pFsense for Those tired of Consumer Routers

Discussion in 'Networking and Wireless' started by Aivxtla, Mar 14, 2020.

  1. Aivxtla

    Aivxtla Notebook Evangelist

    Reputations:
    408
    Messages:
    457
    Likes Received:
    612
    Trophy Points:
    106
    This is mostly just based on my experience and there's no one size fits all, so if your'e happy with what you have and its working well stay with it and probably don't mess with it and this may not be worth the effort or cost, but if you are tired of consumer routers due to various issues and need additional features, functions and proper firmware updates even after more than 2-3 years you may want to take a look at Pfsense.

    I got fed up with the firmware quality of consumer routers and decided to try pFsense. If anyone is interested they can get a $150-250 Qotom or similar box on Amazon or even an old PC and install Pfsense and use their current router as an Access Point cum switch. Do note that it does take a bit of learning or guidance and its not for everyone, but even as a novice myself a few great videos by Lawrence Systems on YouTube got me setup in regards to the basics, pFblocker, OpenVPN and Traffic Limiting for Bufferbloat management. Took me only about 20-30 mins to get all the previously mentioned functions ready. I switched my RAX120 to AP mode with my NAS connected to the RAX120's 5Gbe port.

    Basic Setup and getting online:

    pFblocker: (Don't use the Geo Blocking part unless you really need to)

    Traffic Limiters: (for Buffer Bloat)


    For VPN profiles from providers ExpressVPN etc have links on their own site on how to setup manually.


    pFsense Home Page on my SuperMicro 1U Unit

    Home Page.png


    DNS Setup & Resolving:
    By default pFsense does DNS resolving itself rather than using the ISP for security, you can go to DNS Resolver and select Forwarding mode for a speedup and enable DNS over TLS for security in forwarding mode if you want to use third part DNSs. (First disable DNSSEC when switching to forwarding)

    Switch Resolver to Forwarding.png

    If using Third party DNS Servers you can enable those in general setup, I added an image below with CloudFlare primary & secondary IPv4/IPv6 DNS servers. Also disable WAN DNS override so it won't use ISP DNS servers. If you want speed in resolving, ISP DNSs’ can and will be faster in most cases at the cost of security.

    Third Party DNS.png

    Enabling Hardware Crypto and Thermal Sensors for Intel CPUs:
    In the Advanced -> Miscellaneous section you can enable hardware crypto (helps VPN) and Thermal sensors as shown in the attached image.

    Enable Hardware Crypto and Thermal Sensors.png

    pFblockerNG (Use the Development Version):
    You can get pFblockerNG by going to the package manager in the System section, after install it shows up under Firewall section, it has a guided setup by default.

    Another simple guide: https://www.linuxincluded.com/block-ads-malvertising-on-pfsense-using-pfblockerng-dnsbl/
    One thing I should mention about pfblocker NG is that it has a section you can enable called TLD (Top Level Domain Blocking). Be careful as that feature can take a lot of RAM depending on your block lists' size. Im using upwards of 4.5GB RAM on my unit with TLD function enabled with my large number of blocklists.

    A few short topics from the makers of pFsense including limiters, captive portals etc.



    I went a bit more extreme and recently bought an Intel Xeon D-1541based SuperMicro 1U unit to install ESXi VM for pFsense and FreeNAS side by side. I so far only installed pFsense (2.4.5) and I must say it's far more powerful (honestly even a $200 Intel based Qotom box is probably more powerful than the best consumer router in terms of routing and VPN), reliable and the sheer amount of functions available are amazing including packages like pFblockerNG piHole like ad/tracking blocking but more powerful. OpenVPN and tracking options (ie ntoppng) are really great and the limiter and traffic shaping functions seem to be far better than most consumer routers. I liked OpenWRT on consumer units but with a lot of hardware acceleration functions being lost due to closed source binaries and the fact that even though I can even use OpenWRT on my Xeon D it just doesn't seem as friendly out of the the box as pFsense.

    Will add more info as time permits or on request.
     
    Last edited: Mar 15, 2020
    alexhawker and downloads like this.
  2. downloads

    downloads Super Moderator Super Moderator

    Reputations:
    7,668
    Messages:
    8,651
    Likes Received:
    2,076
    Trophy Points:
    331
    Very interesting and by the looks of it more user friendly than OpenWRT...
     
    Aivxtla likes this.
  3. hacktrix2006

    hacktrix2006 Hold My Vodka, I going to kill my GPU

    Reputations:
    357
    Messages:
    1,313
    Likes Received:
    743
    Trophy Points:
    131
    Another OpenWRT user here and yes I agree PfSense does look more user friendly however I have used PfSense I know that it can be user unfriendly.



    Sent from my SNE-LX1 using Tapatalk
     
  4. downloads

    downloads Super Moderator Super Moderator

    Reputations:
    7,668
    Messages:
    8,651
    Likes Received:
    2,076
    Trophy Points:
    331
    @hacktrix2006 OK, so if you've used both how would you compare them as far as user experience is concerned?
    I get it that it can be user unfriendly but overall?
     
  5. hacktrix2006

    hacktrix2006 Hold My Vodka, I going to kill my GPU

    Reputations:
    357
    Messages:
    1,313
    Likes Received:
    743
    Trophy Points:
    131
    Firstly my last time I used PfSense was when it was at build 2.0 so a lot would of changed. Easiest way would be for me to install PfSense into a Hyper-V to see what has changed.

    However, for normal users or even people that use OpenWRT there is still a learning curve in certain area's of PfSense and vice versa.

    If it was taken on first boot experience the PfSense would win that hands down due to its wizard at the start, where as OpenWRT doesn't have it.

    When I was using build 2.0 the bit that was steep learning curve was firewall rules and setting up vlans.

    But at the end of the day where PfSense excels in some places OpenWRT will excel in others.

    Although PfSense GUI is better to be honest.

    Sent from my SNE-LX1 using Tapatalk
     
    downloads and Aivxtla like this.
  6. Aivxtla

    Aivxtla Notebook Evangelist

    Reputations:
    408
    Messages:
    457
    Likes Received:
    612
    Trophy Points:
    106
    OpenWRT does have great documentation I managed to compile my own by builds for my R7800 despite being new thanks to the effort they put into the docs and their throughness (I did have to make certain changes to my build environment vs the docs as it didn’t work right away using their instructions) and great community too. I loved that they had Cake SQM available, when I was with my VDSL ISP it helped bring my Bufferbloat from a D-F to an A with very little tinkering.

    However as you said the Wizards in pFsense do make it easier to just get up and running and all the needed packages are right there and no need add or compile extra things like I needed on my R7800 OpenWRT builds (LEDE at the time since most of the DEVs split with OWRT due to an internal conflict that is now resolved) vs their stock builds.


    In certain instances with consumer routers due to OpenWRT covering a vast array of devices certain changes they made to support one “similar” chipset could be detrimental to another like some changes to enhance support for the IPQ4XX series caused issues with the R7800’s stability though later rectified in later patches.

    As you said they both excel in their on way and I totally agree some areas do require a learning curve. I will say though the OWRT community is very polite even when people ask the same old questions without searching forums or maybe they just missed the info, the experts kindly tell them to look throughly or just help sometimes. From looking at pFsense forums it seems they’re less accommodating to that.
     
    Last edited: Mar 15, 2020
    downloads and hacktrix2006 like this.

Share This Page