Where does pfSense fit into the SD-WAN market?
-
@occamsrazor How does the service cost of ZT vs TS work out for you?
I am looking for ZT support mainly for S2S links, and not mobile clients. I'm quite happy with OpenVPN for mobile clients.
The built-in Multipath support in ZT seems like it would be a killer feature for pfS.
-
@coreybrett said in Where does pfSense fit into the SD-WAN market?:
@occamsrazor How does the service cost of ZT vs TS work out for you?
I am just a home user, my main use is remotely managing my home router/network and family members' computers when I am away traveling. And so the free plans of each service are sufficient for my needs, which makes the cost of both work out... just fine.
@coreybrett said in Where does pfSense fit into the SD-WAN market?:
The built-in Multipath support in ZT seems like it would be a killer feature for pfS.
Wow, I hadn't heard about that. So you could for example bond a laptop connected to multiple 4G modems into a single faster link to a remote ZeroTier computer and get faster transfer speeds?
-
O occamsrazor referenced this topic on
-
@occamsrazor said in Where does pfSense fit into the SD-WAN market?:
Wow, I hadn't heard about that. So you could for example bond a laptop connected to multiple 4G modems into a single faster link to a remote ZeroTier computer and get faster transfer speeds?
Yes - https://docs.zerotier.com/zerotier/multipath/
They have several modes Active/Active, Active/Backup and so on. That's why I think it would be such a great fit for mesh style S2S links. I have 10 sites that I could connect together with one ZT network / interface per router. That would replace a mess of OpenVPN links.
-
@harvy66 said in Where does pfSense fit into the SD-WAN market?:
Sounds more and more like "SD-WAN" is about a network that can dynamically change routing to min/max certain characteristics possibly based on conditions. This would require coordination among many routing devices to make sure the rules are honored.
It is exactly what I was finding out about it.
Main of SD-WAN
ZeroTier , netFlow and openFlow are the main points if
it goes to SD-WAN market and many big payers will be
chime in, as it looks like now and let us say some years
backwards, because some networks will growing fast
and become unending big or huge.Connectivity Parts
Tinc, Stunnel and Tailscale will be one more part either for network internal and /or external connections.Additional parts
Grafana, mono logtash and Elastic will be also nice on top
to view and see the entire network or parts of them and
what is going or more how it is going.This are now the parts without much more and more manpower on the need and/or "setting it up manually"
Not really a part of SD-WAN but also network based
and not unimportant (behind the scene let us call it)
PRTG and something such or like Netgears NMS300
will be then together from older days you think but for
it comes all together and is enriching the other one(s)
and play nice together with them all.This is the part with more or the normal manpower
for the entire network.It all depends more on the needs, dimensions and
your own which`s or the companies capabilities.Now lets see what can be pointed to pfSense according to the main question of this thread I mean.
I would not call it SD-WAN ready, but here and there it
is "on its way" regarding the following points;softflowd is able to add
Monitoring with (grafana logstash mono elk stack
kibana prometheus) is not pfSense internal based.tinc, stunnel and Tailscale are there, OpenVPN, WG
and IPSec are also on board.So openFlow and netFlow might be the both entire
important parts here as I see it. -
I would also love to see a central management feature added to pfSense. Managing my 10 units from a central control panel would be amazing. That would save me the hassle of maintaining DDNS and LE ACME across all 10 units (for 3 wans on each). Also sharing alias tables and firewall rules across all of them would be pretty cool. I would think some basic monitoring could be done as well.
I think Netgate has talked about such a product in the past, but I'm not sure if TNSR has changed the plans for pfS.
-
I've just received the hardware for a SW-WAN service. It looks like a rebadged SG-5100 and this triggers me a little as it will sit next to my own SG-5100 as an extra single point of failure!
-
@johnpoz said in Where does pfSense fit into the SD-WAN market?:
It gives any Joe the ability to think they know networking
hahaha - good one..
I can top that. A few years ago, one customer thought she knew more about networks than I did, because her husband had read some magazines. She was upset because I had connected my computer to the switch with CAT5 cable, after we had run in CAT6. She thought it would slow everything down!
-
@pimpmyrouter said in Where does pfSense fit into the SD-WAN market?:
I've just received the hardware for a SW-WAN service. It looks like a rebadged SG-5100 and this triggers me a little as it will sit next to my own SG-5100 as an extra single point of failure!
We're not an OEM so that is likely from our partner Lanner.
-
Having had a SD-WAN service for 6 months, I'll summarise it...
This is a service that sits in front on my pfSense. There's one primary public facing IP address which the SD-WAN provider manages. We have 2x standard FTTC connections and one standby 4G connection, all feeding via modems into an aggregation box that the provider gave us, that is the same hardware as a SG-5100. Each connection could in extremis be fed into my SG-5100 with its own publicly addressable IP address if the provider fell down. Essentially, the provider tunnels all data from the primary IP address to their box over the 2 FTTC connections, doubling the max throughput for one connection to about 140mbps. There's some QoS magic but the packets just arrive.
So what we get is double the throughput (not the same as load balanced WANs which can't use both connections for the same download), failover resilience, and above all a consistent external IP address for our OpenVPN server, independently of which physical last mile connections are active.
I have no doubt it would be technically feasible to run our client end on the same SG-5100 unit under a pfSense package, and that would reduce the power consumption and potential for failure, but (a) that's unlikely, and (b) you'd still need a very redundant and resilient gateway somewhere else to create these tunnels.
So pfSense can't really compete, unless something else was running the external gateway ...such as Cloudflare Tunnels.
-
@pimpmyrouter Yep agreed.
SDWAN and Multi-WAN(with tiers) just isnt the same thing.
But i dont think pfSense is meant to be in the SD space anyway.
