What do you run; Opnsense, pfsense, Smoothwall, maybe a WAF like wazuh?

Today was update/audit firewall day. I’m running a standalone instance of pFsense on a Protectli Vault FW4B - 4 Port - Intel Quad Core - 8GB RAM - 120GB mSATA SSD with unbound, pfBlockerNG, Suricata, ntopng, and heavily filtered. I did bump the swap to 8 GB as I’ve previously noticed a few ‘out of swap’ errors under load.

Before I signed off, I ran it through a couple porn sites to see if my adblocking strategy was working. Not one intrusive ad. Sweet!

Show me what you got.

    • PlutoniumAcid@lemmy.world
      0·
      7 months ago

      Same. What’s the deal with having elaborate firewall stuff for a normal family home anyway?

      If the built in stuff isn’t good enough then 99.9% of households would be compromised a long time ago already.

      • thermal_shock@lemmy.worldEnglish
        0·
        7 months ago

        Some of it is for fun and testing, learning. Which I used to do. I used to have an old watchdog that I put pfsense on, just don’t need it nowadays.

        Once i learn how it works and have run through the setup, I move on. Just need to spend my time in other areas, but now I have an understanding of it and can apply that logic or idea to other things and troubleshooting.

        • PlutoniumAcid@lemmy.world
          0·
          7 months ago

          This is perfectly valid! I to a lot of tinkering with selfhosting using Docker containers, and I have learned a ton from that. I feel a bit silly that I didn’t make the connection with firewalls - just tinkering for fun!

  • ki9@lemmy.gf4.pwEnglish
    0·
    7 months ago

    I think I have the same protectli as you and it is awesome. Need it for my 2.5gb uplink. I use openwrt on it… Didn’t really like opnsense. I am more used to linux than bsd.

    I host lots of services and get bombarded by scrapers, scanners, and skids both at home and on my VPSs.

    I use ipset for the usual blocklists which I download regularly. I also have tarpits on 22/tcp (endlessh). I pipe the IPs from the endlessh logs into fail2ban which feeds the ipsets. I have ipset blocks and fail2ban on my home firewall and all VPSs and coordinate over mqtt. So any fail2ban trigger > mqtt > every ipset block. Touch my 22/tcp anywhere and you get banned instantly everywhere. The program I use for this is called vallumd and it runs on openwrt.

    I also put maltrail everywhere but I’m not totally sure how to interpret and respond to the results. Probably will implement a pipe from maltrail to my mqtt > blocklist setup.

    I don’t do any network-level adblocking… Might be a future project.

    • irmadlad@lemmy.worldOPEnglish
      0·
      7 months ago

      OpenBSD pf

      I’d never heard of it so I went and checked it out. It seems to have a lot of pFsense/Opnsense features just managed from the cli. Cool.

      • Hobbes_Dent@lemmy.world
        0·
        7 months ago

        It’s the ‘pf’ in pfSense.

        pf is developed as part of the OpenBSD project and is the built in packet filter/firewall.