PF Sense & UnTangle 1 / 2 punch

fastcon68

I just found out about UnTangle. It is one of the best products to add behind the firewall. With it set in transparent bridge mode and spam, phishing, antivirus, and others is incredible.

I am seeing virtually no spam at all now. It awesome.

RC

fribert

I gave up on unTangle, I think it's odd, pfSense might have less packages, but at least I could figure it out.

It would be nice though to have a antispam included, as well as anti-spyware / anti-virus on the webproxy.

sai

fastcon68: how have you set up your network ? whats the reliability like ?

coolcat1975

we are using an untangle in transparent mode in a production enviroment. we are really satisfied with it. we first tried pf but due to the lack of antispam/antivir we had to choose untangle.

in my test enviroment i set up a untangle and a pf on a vmware server using 5 nics (looked nice with the crossover from one nic to the other and the other 3 nics) for all interfaces. well it was running, but the hosts hardware was a little bit to weak to satisfie me,but: it worked. one issue occurded on untangle was, that the untangle had to use the official ip cause with a private ip on it and the public on pf, untangle didnt see any traffic.

regards

cc

fastcon68

It's been running like a champ. I actually have had a increase in performance. I try to give a simple overview of my network.

DSL with fixed IP connects to PFSENSE firewall
Crossover to UnTangle in
UnTangle out connects to Dell GB switch
All other devices connect to Dell GB switch
1 clone
1 nas
1 compaq server
1 linksys wirless switch
1 play station2
1 Dish Network DVR
2 laptops via wirless

I am seeing over 4000 spam messages blocked. I need to do some fine tunning but it works great
RC

fribert

@fastcon68:

DSL with fixed IP connects to PFSENSE firewall
Crossover to UnTangle in
UnTangle out connects to Dell GB switch
All other devices connect to Dell GB switch

Ok, so two dedicated machines, I tried untangle, as I thought it was a firewall, but this use makes much more sense,I'm contemplating creating an unTangle here, I'm just a bit worried about the amount of boxes here, just for access secutiry.

I would very much like an 'all-in-one' box, a bit like Astaro, but without the limitations.

fastcon68

The untangle server offers abunch of features that are not avaiable in PFSense. The PFSense server offeres a lot of features that untangle does not. I would rather use a combination of boxes and get the best of both worlds. I work with medium and small companies. They need this type of combination. I have reduced my spam alone by 4000/5000 messages a week.

RC

sai

@fribert:

Ok, so two dedicated machines, I tried untangle, as I thought it was a firewall, but this use makes much more sense,I'm contemplating creating an unTangle here, I'm just a bit worried about the amount of boxes here, just for access secutiry.

I would very much like an 'all-in-one' box, a bit like Astaro, but without the limitations.

separate boxes are much much better in terms of security. less complexity, less chances of the various software messing with each other.

fastcon68

i agree with sai comments there.
RC

jle2005

Is Untangle free also?

fastcon68

They have 1 main program with 2 feature sets. Most are free but some have paided costs. the site is http://www.untangle.com

I actual found it while reviewing the latest verision of M0n0wall. It was a ad on their site. It looked promising and it filled a very specific need I had. So I tried it.

It's working very well.
RC

ssampier

Thought about doing exactly that. I have Gigabit connectivity into my building with about 25 nodes. I will need a fairly robust (extremely modest by most company standards) PFsense and Untangle boxes; the Untangle hardware support isn't quite what I would like, however. The forums indicate the newer kernel should be out soon. Or I could just buy one of those Untangle appliances they sell.

fastcon68

I am trying to build a really cool product. I want to get one of the 1u cases that will handle two mini-itx system boards and then run pfsense on one and untagle on the other. that would be a great product and would fill a nice void in the market right now.
RC

hoba

@fastcon68:

I am trying to build a really cool product. I want to get one of the 1u cases that will handle two mini-itx system boards and then run pfsense on one and untagle on the other. that would be a great product and would fill a nice void in the market right now.
RC

Get one from our recommended vendors ;) http://linitx.com/viewproduct.php?prodid=10404

leviathan

I use this same setup at my organization. I have one pfSense firewall doing everything I need (pfSense is, by far, a better firewall), but the Untangle does a fantastic job in transparent bridge mode of filtering spam, phishing, virus, etc. you would expect from an UTM. Currently, we run them as separate boxes for our two networks being feed from our one pfSense firewall. We were being overloaded with e-mail, but when I brought the Untangle unit online, we began filtering over 20,000 pieces of junk mail a week. I agree with fastcon68, this is a fantastic design for any small or medium network. In my consulting, I recommend them together for growing businesses. Thanks to hoba, I now have a 1U unit that I can recommend to do both. I also am going to pick one up for our two networks, so I can save some rack space.

fastcon68

Anything in the US case wise? what would you recommend for a system board with say 10 ipsec vpn tunnels?
RC

pinoyboy

Can you guys please explain or give an example of how you have this setup as transparent bridge? I guess what I am not clear on is how you set the ip's up. Thank you.

Sample.gif_thumb

marcoof

Hi !
Untangle seems to be great ! It have a vpn portal… But I prefer two box to do this,
1 pfsense for the firewall and one sme server for the mail (spamassasin /clamav) / proxy (dansguardian) /lamp / server.
This is my opinion.
Marc

Guest

Been messing around with untangle on my homenetwork(not really need but..)
how have you solved the vlan problem with untangle, i cant have vlan configured on pfsense at the same time

what´s your config on this?

/F

YeOldeStonecat

@pinoyboy:

Can you guys please explain or give an example of how you have this setup as transparent bridge? I guess what I am not clear on is how you set the ip's up. Thank you.

During the install/setup of Untangle…the wizard will ask you what mode you will run it in..as your router, or as a bridge. Select bridge. You use both NICs..but during this wizard, it bridges in the internal NIC with the external NIC.

See 1/2 down this part of their WiKi
http://wiki.untangle.com/index.php/Introduction#Supported_Configurations

It's a UTM distro (Unified Threat Management), would be compared against Endian, or IPCop with the Copfilter add-on, or Astaro..as they are UTM distros. PFSense is not one.

I install Untangle at my clients in full router/gateway mode...not bridged, I'm not a fan of layering firewalls. I run PFSense at home due to its superior traffic shaping/QoS, and IPSec support..which currently...Untangle has no IPSec support, only OpenVPN. But...IPSec support is comin soon. As well as the slow pokey java management console is going away, soon will be all web based.