pfSense or Firewalla / Several Questions

[sbmocp]

I've heard Steve mention many times that he uses pfSense pre-installed on a Netgate SG-1100. I thought I might get one; however, I heard about the Firewalla box and wondered which would be better. Apparently the pfSense is very involved setup-wise with a steep learning curve. The FW is supposedly much easier as there is support available and it's more plug-and-play.

Then I found out that I can install pfSense on my Qnap NAS. That option is definitely more cost-friendly. I think I'd like to do that, but I'm not a networking pro. Are there any good guides available that could help me get an installation of pfSense up and running?

Thanks for any recommendations.

 

[PHolder]

I can install pfSense on my Qnap NAS.

Considering that QNAP already has a bad rep for security issues, I don't suggest you put all your eggs in that one basket.

You should be able to experiment with the firewall UI in a virtual machine, so you could try one or both or any to see which you like. I know that Reddit has pfSense subreddit, check and see if the other one does too. Look over the messages there and maybe that will give you more of a sense about each product, and the community around and behind it.

 

[coffeeprogrammer]

This guy from YouTube, Lawrence Systems. If you cann't follow his stuff then you are not ready for pfSense, but if you follow SN and Steve you probably can. I use pfSense and I love it, I don't use on the netgate, I've use it on an old hp computer and in vmware with virtual networking. He has many videos on pfsense, I just linked to the first.

 

[systemz]

This guy from YouTube, Lawrence Systems. If you cann't follow his stuff then you are not ready for pfSense, but if you follow SN and Steve you probably can. I use pfSense and I love it, I don't use on the netgate, I've use it on an old hp computer and in vmware with virtual networking. He has many videos on pfsense, I just linked to the first.

I was about to post the same thing.

Great content all around, and does some good security content.

 

[Ianc]

This guy from YouTube, Lawrence Systems. If you cann't follow his stuff then you are not ready for pfSense, but if you follow SN and Steve you probably can. I use pfSense and I love it, I don't use on the netgate, I've use it on an old hp computer and in vmware with virtual networking. He has many videos on pfsense, I just linked to the first.

Thanks for this, I was looking at upgrading my switch functionality and after watching this I realise I'm not quite ready for pfSense!

 

[himemsys]

Keep IPFire in mind as a firewall OS. It is based on linux instead of freebsd, but otherwise it is free and open source just like pfsense. They have some differences. IPFire has fewer features, but also some different features not available in pfsense. The main thing is IPFire is very easy to set up, configure, and use compared to pfsense. I've used both and I prefer IPFire, but either are exceptional.

Welcome To IPFire! - More Than A Firewall

The Open Source Linux-based Firewall Operating System with a Comprehensive Feature Set

www.ipfire.org

 

[cschuber]

The reason IPFire is easier to use than pfsense is firewalld(8). iptables(8) and firewalld use the same Linux kernel constructs but it hides TCP/IP's gory details from the user. It's easier to use but not nearly as configurable as firewalld's rules are coded in XML (maintained by firewalld maintainers). Easier to use but not nearly as flexible. IPFire does not have the features because the user cannot, without difficulty, create their own more complex rules. Though Red Hat and Fedora systems do come with a GUI to create rules, if IP addresses and ports are the only thing one is concerned with.

pfsense is based on pf (one of the three packet filters built into FreeBSD -- the others being ipfw and ipfilter). (I use ipfilter, since my Solaris days.)

It's difficult to expose the full features of a kernel packet filter without inundating new users with foreign concepts. I've met many firewall admins who fail to understand more than simple IP addresses and port numbers. Kind of frustrating.