State of the Union (in pfSense land) - Opinions?

Cool_Corona

Basically I am looking in other directions right now for our production environments.

For the very reason we havent implemented IPv6 as of yet.

Traffic monitoring and reporting to clients is a hazzle and in this modern age we should have a dashboard that can show clients realtime where and how they are attacked based on the logs from Snort or Suricata.

A basic VPN tunnel. Site 2 site. Is a MAJOR hazzle in pfsense. I have started to use RRAS for the same reason. Basic setup and it works like a charm. I gave up on pfsense in regards to VPN.

fireodo

@cool_corona said in State of the Union (in pfSense land) - Opinions?:

in this modern age we should have a dashboard that can show clients realtime where and how they are attacked based on the logs from Snort or Suricata.

This is a Feature I'd like to see/have too

stephenw10

@cool_corona said in State of the Union (in pfSense land) - Opinions?:

A basic VPN tunnel. Site 2 site. Is a MAJOR hazzle in pfsense.

Hmm, well I'd struggle to see that. I must have set up thousands of site-to-site VPNs and the vast majority of time it just works without any significant hassle. That's using any of the available VPN technologies.
What is the 'major hassle' you're seeing there? Obviously if we can make it easier we would like to.

Steve

keyser

@stephenw10 said in State of the Union (in pfSense land) - Opinions?:

@cool_corona said in State of the Union (in pfSense land) - Opinions?:

A basic VPN tunnel. Site 2 site. Is a MAJOR hazzle in pfsense.

Hmm, well I'd struggle to see that. I must have set up thousands of site-to-site VPNs and the vast majority of time it just works without any significant hassle. That's using any of the available VPN technologies.
What is the 'major hassle' you're seeing there? Obviously if we can make it easier we would like to.

Steve

I agree with Steven here. S2S is fairly simple (As simple as Generic IPSec can be - its no Wireguard :-)).

For me the issue is with Mobile User IPSec and the very limited user/firewall rules control it offers.
I recently found a way to hack the pfSense scripts so it actually supports grouping of users to specific IP Pools (Allows you to create firewall rules pr. group). But the fact this never worked natively is a VERY good example of a "dead" area in pfSense. How can something SO basic not have been supported for at least the last decade? IPSec VPN is after all the only VPN client built in to almost all OSs, so a MAJOR hassle with OpenVPN client management could have been avoided.

NogBadTheBad

@keyser said in [State of the Union (in pfSense land) - Opinions?]

For me the issue is with Mobile User IPSec and the very limited user/firewall rules control it offers.

Have you tried using FreeRadius and Framed-IP ?

"andy" Cleartext-Password := "XXXXXXXXXX", Simultaneous-Use := "1", Expiration := "Apr 11 2027", NAS-Identifier == strongSwan 

	Framed-IP-Address = 172.16.8.2,
	Framed-IP-Netmask = 255.255.255.0,
	Framed-Route = "0.0.0.0/0 172.16.8.1 1

mcury

@nogbadthebad Indeed, freeradius works perfectly..
Using freeradius for authorization and accounting. LDAP for authentication.

#start pfsense GUI
         if (LDAP-Group == "pfsense_admins" && NAS-Identifier == "webConfigurator-pfsense.home.arpa") {
         update  {
                 reply:Class := "pfsense_admins"
         }
                noop
        }
#end pfsense GUI
#start WIFI WPA-2 Enterprise   
        if (LDAP-Group == "wireless_users" && NAS-IP-Address == "192.168.199.3") {
         update  {
                 Simultaneous-Use := "1"
                 control:Max-Daily-Session := "7200"
         }
                noop
dailycounter
        }
#end WIFI WPA2 Enterprise
#IPSec road warrior static IP for AD_USER
        if (&control:LDAP-UserDN =~ /cn=AD_USER,cn=users,dc=home,dc=arpa$/i && NAS-Port-Id == "con-mobile") {
         update  {
                 reply:Class := "pfsense_admins"
                 reply:Framed-IP-Address := "172.16.98.100"
                 reply:Framed-Netmask := "255.255.255.0"
         }
                noop
        }
        elsif (LDAP-Group == "vpn_access" && NAS-Port-Id == "con-mobile") {
          update {
              reply:Class := "vpn_access"
        }
                noop
        }
#end IPSec road warrior VPN

keyser

@nogbadthebad said in State of the Union (in pfSense land) - Opinions?:

@keyser said in [State of the Union (in pfSense land) - Opinions?]

For me the issue is with Mobile User IPSec and the very limited user/firewall rules control it offers.

Have you tried using FreeRadius and Framed-IP ?

