TNSR Business announced (pfSense replacement?)

[nezach]

Netgate announced TNSR Business today:

Come on the Journey with Us

It seems like they are positioning it as a pfSense replacement. They are using words "open source" a lot throughout the article, but then they state "for a little more than a dollar a day". It is actually $399 annual subscription per license, but they don't say it outright. They also try to defend the fact that this is paid service by saying if you don't like go build it yourself.

I personally don't have any problem with them charging money for it, but the way blog post is worded is just weird.

What do you guys make of it?

 

[EffrafaxOfWug]

What do you guys make of it?

Marketeer bulltwaddle to the nth degree.

Eleven instances of the word "journey", not counting the headline. An annoying assumption that I am somehow happy spending £400 a year on coffee (or does everyone but me waste their cash on overpriced burnt and/or oversweetened not-coffee products from starbucks?). Bugger all technical information. The final paragraph of "well if you don't want to subscribe..." reminded me of those adverts where they have some poor actor down on their luck doing a task in a way that would Wile E. Coyote look sane with a soothingly psychotic voiceover telling the viewer that peeling potatoes is now somehow impossible without the new plutonium-powered Spud-O-Tron, a snip at only twelve grillion quatloos.

Someone gimme a prod when they have some actual content please

 

[T_Minus]

Marketeer bulltwaddle to the nth degree.

Eleven instances of the word "journey", not counting the headline. An annoying assumption that I am somehow happy spending £400 a year on coffee (or does everyone but me waste their cash on overpriced burnt and/or oversweetened not-coffee products from starbucks?). Bugger all technical information. The final paragraph of "well if you don't want to subscribe..." reminded me of those adverts where they have some poor actor down on their luck doing a task in a way that would Wile E. Coyote look sane with a soothingly psychotic voiceover telling the viewer that peeling potatoes is now somehow impossible without the new plutonium-powered Spud-O-Tron, a snip at only twelve grillion quatloos.

Someone gimme a prod when they have some actual content please

Agreed.

 

[kapone]

While I'm shaking my head at the marketing speak... NetGate IS between a rock and a hard place. They want/need to make money, and while open source is great, it doesn't achieve the objective. The flip side of that is positioning...People who use pfSense are typically:

- Geeks who know what they're doing, and they build their stuff.
- A small segment of SMBs that typically use geeks mentioned above.
- Any bigger organizations that still build their pfSense stuff, because they can afford to, have technical talent on hand, and don't see a need for a subscription.

And that's it. Who are they marketing to?

 

[vudu]

I too am a little worried. Wondering if this is long term play to monetise what was originally Monowall. If a "community" edition remains I may be not too worried as my requirements are fairly simple.

 

[zxv]

TNSR is built on DPDK (data plane development kit) which has the potential to route and firewall at full line rate on 100G. It's built on top of a vector packet processor (VPP) that was open sourced by Cisco in 2016.

Here is a video of a presentation by Jim Thompson at a recent research workshop on DPDK.

Netgate has been very involved, and provided the first off-the-shelf development platform for other DPDK researchers. If you listen to the comments of the other researchers at the end of his talk, you'll see how much they appreciate Netgate's involvement.

It is a pfSense replancement, in that with a huge increase in performance, most would gladly switch to get much higher bandwidth on the same x86 hardware platform.

100G on a commodity COTS hardware is going to be great, and $400/yr for a license is a lot less than I was expecting. TNSR also differs from pfSense in that it has a REST API.

 

[nezach]

Technically speaking TNSR looks to be a very interesting product and my hat is off to all the people who created it. But just like @kapone I don't understand what their target market is for this product and I don't think Netgate knows that either. I just don't see majority of pfSense users migrating to TNSR @ this price point. If they stopped pfSense development most of the users would migrate to alternative open source solutions and not TNSR.

 

[zxv]

Technically speaking TNSR looks to be a very interesting product and my hat is off to all the people who created it. But just like @kapone I don't understand what their target market is for this product and I don't think Netgate knows that either. I just don't see majority of pfSense users migrating to TNSR @ this price point. If they stopped pfSense development most of the users would migrate to alternative open source solutions and not TNSR.

I hear your concern.

DPDK is potentially able to route and firewall at 100G on the same hardware as pfSense.
TNSR is already shipping on a few of the appliances that are either the same or very similar to what pfSense shipped on.

So in that sense, we already see some portions of the market that can overlap.
Hardware that could run pfSense, can run TNSR.

I can appreciate the concerns that this might affect pfSense. Keep in mind that they have lots of appliances and support contracts, and (in my limited experience) a track record for good support, as well as, very positive involvement with FreeBSD and other developers and reseachers. Regardless of which direction they choose to go, I just want to point out that there's no apparent history of burning bridges.

That said, your concern is valid in the sense that DPDK may obsolete other firewall/router software for the x86 platform, not just pfSense. The fact that they've brought it to market, in both appliance and software-only forms, speaks to their capabilities. The fact that the new product has a REST API, which had been on their roadmap for quite a while, is a reflection that it will be a continuation of their previous roadmaps.

As to the price, consider the amount of investment that was needed to get DPDK to market and stabilize it sufficiently for support contracts. That's got to have been considerable expense, and given that, I had not expected that I would be able to afford TNSR at all. I'm seriously considering it since it's now a fit not just for border/edge at 1G, but internally on 10/40/100G boundaries for intranet.

