After having issues with my Netgate 4100 (see this post) and knowing all the crap Netgate has pulled the last few years, I decided to build a new Firewall capable of 10 gig routing. Hopefully this fixes my issues. If not at least I no longer have to support PFsense.
Pictures:
Hardware:
X11SSH-F Motherboard
Xeon E3-1240 v5 CPU
32GB 2400mghz RAM
ZFS Mirrored 128gb SSDs
350W Gold Rated PSU
Connect X3 Dual SFP+ NIC
Should have it production ready by next week. Really not looking forward to reconfiguring all the HAProxy/ VPN stuff, but so far already found quite a few Aliases/Rules I can cleanup.
Thanks for stopping by!
You must log in or # to comment.
I’ve done the same as well, can’t say it’s been any issue and I’m just as happy with opnsense as I was with pfsense.
Pfsense behaviours recently made me decide to look elsewhere.
I’ve made a tool that can convert your pfsense configuration to an opnsense configuration. It’s not perfect, but it can do a majority of the legwork for you.
You can pull the site via docker:
docker run --name pf2opn -p 4200:80 -d mwood77/pf2opn
Or use it on the web here:
- https://www.pf2opn.com/
- The conversion happens 100% on your machine; there are no network requests / cookies / or any kind of tracking on the site.
As always, please try the converted configuration in a test image before you apply it to a production environment. If you find any bugs, please reach out.
Nice, OP. My pfsense config is large and complex, but I’m currently working on migrating it to OPNsense this week too. I’m glad to not be putting up with Netgate’s crap for much longer. Since I have a few Dell R240s, I’ve even been thinking of doing HA.
What supermicro case is that if I may ask? I’m also going to set up and build a dedicated firewall. Something similar specs to yours.
Complete overkill in my opinion, but I like spending money, so I’ll allow it.
Mine runs on an i3 and generally gets around 10-30% CPU usage, never anything even close to taxing.
Agreed. OP should install pfsense on that thing and run opnsense vitually on this. I do this on a Lenovo Tiny with a 10g NIC and it works perfectly
Anyone know if the pppoe speed limits of pfsense are also present in opnsense?
Can’t get more than 700mb/s from my 1gb/s service on my netgate box.
I max out my pppoe FTTH install on pfsense with no issues
I’m in a similar boat. Have a Netgate 7100 and it’s garbage. My network is mostly 10gb with a few 25gb devices. The 25gb is on the same VLAN so the router doesn’t come into play there, but it does a bunch across the 10gb devices. The netgate can’t handle it. Just bought an r230 and started setting up vyos. If opnsense can handle the traffic I might just go with that. Having a GUI is nice and I’m already familiar with pfsense.
If pfsense can’t do it I doublt opnsense can on the same hardware.
You can get pretty close if you throw more powerful hardware at it. I managed to route at least 1.4 million packets per second (~16.8Gb/s, 1500MTU concurrent upload and download summed together) using 4 alder lake P cores on pfsense+ 22.05.
Once you start, you’ll find the conversion and resetup goes by quickly. I migrated to a dedicated supermicro box as well, in hopes that PFSense could do 10gig without issues. I eventually moved my 6+ year old PFSense build from a VM over to the dedicated box… and was disappointed. Then PFSense pulled their stunt and I finally just said F-this and rebuilt it.
1 hour - it took me 1 hour to wipe PFSense, figure out the new menus of OPNSense and get everything back online. What I had dragged my feet on for so long, turned out to be a big nothing burger. Zero issues, 10gig speedtests just fine, zero trouble with the NIC and great performance overall.
I’ll leave with this - fuck PFSense, what they pulled was rediculous and an insult to homelabs and folks who like to bring production tech into their homes. They turned a great product, one I’ve implimented into many commercial setups, into a joke - who could ever trust them again?! I’ll never recommend them and I won’t be looking back.
Yeah I swapped pfsense for opnsense last saturday because local dns was shitting the bed. I’m not completely satisfied with opnsense but whatever.