Let’s all Pause for a moment and Consider the state of pfsense

[nickf1227]

Lets start by asking ourselves a simple question. pfSense, who are you? Do you love pfSense? I think I have resolved both of these questions, and the answer is yes.

I’ve used Netgate hardware in production in real life for many purposes. It’s good. TAC, even TAC lite, is a great value add. Plus is worth it for many circumstances.

But I don’t always need or want support. I reserve the right to hack the missing features I may need or want back into the CE codebase. I’ve used, in a pinch, dozens of pfsense firewalls in production. Don’t always have money professionally to do things the “right way”. Pfsense is as close as it gets, and I’m not confident Opnsense can be that stepping stone for me in all circumstances. The other options Tom Lawrence mentioned are just not good options for many use cases. Things like WRT were born out of a pet project of hacking consumer routers. Things like VyOS are great but more complicated than pf.

Thats what this thread is about from my perspective. I’m a professional first and a home user second.

Everything is going cloud first. I’m not on that train. As a community and as individuals we need to stem the tide. There is an erosion of good low-cost on-prem options. This cannot occur. We must hold steadfast against the corporate trend of no one owning anything. If anything, I think now is time to hedge our bets.

Enterprise products exist because people have more money than time. Open source products exist because people have more time than money. Each have their purpose, and pfSense lives in both camps. My only purpose is to ensure that it always does. Sacrifice is sometimes necessary. Freedom may be more valuable than convenience, other times it may be the other way around.

I also live in both camps. I sometimes have more money than sense, and other times have more sense than money. My only purpose is to ensure that it always remains viable in both. I think I can help, if my help is needed. Lets holdfast for now, and watch. Join me if you care.

Agree or disagree, I'd love to hear the thoughts of others here at STH. I have a unique respect for this community. If you all thing I should sit down and shut up, I will respect that.

I’d be interested in knowing if you all here would be if you would be interested in sponsoring, promoting, or somehow supporting a community fork of pfsense. I’m not sure now is the time for a fork, but I am actually spending significant brain cycles trying to fix my problem with Netgate, if one exists. This is not a call to action, but rather, I am seeking individuals of like mind.

I am a hacker. I use that term as a millennial who has probably bastardized Stallman’s meaning of the word. But that’s who I am. Netgate has the right to make money. We have the right to enforce change if Netgate doesn’t kick stuff back to the community. (648) Free software, free society: Richard Stallman at TEDxGeneva 2014 - YouTube

https://www.reddit.com/r/PFSENSE/comments/17iiya2/_/k6yh2dm

pfSense Licensing changes

Seeing some changes to the license for pfSense plus for home/lab use. @tomlawrence have you any more info?

forums.lawrencesystems.com

19 people signed and won this petition

A Community pfSense Fork

www.change.org

Let's all Pause for a moment and Consider the state of pfsense - Software & Operating Systems - Level1Techs Forums

 

[Reider]

I've used PFSene for about 11 years (home user). It does what it needs to do, and it does it well. I run a Netgate appliance and have had PFsense Plus since it's been available. So, in that regard, the changes don't change anything concerning my deployment.

I've always been pro-open-source, and I'll happily support (financially) good projects or companies that deliver value to me and my family.

I feel a lot of these great projects who give their products away for "free" will at some point be forced to fund the project more aggresively to survive in a challenging market.

Many people I know use PFSense and similar software but never donate, not development time, not financially or even on support forums. Most users fall into this category which hurts open source because it's the foundation supporting further development. Unless they can build a business, they have no framework to ensure its continued survival.

All the forks, the splits, and the bad blood are all caused by this. We have the freedom to Fork PFSense, but I'd rather see more people helping OPNSense if they want to give Netgate the middle finger than another fork of PFSense.

I guess the proverb "You can't have your cake and eat it too" makes sense here - We want free software of high quality and continued maintenance, but neither want to support nor help the continued development of the product.

PS: There are obviously many who both donate time and money to these projects, I just have a feeling it's not these people who are making the most noise right now.

