I’ve had the pop-up that all Admins dread; my hardware is going unsupported. Unifi OS will not allow updates so long as my USG remains adopted.
To that end, I have been looking into solutions to replace it. I am not exactly in a hurry to go out and purchase the new shiny from Unifi, and OPNSense has got my attention.
The question here is; what do I run it on? I know that you can purchase appliance-type hardware with pre-baked OPNSense, but I’m looking for something that can grow and change with my setup. For the fine folks here that run or have experience of it, how are you running it? Answers on a postcard; thanks in advance!
I was considering OPNsense myself around this time last year but went with a UniFi Cloud Gateway Fiber. It was actually much less expensive while being much easier to use and manage. On UniFi everything is automated, from firmware and OS updates to Wi-Fi turning, there’s a single point of control for everything, and the mobile apps are superb and allow remote access without requiring a VPN. Also, unlike OPNsense, UniFi doesn’t incur a performance penalty for bridging gateway ports.
I set up a separate Wireguard gateway on Kubuntu, use Pi-hole + unbound on Debian for DNS, and use UniFi’s ProofPoint IDS (paid just like OPNsense options).
IMO OPNsense isn’t worth the headache unless you really really want to go cloudless/FLOSS and are willing to incur the intrinsic time cost.
As for reliability, I’ve been running UniFi gear since 2018 and haven’t had a single outage attributable to it. UniFi OS Server runs on my Mac M1 Mini.
But the biggest problem with OPNsense is you generally have to DIY the hardware, which nowadays is expensive enough to result in UniFi actually being a more cost effective route.
Given the current hardware situation, what do you really need?
If the USG Pro (USG-PRO-4) was/is fine then a Mediatek Filogic 830/880 platform running OpenWrt will likely do fine without breaking the bank. It’ll handle VPN (such as Wireguard) and DNS filtering (Pi Hole) just fine on its own.
I went down this route before with DD-WRT and it was hard to find something that didn’t crash at least once a week. I’m sure things are better now, but if I were DIYing a router I’d pick something with UEFI + ACPI support for the installation convenience at the least.
Besides OpenWRT and OPNSense, consider CHR RouterOS from Mikrotik. Easy iso with flat purchasing price depending on bandwidth of the router 1G/10G/unlimited. Nice (payed) alternative with fair pricing model. I really prefer RouterOS over OPNSense now as I have Mikrotik hardware as well…and would use DIY x86 hardware if I ever need some more oomph or new router
I’ve been running OPNsense for a few years now. Pretty happy with it. Running it on a fanless NUC with 2 NICs now. Had it on Topaz NUC for a while, burnt out a fan but that’s about it. Any old processor, RAM if you got it, should be fine on 16gb. Fast NICs if you need them, but 2.5g or 1gb cards should do fine for a regular use home setup.
DD-WRT is a very different beast and you very likely didn’t use the Mediatek platform(s) which have very good Linux mainline support. It’s just as good as your decent x86 box (and I’m not referring to cheap chinese boxes with very little to no aftermarket support) for your everyday gateway/firewall services.
In fact, I have a smaller box (Filogic 820 based with 512Mbyte of RAM) running for months now on a 1Gbit line with DNS filtering (blocky) just fine.
The idea that you need x86 to move around Gbit isn’t really the case for a domestic connection.
Octeon (MIPS64) is pretty much a dead end, there is some support in mainline Linux but there’s no hardware acceleration. Given the performance of its little bother (EdgeRouter Lite) which uses the same platform but at a lower clock speed I’d say that you’ll struggle to get past 350mbit and Wireguard will be even worse. If that’s fine then I guess you could just flash it. I’ve personally moved away from MIPS64 a long time ago, the newer aarch64 platforms gives you much less headaches in general.
I don’t get the impression OP is a masochist. But, if we’re on that route, might as well suggest VyOS for max performance.
I was referring to ease of installation (like a regular PC OS), driver support, etc. Not performance.
I stand by my UniFi Gateway Fiber recommendation, especially since it will probably be on sale for Black Friday/Cyber Monday as it was last year. If it drops to $199.99 there’s absolutely no (brand new) parts list mini-PC that can beat its performance. Already made the ease of use point. You can set up UniFi OS Server to update itself and all the devices it provisions and you’ll likely never have to touch it again. I don’t think my Gateway Fiber has crashed in the almost year I’ve had it up and running.
Just curious. That’s how many years of software update from Ubiquiti for your device
I’m running Bananapi BPI-R4 that comes with two m.2 slots and two mini-PCIe slots. Currently empty in my setup but sure provides lots of growth potential for me.
You have a choice of OpenWrt, VyOS, Armbian and some very interesting new. distro.
The original USG was released in 2014. So 12, which is longer than many PCs last.
TIL, fair.
Yeah I’ve noticed GL.inet routers use it, which is super cool that they do that instead of using something exclusive to them. The Brume 3 (GL-MT5000) High-Speed VPN Security Gateway’s $129.99 pricing definitely blows just about everything else except maybe TP-Link Omada’s legacy gateways out of the water.
Speaking of TP-Link, looks like they have a new Fusion series that runs Controller on the gateway as the UniFi Cloud Gateways do. Unfortunately they lack a 10G port, which UniFi Gateways have had for a while now.
It’s expensive all around to build anything now, so unless you have some hardware laying around you won’t be saving too much by DIY.
In respect to growing with you, shifting between hardware isn’t always a picnic either as your interface IDs will change which can require a little bit of hammering and creativity.
I ran pfSense right after m0n0wall and kept it right up until maybe 2 years ago now, shortly after their terrible decision (which they’ve officially back tracked now). It was honestly rock solid and the packages / plugins did everything I needed. I switched to OPNSense, and I guess after using pfsense for over 15 years - I just didn’t like using it. I figured it out and got everything 1:1 pretty quickly but overall just didn’t like using it. Definitely more polish than pfsense though.
After running OPNSense for maybe 6 months I caved in and bought a Unifi cloud gateway MAX. Definitely a big adjustment to the way firewall rules / port forwarding / NAT work and had to split off things like my reverse proxy but overall a pleasure to use.
All this to say - be prepared in case you do not like OPNSense, if you have a hypervisor maybe run it in front of something (double NAT is fine) to give it a whirl first. It’s a good firewall but you simply may not like it.
It works on the hardware he already has however it’s slow and dated by now and I mentioned estimated performance a few posts up. The initial install is a bit quirky on the MIPS64 platforms in general and support is dying overall.
