pfsence firewall

[uk26]

We are looking at using pfsence firewall for use on VMware.

How stable is pfsence any issues to be aware of?

 

[vmhosts]

we have a few customers hosting these appliances with us on VMware, no problems what so ever. Another one which you could look at is Astaro (Now Sophos UTM) they have a free business use license. HAs some limitations, but if your just doing firewalling and NAT, its absolutely fine and fairly powerful. One feature we like about Astaro is the ability to create rules based on host names

 

[uk26]

Sophos is good and easy to setup. However Sophos as a company is the let down and ill explain.

We are looking for this to set in a data centre on Vmware to offer our clients a site to site VPN service so their hosted services are protected and not visible on the internet (Only via VPN)

one UTM would be used by Many customers.

Sophos requirements
1. licence for every device connected via VPN (no site to site licence)
2. cant purchase support unless taking the training (£79.00 per year for support and £750 for training)
3. they require the end user details of every customer using the UTM (they say they have a legal requirement to obtain end user details) yeah right

they don't understand our setup and seem to only provide utm which are deployed at customer locations and not in the data centre.

 

[uk26]

Just managed to push 800Mbps wan traffic via the PFsense

 

[vmhosts]

agreed, the Sophos appliance may not be what you are looking for, but for anyone else who is looking for a user friendly interface and only needs firewalling this could be an option.

Never had any issues with the pfSense appliances either. The Web GUI is relatively easy to use, performance and stability are also very good (providing the hardware/virtualisation layer is solid)

 

[pjperez]

One feature we like about Astaro is the ability to create rules based on host names

Does it cache resolutions every X minutes or on the fly every time a connection is evaluated?

Cheers

 

[vmhosts]

im not 100% certain but we use it secure connectivity back to certain web resources using dyndns. Once the client on our workstation has updated we have always been able to connect.

I assume a lot of the dependency will be on the configured TTL of the actual DNS records

 

[pjperez]

Oh I see, so it's just dyndns updating the records.

Nice one, thanks!