Does pfSense frequently change core features with its releases?
-
Hi,
I'm looking into pfSense as a person who doesn't have much free time on my hands. I'm looking for a "set and forget" type of setup where I would be able to install security updates that don't change core features of the firewall that much once everything is initially setup.
I like that there are a lot of updates in OPNsense but my recent annoyance and gripe with it is when they started changing too many core features of the firewall that resulted in me needing to redo some aspects of my setup for which I don't have time and can't keep up with all the changes due to time constraints.
Such example is the recent introduction of the new firewall rules system in OPNsense, where you now need to migrate all the firewall rules manually from the old to new feature. Once I set something in place, I like it to stay the same.
Simply saying, there are just too many core changes happening in OPNsense that I don't have time to maintain due to my limited free time that I have.
The "set and forget" to me means that once you setup everything in place, there is a minimal maintenance besides applying updates that fix issues and security vulnerabilities.
So, my question is, does pfSense do such changes frequently or do the features stay the same across updates \ releases with maybe addition of new ones being added? My other question is, does pfSense support snapshots feature?
Thanks
-
@Wallofbutter I don’t recall ever having to manually reconfigure things like that. Configuration files are usable in future versions.
Plus includes ZFS boot environments in the GUI. I believe they’re accessible via command line in CE.
-
@Wallofbutter pfSense is notorious for being slow to add features. Netgate does improve things, but it is sometimes slower than most would like.
They are also known for needing few security patches.
For upgrades I might restart my pfSense+ firewall 2 or 3 times a year. pfSense CE is a bit slower on updates, but still solid. Like you I want stable and something that does not require my time.
Give your favorite AI this prompt:
Compare security vulnerabilities between pfSense and OPNsense for the last 2 years. -
@AndyRH I know about vulnerabilities patches from Lawrence Systems forum post that because NetGate contributes code to FreeBSD, you get security patches faster in pfSense as a result of that.
-
Generally you can import any ancient config into current pfSense and it should work fine. You hardly ever need to change anything between updates in a normal install.
If you have a bunch of custom stuff configured that may require some intervention.
Sometimes we are forced to make a change at upgrade that effects some users such as when OpenVPN removes support for older encryption protocols which are no longer considered secure. In that instance we automatically selected a secure option at upgrade for users using that and alerted them in them gui. Or when a package may no longer be supported upstream and has to be withdrawn. In all cases we try to handle it in the config updater so affected systems still boot with rational options.
-
@Wallofbutter ~ "ISC DHCP has reached end-of-life and will be removed from a future version of pfSense. Kea DHCP is the newer, modern DHCP distribution from ISC that includes the most-requested features."
In my opinion, the Kea service is a total mess! I tried it several times in the past only to have it stop renewing leases and I quickly switched back to ISC. It also removes GUI config for some options.
-
@rpsmith Yeah, I'm still on ISC DHCP and am unlikely to switch to Kea anytime soon. I tried it when I first set up pfSense, a couple years ago now, and it was a disaster. I suppose they've been working on fixing the bugs, but I see enough complaints on this forum that I'm not in any hurry to try it again. ISC does everything I need.
Fortunately, I don't think Netgate is going to go through with that removal plan anytime soon.
Other than this maybe-it-will-be-a-problem-sometime-in-the-future issue, I've been really pleased with how little maintenance effort my pfSense router has required.
-
@tgl ~ I hope your correct. ISC does everything I need and I've never had a single problem with it.
-
ISC is still available so you can continue using it. However that's one of the cases where it's upstream development is discontinued. At some point some security issue may be discovered that forces us to remove it. At that time the upgrade code will move any existing configs to Kea. However there will be custom setups that do not transition cleanly and they will likely require invention. The vast majority of users probably won't even notice.
But even that is not exactly a 'frequent' change. We introduced Kea as an option quite some time ago and retain ISC available. -
Added to what has been said above, the authors of ISC DHCP told us : "ISC DHCOP has now and EOL", but they didn't left us out there in the dark. They decided to write it all over again from the ground up, as they have acquired some experience with creating a DHCP server ^^
So, it's more a special case of a "new version". -
@stephenw10 ~ My DHCP config is about as simple as you can get and on the three recent occasions I tried to switch my firewall and a friend's firewall to Kea, It stopped renewing leases. I also don't like that they removed some of the config options from the GUI. Just my two cents!
-
@Gertjan Yeah, given that the Kea authors are the same people who did ISC DHCP, it's most odd that they're seemingly struggling to get it right. I'm tempted to wonder if the issues being seen here are not so much Kea itself as something wrong with its integration into pfSense. Just blue-sky speculation though.
-
@rpsmith said in Does pfSense frequently change core features with its releases?:
on the three recent occasions I tried to switch my firewall and a friend's firewall to Kea, It stopped renewing leases.
Hmm, interesting. I've not seen any issues with it here recently other than on the 3100 where the 32bit arm port does have issues.
-
@stephenw10 said in Does pfSense frequently change core features with its releases?:
@rpsmith said in Does pfSense frequently change core features with its releases?:
on the three recent occasions I tried to switch my firewall and a friend's firewall to Kea, It stopped renewing leases.
Hmm, interesting. I've not seen any issues with it here recently other than on the 3100 where the 32bit arm port does have issues.
At my shop here when I first tried Kea I had to go back to ISC but would occasionally try back to Kea. Over time I have not had to switch back to ISC.. I cannot tell you when the last time I switched around unfortunately..
Lab machine is on Kea but never gets anything on the LAN ports that require DHCP..
-
@chpalmer ~ I don't think it even qualifies as a beta version. Why it's included in a release is beyond me!
-
Have you opened a bug with any details?
-
@stephenw10 ~ My bad. I have not. My last attempt to switch was about a month ago. I'll try again on the current 2.9.0 and open a bug report if I still have issues. I asked Gemini about the problem today and it mentioned known problems with using host names in custom options and host registration for dynamic DHCP clients so I need to look at those two areas before switching over next time.
-
@Wallofbutter If you really want to go the distance don't use packages. You should be able to get a few years easy if not using packages.
-
@rpsmith Yes, I seen the DHCP feature removal and replacement done in OPNsense also, they just change too many core features too frequently like with the new firewall rules that at the end it becomes a headache to manage for people with limited time.
-
@Wallofbutter but that is the first change in that area for a long time and it won't change again for a long time.
You'll have to adjust to a new webUI (Nexus) in pfSense soon too. And if CoreDNS is coming to CE (which I assume it does) you'll have to adapt to that.
Privacy Policy · Cookie Policy