What do you run; Opnsense, pfsense, Smoothwall, maybe a WAF like wazuh?
Today was update/audit firewall day. I’m running a standalone instance of pFsense on a Protectli Vault FW4B - 4 Port - Intel Quad Core - 8GB RAM - 120GB mSATA SSD with unbound, pfBlockerNG, Suricata, ntopng, and heavily filtered. I did bump the swap to 8 GB as I’ve previously noticed a few ‘out of swap’ errors under load.
Before I signed off, I ran it through a couple porn sites to see if my adblocking strategy was working. Not one intrusive ad. Sweet!
Show me what you got.
Opnsense on protectlii. Nothing but love.
Protectli
I love my Protectli. I tried Opnsense. Seemed to be a well put together piece of open source software by people really who care. There’s nothing wrong with it. Does what it says on the tin. I guess I just liked the flow of pFsense. They both acomplish the same thing. I am aware of the pro’s and the cons of each. pFsense just appealed to me more.
Nothing fancy, old ubiquiti gateway with a dedicated pihole server for my DNS.
Same. What’s the deal with having elaborate firewall stuff for a normal family home anyway?
If the built in stuff isn’t good enough then 99.9% of households would be compromised a long time ago already.
Some of it is for fun and testing, learning. Which I used to do. I used to have an old watchdog that I put pfsense on, just don’t need it nowadays.
Once i learn how it works and have run through the setup, I move on. Just need to spend my time in other areas, but now I have an understanding of it and can apply that logic or idea to other things and troubleshooting.
This is perfectly valid! I to a lot of tinkering with selfhosting using Docker containers, and I have learned a ton from that. I feel a bit silly that I didn’t make the connection with firewalls - just tinkering for fun!
The last stats I remember reading cited some 1.5 million home networks are compromised on a daily basis. Some people, such as myself, run more complex services on their local servers that are perhaps tied into remotes such as VPS. You’ll see a lot of selfhosters with rather elaborate firewall defenses set up. I self host a lot of services I use that the ‘normal family home’ would outsource to public entities. I have a rack in the closet and several VPS, so I need something more than just Windows Firewall, or similar, that I can dial in to my unique environment.
Also, because I can.
Valid! I also tinker with selfhosting using Docker containers, didn’t think of firewalls the same way. Thank you.
No worries mate. What do you host?
Nothing spectacular.
Git, Paperless, UniFi Controller, Pihole, Mattermost chat, Immich, Home Assistant, Frigate, Syncthing, Hoarder. Just stuff for myself, my home, and my friends. And 🏴☠️
And you?
The usual. Might be a few I’ve missed:
- Homarr
- Code-server
- Netdata
- Searxng
- Change-detection
- Readeck
- Checkcle
- Duckdns
- Obsidian
- Dozzle
- Loki-promtail-1
- Loki-loki-1
- Root-influxdb2-1
- Cadvisor-redis
- Dbeaver
- Pairdrop
- Speedtest-tracker
- Btop-plus-plus
- Portainer
- Grocy
- Loki-grafana-1
- Cup
- Web-check
- Omni-tools
- Cadvisor-prometheus
- Watchtower-fork
- Barcode-buddy
- Ittools
- Nessus
- Dockerbot
- Fusion
- Bytestash
- Uptime-kuma
- Karakeep-web
- Karakeep-chrome
- Karakeep-meili
- Cadvisor
- Gitlab
- RocketChat
- Anonaddy
- Etherpad
- Archivebox
- FreshRSS
- FileStash
- piHole
- LAMP Stack
- UnRaid
- Proxmox
OpenBSD pf
Edit: just home/hobby now, I’m not in tech anymore.
OpenBSD pf
I’d never heard of it so I went and checked it out. It seems to have a lot of pFsense/Opnsense features just managed from the cli. Cool.
It’s the ‘pf’ in pfSense.
pf is developed as part of the OpenBSD project and is the built in packet filter/firewall.
Pfsense guy here, and professionally Palo alto guy. Can someone tl;dr the purpose of blockerng and suricata? I thought I remember the Lawrence systems folks mentioning using it for IPS but with segmentation at home “human” IPS seems more relevant than digital
- Suricata: Open source IDS/IPS
- PfBlockerNG: Used to block ads, malicious content, and manage access based on IP geolocation and domain names. It provides features like DNS-based blocking
Some of the features of both overlap which might not be a bad thing.