 

[nickf1227]

PS: There are obviously many who both donate time and money to these projects, I just have a feeling it's not these people who are making the most noise right now.

I hope you don't think I am in the camp of folks not vested in this project. There are many ways to show support. I don't think theres as much ground we disagree on as you seem to think.

 

[Reider]

My post was a more general reply and not focused at you personally in any way, but I can understand why it might seem that way. But rest assured, that is not the case, I wasn't trying to indirectly imply anything. Just replying in a general sense .

 

[nickf1227]

Current version of the Timeline in the code I am pondering. To steal a different proverb, keep your friends close but your enemies closer.

█+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+█
█| 1979-1995             | 2002-2014          | 2006-present          | 2015-present         | 2021-present         | 2023-present (hypothetical)                    |█
█|-----------------------|--------------------|-----------------------|----------------------|----------------------|------------------------------------------------|█
█| BSD Operating Systems | m0n0wall           | → pfSense CE          | → OPNsense           | pfSense Plus         | CommunitySponsoredFW                           |█
█| (Development of various| (Original firewall| (Forked for more      | (Community-driven    | (Netgate's official  | (*Consider* the creation of a                  |█
█| BSD flavors leading up | project)          | features and dynamic  | fork for more        | version, includes    | Community initiative for specific features or  |█
█| to FreeBSD)           |                    | dev.)                 | features and changes | additional features  | improvements, aims to merge back into pfSense  |█
█|                       |                    |                       | *friends not enemies*| and support for      | CE)                                            |█
█|                       |                    |                       | *codebase diverged   | Netgate hardware)    |                                                |█
█|                       |                    |                       | too far *            | ***Frienemies***     |                                                |█
█+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+█

 

[Railgun]

Meh.

Netgate IMHO has had a bad rep for a while.
Use something else. If in the enterprise, really use something else.

 

[nickf1227]

Use something else. If in the enterprise, really use something else.

Disagree. use cases exist beyond prime production. Ancillary services can be provided with no SLA. pfSense fills a void in that universe. I can go pretty deep into this, but I don't think it's worth it. You should just trust me that there are valid uses for pfSense in the enterprise, and not all of them need a support contract or need to be run on netgate hardware. IT Administrators have the right, and the obligation, to take risks when challenged with fiscal austerity. These risks come with great potential failure scenarios. There are plenty of narrative sitcoms I can show and tell, demonstrating that I need pfSense as a crutch, and I don't think I am alone.

 

[unwind-protect]

Their attempt to put Wireguard into the FreeBSD kernel shows that they have at least some incompetent developers that they allow to run amok. You can't let a company like that be involved in your security.

I always preferred to run plain FreeBSD or OpenBSD.

 

[nickf1227]

Their attempt to put Wireguard into the FreeBSD kernel shows that they have at least some incompetent developers that they allow to run amok. You can't let a company like that be involved in your security.

I always preferred to run plain FreeBSD or OpenBSD.

Agree. In isolation, that problem was not a big deal. Scale out a bit and consider other actions Netgate has made, maybe a bigger deal. Reason enough for the community to insist on more involvement in the pfSense CE codebase. I need help finding sane actors to help me rectify.

 

[Railgun]

Disagree. use cases exist beyond prime production. Ancillary services can be provided with no SLA. pfSense fills a void in that universe. I can go pretty deep into this, but I don't think it's worth it. You should just trust me that there are valid uses for pfSense in the enterprise, and not all of them need a support contract or need to be run on netgate hardware. IT Administrators have the right, and the obligation, to take risks when challenged with fiscal austerity. These risks come with great potential failure scenarios. There are plenty of narrative sitcoms I can show and tell, demonstrating that I need pfSense as a crutch, and I don't think I am alone.

Perhaps. Yet, here you are.

 

[nickf1227]

Perhaps. Yet, here you are.

Yes. Because I maintain the above to be historically true. I am here because I want to be part of making it true for the next generation of young it folk as well.