Granted, there is no community edition. That's because this did not originate in an open source distro of some kind. They had to build a distro themselves. It is what it is. Even so, some of the technology and certain components are open source, and they are giving back to the open source community in terms of supporting the existing research in DPDK and development by others.

We'll have to wait and see what happens if and when there are open source distros built on DPDK. There aren't that many companies that have been able to survive as long has Netgate has while being as open-source oriented. This is one of their strengths, and it's encouraging that they have both brought it to market, and are actively giving back to the community in the ways that are available.

While I understand some of the alarm at the lack of a community edition, the lack of a community edition is not their fault. DPDK is going to make big waves, not just in distros, but also in applications like samba, web servers, databases, and others. But it'll take time.

 

[pcmoore]

While I understand some of the alarm at the lack of a community edition, the lack of a community edition is not their fault.

Assuming that TNSR is built entirely of Open Source components and Netgate owned IP, the lack of a community edition is because they decided it didn't fit their business model. Most likely Netgate could have created a community edition, but made a conscious decision not to do so. Claiming it is "not their fault", is similar to me skipping the gym this morning in favor of an extra hour of sleep and blaming my bed.

Based on some of the comments in the press release, I suspect the upper levels of management at Netgate don't fully understand some of the trickier parts of building a business around free and open software. As a pfSense user I wish them success, but their business decisions thus far with TNSR do not fill me with confidence.

 

[Jannis Jacobsen]

Open source does not mean free as in no cost
It does require the source code to be available

-j

 

[pcmoore]

Open source does not mean free as in no cost

Indeed. You'll note I didn't make any references to cost, purely the community edition. There are several successful companies that base their business around free and open software. Most of the software companies generate revenue not on the product/software itself, but on the support contracts. Having a "community edition" is a good way to both develop and evangelize the product (think of it as an advanced beta release). Look at Canonical and Ubuntu, Red Hat and RHEL/Fedora, etc.

 

[Dreece]

Strangely enough I was looking at DPDK API the other day... only a matter of time before more jump onto this ship of big-pipe firewalling...
I'd love to give TNSR a run and I'll second @pcmoore on the question-mark regarding community-edition availability or they could even call it the STH edition for us l0w-budget home-lab'ers.

...we use it, we get technically bold with it, then we recommend it to our big-budget business clients... NetGate need to think of the bigger picture... there is a reason why software firewalls tend to succeed when they embrace a 'crowd' model... it's the difference between the closed hardware rack firewall and not... anyhow it's only early days, I feel they will clock onto the bigger picture sooner rather than later

 

[Jannis Jacobsen]

They would probably get word out better and faster with a community edition.
Companies need support etc, so they would not lose business either.
(Any companies using the community edition, probably would not have paid for it in the first place)

-j

 

[Dennis@Netgate]

Hi All,

I work for Netgate and wanted to add a little context to what I think are some of the main concerns/topics regarding TNSR.


TNSR is pfSense replacement:

Yes, and no…..there are no plans to abandon pfSense. A lot of pfSense users have asked us for features/functionality that pfSense just can’t do. When we came out with TNSR a year ago, the initial release was intended to solve the 100Gb problem and it has done this very well. With the release of TNSR Business yesterday, we addressed the needs of users that just need up to 10Gb throughput.


No Community Edition of TNSR:

Every one of the components that make up TNSR are open source. The reason that TNSR is all of these at once is that we have customers who have asked us to productize these projects and support it. Customers have told us that they cannot find 10Gb routing and packet filtering for less than thousands of dollars per year so we believe that $399/year is a great value for performance. However, there is a trial version you can download and try for up to 120 days (after that config is frozen) in a lab environment.

“I don't understand what their target market is for this product and I don't think Netgate knows that either”:

TNSR has been out for a year and has been adopted by customers who needed to solve high-bandwidth (40-100Gbps) routing and packet filtering problems. All that's happening now is that we're making a version of TNSR available to folks who have more modest - but still beyond the current capabilities of pfSense - performance requirements. The blog outlines where we think pfSense users will benefit from TNSR Business in each space (Home, SMB, Enterprise, SP). We also know that not all pfSense users will feel they need to move TNSR and that is okay, as stated before there are no plans to abandon pfSense.

 

[Patriot]

Considering we can hit 7Gbps with an Denverton setup... Why pay $400 a year to be artificially capped at 10Gbps?
You gotta work with us here... no community edition, artificial caps and unlisted price for >10Gbps... Try again before another opensource firewall picks up vpp and leaves you obsolete.

 

[vudu]

^ Thanks for your response. Adds a little clarity. Here in AU we are still struggling to rollout 100Mbps NBN, Largely thanks to our inept guberment. Maybe in a decade we can can revisit. I too would argue for a Community edition.

 

[Siman]

IMHO I really haven't been a fan of pfsense since it got sold out to netgate, and their treatment of OPNSense... But they do offer a compelling product. The only thing though is there is always VyOS its nipping on the heals of TNSR, there is plenty of talk about implementing VPP, XDP, and other similar TNSR features. It's also truly open source, but I enjoy the simplicity of PFSense...

 

[BoredSysadmin]

Come on the Journey with Us

February 27, 2019
By Neal Hardsell