Thanks for the succinct reply!
Opnsense on dedicated device, several built in filters + several github backed filters for unbounddns.
Haven’t tested it heavily, but the times I am on an outside network not using VPN into my network, or using TOR, etc, i am inundated with ads… So i guess successful internally.
outside network not using VPN … i am inundated with ads…
I swear I do not know how the regular Joe Schmoe internet user deals with all that clutter. Sometimes I am called by a friend to look at their computer for some issue they are having. It is mind bogglingly frustrating for me.
pfSense on this:
https://a.co/d/6WpafWQI also block outgoing port 53 only allowing my Pihole through.
I use Tailscale to access the network while away.
Do you run unbound on pFsense?
No my pfSense setup is fairly minimal
Opnsense with unbound DNS here. Running on an old PC that got converted to dedicated firewall (with added NIC card for ports). Nothing crazy, just enough to control what communicates out of my network.
Used to do the same thing with an old PC. Hell, at one time I was running one off a laptop with USB to RJ45 adapters for the WAN/LAN ports.
My firewall varies from installation-to-installation, as it’s always client-side with a custom DNS provider. Right now, I’m using YaST Firewall on my main machine, iptables on my old ThinkPad, and my other machines are currently between operating systems. In the past, I have also dabbled in ufw, pf, and awall.
In addition to that, I generally use NextDNS (though I also get excellent results with Mullvad DNS).
My policy is simple: reject all incoming connections, except for Torrent and Syncthing.
NextDNS
I hear a lot of good things about NextDNS.
My policy is simple:
Do you call your network Virgin, because that’s pretty tight.
I run iptables on Debian, on a cheap aliexpress minipc with dual NICs. Been using more or less the same config for about five years. It’s simple, boring, and works great.
It’s simple, boring, and works great.
One cannot quibble with long term success. Admitidly tho, I am a sucker for a good UI. One of the first things I do when researching a piece of opensource software is to do an image search to see what it looks like. LOL
Same. Immeasurably disappointed whenever the repo for a GUI program does not include any screenshots.
Hiding behind my firewalls. Shhhhh.
Sitting in my bunker
Hid behind my wall…
In perfect isolation here behind my wall
Waiting for the worms to come
Nock nock, someone’s home?
RST
I’ve been using Ufw but airvpn’s kill switch seems to override it, should i be using something else?
I have found that a lot of VPN kill switches interfere with other security measures. For instance, I use tailscale on my VPS. I also run a local VPN. If I have the kill switch on the local VPN engaged, it interferes with tailscale and I cannot ssh in to my VPS. So, a not so elegant solution for me is to disengage the local VPN’s kill switch for that session, and then re-enable it after I am finished administering my VPS. After which I will do a DNS leak check to make sure everything is as it was. Takes a couple of quick steps, but it seems to work.
Pfsense with pfblocker in a VM. Works wonders. Pipe fail2ban to pfblocker for extra goodness.
Pipe fail2ban to pfblocker for extra goodness.
The thought has crossed my mind on several occasions. If you don’t mind me asking and take up your time, how do you integrate f2b with pFsense? I’m running f2b on several VPS I have, and it just downright works. So, my thought was, what would f2b do to enhance pFsense’s capabilities, and how would you make that all homogenate?
Been a while since I set it up but as I recall it’s a 5-minute from job that runs a command that just dumps the pf block list fail2ban manages into a text file in my public_html directory. Then I just add a feed in pfblocker with the address of the text file and it loads from that feed.
I’ll see if I can dig up some info. I started searching, then got busy. So I put the few I had time to find in a selfhosted Readeck instance. I use it for ‘read it later’ kind of bookmarks.
Thanks for the share.
another advantage of running VMs is the flexibility of changing stuff whenever you decide to try something new. like shuffling new hardware around but you don’t need to get up from the couch, or buy new hardware.
Or swapping networks around!
Show me what you got.
you’re doing the same thing i am, so there’s not point. lol
Yeah, but you got charts n’ graphs and a big writeup. Nice job.
We’re behind our firewalls of course 😋 I’m using a random no root android firewall but I’m probably just going to root it and use something good