Yes I have and Windows NPS as well, but like I wrote in the initial post, it doesn’t scale. (EDIT: Sorry, I wrote that in some of my several other posts on the subject)
Some of my customers have several hundred users - some thousands. You cannot assign static IP’s to all those users. You need them to be assigned to a specific IP range/subnet based on group memebership determined by the Radius authentication source (Active Directory or some other LDAP). That way you create firewall rules for IP ranges/subnets - which in effect is rules for a group of users.

aduzsardi

@keyser
I think at some point pfSense people will need to acknowledge that using freebsd as base os is not the best option.
The development is very slow, from what i've read the networking stack is vastly inferior to Linux (yeah, i know ... some feeling will be hurt), needless to say anything about drivers and hardware compatibility

Hard to say where this project is headed but there are not a lot of choices if you're not willing to pay a monthly/yearly subscription or license + hardware cost for a commercial firewall appliance.

keyser

@aduzsardi said in State of the Union (in pfSense land) - Opinions?:

@keyser
I think at some point pfSense people will need to acknowledge that using freebsd as base os is not the best option.
The development is very slow, from what i've read the networking stack is vastly inferior to Linux (yeah, i know ... some feeling will be hurt), needless to say anything about drivers and hardware compatibility

Hard to say where this project is headed but there are not a lot of choices if you're not willing to pay a monthly/yearly subscription or license + hardware cost for a commercial firewall appliance.

I agree with parts of your post insofar that drivers and ports for a “small” platform as FreeBSD obviously is an issue.
But I suspect the integration between the GUI, services and pffilter parts are far to tight to ever see it migrate to a linux flavor OS.

I do however feel that the situation is a bit the hen and eeg problem. PfSense/Netgate is missing customers because there are to many underdeveloped parts that prevents popularity.
Corona and working from home was a great example. I dunno how many VPN bokses/routers where commisioned during that period, but pfSense was of very little help because, as a company you could not do basic user separation, unless you subscribed to the hassle of OpenVPN client distribution and configuration.
The ONLY VPN client that is easier to use than Cisco/Fortinet level clients are the OS native ones - which you cannot use in pfSense @ scale/ease - which is what companies are looking for.

Just for the record, My customers - and I - are only using official Netgate Hardware and pfSense+.
But I know developer ressources is the major issue here, so we just have to manage.

aduzsardi

@keyser
We are using the 7100 model, but we don't have a lot of users , i think probably around 80, and not everybody needs VPN in my situation.
But even so, i started to separate sevices to their own boxes and manage them separately using APIs or custom scripts.

not sure if we'll continue using pfSense on the long run, there are talks about getting one of those NGFW appliances

psp

@keyser said in State of the Union (in pfSense land) - Opinions?:

The ONLY VPN client that is easier to use than Cisco/Fortinet level clients are the OS native ones

Right. I'm using pfSense in all our subsidiary, but to properly handle all our road warriors VPNs I had to setup Softether as a concentrator. All users are simply required to configure their native L2TP/IPSec clients.

Cool_Corona

Instead of moving on to new versions now and then, patch the running ones like 2.5.2.

Fix the monitoring, reporting and VPN parts. Make them useful and modern.

Its like Windows 10. Its patched all the time. Windows 11 have arrived but 10 is still patched.

If you upgraded to 2.6.0 youre stuck with errors and VLAN performing bad unless you run a script when the damn thing boots or disable RSC. Imagine needing to turn of your headlights to get the heating working in the car during winter....

If the goal is to create an alternative to Palo Alto or any of the larger brands then pfsense are lightyears behind.

If the goal is just to be geeks and have fun then pls. continue. But the user base will sip away slowly....

keyser

@psp said in State of the Union (in pfSense land) - Opinions?:

@keyser said in State of the Union (in pfSense land) - Opinions?:

The ONLY VPN client that is easier to use than Cisco/Fortinet level clients are the OS native ones

Right. I'm using pfSense in all our subsidiary, but to properly handle all our road warriors VPNs I had to setup Softether as a concentrator. All users are simply required to configure their native L2TP/IPSec clients.

I understand - but for the record I have now created a simple hack to pfSense, that allows you to use the IPSec Mobile User VPN with group based authentication and group based IP Pools (Firewall rules for group of users).
It works with the OS native VPN client on all the major client OSs, and a feature pfSense has been lacking for FAR FAR FAR to long.
It works beautifully at a costumer with about 500 Mobile VPN Users :-)

I have created a redmine request to have it fixed in coming releases, but since it’s beyond my skills to create/edit the code myself and create a proper Pull Request, I fear it won’t happen.
But it’s simple to do, so I will just rehack the install at every version upgrade.

keyser

@cool_corona I hear you, but the point of my post is not that pfSense is generally useless/pointless.

I think it’s a great - really great product - that just suffers some “black holes” in features/fixes. So my point of the post is not to create a complaint thread - I would prefer we actually ended up commending the developers for the hard work they do.
I am pretty happy overall with pfSense and think they deserve a lot a credit - A LOT :-)

I would like this thread to revolve around what we can do to have pfSense “pick up” on the missing/dead feature ends it has. Any ideas?

Creating redmine requests seems to have little effect unless it’s a bug or you can create the codeedits yourself and actually make a pull request.
This forum is more or less dead in the areas where the functionality have been missing for years - a good indication of my point - so posting here has equally little effect.
There’s even quite a few posts that very heavily attempts to persuade users that those features are not needed, and they should actively try and do something else/use workarounds.

