text file and it loads from that feed.