Perhaps a voting system with some kind of “product manager” that actively seeks out posts/threads that actually makes a good point for a feature/fix? The product manager could then clean up and formalize it as a feature request that could be voted on for popularity?

aduzsardi

@keyser
so what do you think we should do to have a more active development commitment from Netgate ?
I'm a systems administrator , not sure what or how could i help in the development area since i don't know anything about software development, otherwise i would gladly help in any way i can.

keyser

@aduzsardi said in State of the Union (in pfSense land) - Opinions?:

@keyser
so what do you think we should do to have a more active development commitment from Netgate ?
I'm a systems administrator , not sure what or how could i help in the development area since i don't know anything about software development, otherwise i would gladly help in any way i can.

Yeah that is the question - I'm in the same situation as you, and would also like to help.
PfSense really is a very very good and easy to use product, with the most intuitive GUI of all the Firewalls I have ever worked with. But there are these feature caveats.

The most problematic thing is probably "turning things around" for the dead branches of pfSense.
It will first require some development to actually bring it to a working and dependable state.
Then it will take a lot of time for users/the world to actually start using and believing in those features again on pfSense.

My experience is that Netgate/pfSense have improved on their communication skills, but they are still very hard to get out of the bushes. So the first point on the agenda would be to get them to talk about how we can help.
I have no insights into how they select what to fix/change/add to pfSense, but it seems to me that process is broken, because of the heavy focus on parts of the product and complete negligence of other parts. I'm not even arguing for new major features - just more feature completeness in the already included services.
22.05 is at the brink of release, but that seems to be bug fixes/security updates only, so that's not going to change any of the dead areas.

Perhaps persuade them to do a focused next release that aims to make already included services in pfSense more fully functional/dependable across platforms?

gabacho4

So quick question for the group here as I’ve wanted to know this for some time. You compare pfsense to other commercial products but how many of you are actually using it on Netgate hardware (PfSense+) or paying for a license/support plan versus using the CE version?

Development requires people and people require payment. It’s entirely possible that the things you want are valid but Netgate’s paying customers aren’t asking for it. If paying customers are making these requests, I wonder if the number who have made that request is large enough for Netgate to dedicate resources/money to? If large enough, Netgate should justify why they are ignoring that need. But first and foremost, you can’t compare free PfSense (CE) with very much not free alternatives.

I’m not a troll. I’m not affiliated with Netgate. I am a former CE user who went to Netgate hardware to help support the company and development. I’ve seen so much entitlement expressed since the announcement for Plus was made, by people who seem to forget that nothing in life is truly free (one way or another it has a cost), that I’ve struggled to see where the line between ungrateful whiners, and those who are actually contributing to the longevity of the product, lies.

Edit: not accusing anyone in this thread of being a whiner. Just asking an earnest question and expressing my observations.

Cool_Corona

@gabacho4 But if a product lacks the basic things, would you pay for it or look elsewhere?

First and formost, you deliver a solid and modern product with a little to no issues. Thats the basic requirement nowadays.

When things like VPN, reporting and monitoring is a hazzle, then people are hesitent to pay. Because they are not promised to get it done. as @keyser mentioned... it has been dormant for years.

Thats what bounties are for. Get a package going. Like pfblocker in the early with Marcello, snort and suricata with @bmeeks asf.

If you eliminated Snort, Suricata, zeek and pfblocker, what would make pfsense a great FW??

Exactly. :)

aduzsardi

@gabacho4
why do you assume that the people who are requesting these bug fixes/feature completeness are not running pfSense on netgate hardware ?

I think @keyser stated above that he is a paying customer with fairly large organizations. I'm also using netgate hardware as i stated a few replies above. And probably others as well. Anyway, it's not like anybody is asking for outrageous things ... mostly bug fixing and feature completeness for the features that are already included in pfSense.

gabacho4

@cool_corona I would agree with you. I think with the new business model and some time, we might start to see some movement on some of these issues. I think the previous model of pretty much 100% free unless you wanted to donate to Netgate definitely had an impact. I do find the argument that Palo Alto or Cisco or a namedPaidService can do X or Y better to be a dead one. Have fun paying an arm and a leg for all the licenses just to get the basic functionality that pfsense offers, let alone the extras.

I also think Netgate could do a better job being transparent about things they are working on or intend to implement and perhaps engage their user base more. The redmine shows issues being worked but I’ve seen it mentioned a few times that they have an internal “to do” list with Plus. Understand their need to keep new and exciting developments under wraps until they can excitedly announce them, but don’t see a reason that they can’t come out and say “your desire for request/feature X has been heard and is being worked on” or something to that extent. And of course, they can also just tell us when there’s no chance in hell. Reminds me of the much wanted and long broken UPnP and multiple game consoles issue they just got fixed. The hold up? They didn’t have any consoles to replicate the issue with and troubleshoot. To the user, it seemed they were hopelessly unable to do what a cheap D-link can do, while all the while they just lacked the gear or data to fix things. So yeah, I get where you’re coming from.

I wish I had development skills so that I could help kickstart things I would like to see advance. Like others have said, I don’t know how I can actively help contribute without those skills in hand.