I was surprised to not see any post about this here yet, so here it is i guess.
Netgate (the company who runs pfSense) has just announced serious changes to their “free” so called “Home+Lab” license of pfSense.
Here is the link to their offical blog post.
Background:
Netgate have offered a free and opensource version of pfSense, called the CE (Community Edition). They also offered a version called “pfSense Plus” which was paid and offered a few more features but also support from Netgate, which is of course perfectly fine and very common (look at Proxmox for example).
A while ago (1,5 years) they introduced “Home+Lab” as a product and license version in order for casual users and “homelabbers” to dip a toe into their commercial offerings which has more features than the CE. Basically like “here you can use your enterprise version for free, but its a bit limited of course”. The obvious goal there is to motivate users to switch from the free CE to a paid version, again nothing wrong with that. Portainer for example does this too.
Because of this, users switched from the “always” free CE version to the “Home+Lab” version, upgrading their installations and enjoying a few more features. According to Netgate, thousands of users have installed it. Great!
Now
But just now Netgate have announced major changes to this, out of the blue, without any prior notice. The free “Home+Lab” version is no longer available for download, its just gone.
As a reason they cite that thirdparty sellers (on Aliexpress etc. i imagine) were downloading the “better” version of pfSense, aka the “Home+Lab” version, and installing it on their hardware appliances and then selling them. Without Netgate seeing any revenue from this.
Please see their blogpost for all the details. But one crucial point is that anyone who is currently running their “Home+Lab” version, can keep running it (yay!) but they also say that future upgrades and bugfixes may require a subscription. So basically, users installed a free “better” version, which now doesnt exist anymore, and to continue using it with updates, they “might” need to pay a subscription fee. Something as crucial like a firewall appliance should be kept up to date for security, so just ignoring that is not really a option. And Netgate also state that if you have to reinstall your current “Home+Lab” version, they cannot provide that for free to you. And those subscriptions apparently come at a very high price. Are you willing to pay $400/year for your firewall software when youre only using it privately in your small homelab?
Paying for software, or any product, is not a bad thing. And companies need to make money, they need to pay employees. This should be obvious. There is no problem with that in itself. But the way this was done, telling their userbase for quite a while to try out this free version of the premium product, and then pulling the rug away underneath the feet, is just plain wrong and fucked up.
“Okay whatever, then just switch back to the actual free CE version!” Great idea, but apparently thats not so super easy.
Lawrence Systems have already made a excellent video summing up all these changes. I would recommend watching it to get the full picture, i can and want to only cover a bit here:
They also made a video about switching back from pfSense plus (Home+Lab) to pfSense CE:
Reading recent posts about this on /r/pfSense subreddit, the community seems to be quite angry about this. And it doesnt help that their subreddit is actually run by Netgate employees, so it isnt exactly a independent discussion forum there at all. For example a user tried to get feedback and support for a tool to convert pfSense configs to OPNsense configs, and the moderators removed the post without further comment.
My personal recommendation would be that this is a huge opportunity to finally switch away from pfSense, they have shown once again that they cannot be trusted. Take a look at the most obvious “competitor” /r/OPNsenseFirewall, they started as a fork of pfSense and have developed quite nicely.
And to make it even more clear what kind of people are running Netgate (pfSense), if you havent read it yet, this is the story of when users announced the fork OPNsense, how a employee of Netgate was running opnsense.com which was a mock website entirely made to shit on the OPNsense project and discredit them. I encourage you to look at it and make up your own mind about it. And yes, this employee still works for them today it seems. This alone should be reason enough to never use anything by Netgate, ever, wether its a free CE or paid.
Atleast right now they are still offering the free and opensource CE version. But who knows how long that will last. They might as well kill that option without prior notice in a few months or a year from now. Its better to think about switching before being forced to.
There have also been various other issues with Netgate´s behaviour towards their users over the years, but covering them all here would be too much and offtopic, i would like to focus this post mostly on the very recent issue.
If people get angry about Oracle and seemingly shutting down “free” VPS instances at random, then they should be angry about Netgate pulling shit like this too.
#TL;DR
Stop using pfSense (just any Netgate products), switch to something else.
Its not the only alternative, but /r/OPNsenseFirewall is one major example.
Disclaimer: I am no pfSense expert, very far from it. If i got any of the history or current events wrong in this post, please let me know and i will immediately correct them. For me when the time came to pick a (virtualized) firewall/router appliance, i installed both pfSense and OPNsense in VMs and took a quick look. Even tho pfSense did leave a very “enterprise-ish” impression, it didnt feel right somehow, just odd in some way. Then looking at OPNsense, i felt immediately at home, i cant really narrow down why exactly. It simply felt much more open and friendly from the beginning. And i mean the software, at that point i had no idea what was going on between pfSense and OPNsense. All i knew was that OPNsense originated from pfSense, thats all. I tried both a tiny bit and quickly decided that i like OPNsense more, and thats what i have been using for a long time now and im very happy with it.
None of the existing flair options seem to really fit to this, so forgive me for not having any flair. Mods feel free to overwrite any flair to this.
Beside the obvious alternatives I understand the move. However it would also have been possible to forbid the installation of that particular license on commercially sold hardware under thread of a fine…
Yep OP is right, but OP didn’t mention the fucking disasterous WireGuard implementation they tried to pull off
God that was a mess
This is yet another reminder to tick off “switch to OPNsense” on my to do list
Yup, the whole Wireguard debacle is what had me switch to OPNSense in the first place
Feel free to add more context please or links to other issues.
I did not want to make this a “look how bad Netgate has been for years” post, but mostly focus on this one current issue.
I think they always planned for ce’s obsolescence from the very start, just they fudged the whole thing with poor communication and wrong decisions…probably they will be aiming for business from now on because that’s their main revenue stream and their lifeblood and not the open source community.
Yes, but most business customers, or the people that advise those business customers, choose stuff that they have already tried out on their homelab and are familiar with.
And to make it even more clear what kind of people are running Netgate (pfSense), if you havent read it yet, this is the story of when users announced the fork OPNsense, how Netgate was running opnsense.com which was a mock website entirely made to shit on the OPNsense project and discredit them. I encourage you to look at it and make up your own mind about it. And guess who exactly was running that website? Some disgruntled hardcore pfSense fan, or some low level employee who went too far? No, it was the founder & CEO of Netgate. This alone should be reason enough to never use anything by Netgate, ever, wether its a free CE or paid.
Story time.
I always found it difficult to like pfSense. I’m big on UI/UX and this was before their redesign. Even after the new design I really didn’t love it. I started researching alternatives and asked in some (not /r/pfsense) subreddit about opnsense.
Some dude named htilonom shows up absolutely going off the handle about it. Was calling it a scam. He seemed disturbingly passionate about hate for an open source project so I did some digging instead of taking his words at face value. He was running a subreddit called /r/opnscam where he was doing some downright creepy dude stalking an onlyfans girl level of stalking the opnsense devs. Posting random links to forum posts by opnsense devs, making wild accusations that didn’t fit the links he was posting. Long nonsensical rants about topics like how criticizing the choice of using C or a web interface meant people wanted to “steal” code. Nobody else posted there. Was just years of this one guy talking to himself about opnsense being a scam and how the maintainers were incompetent or were somehow stealing from an open source codebase.
I always suspected it was someone who had some business ties to pfSense, if not that CEO himself.
Nice story bro.
Oh god. I fell in love with you after reading this. :-)
This subreddit was created by a petty and childish troll who made pfSense users look bad by doing nothing on reddit but shitting on a similar open source project. It has been taken over and shut down.
Excellent, well done!
Dropped them last year for a Ubiquiti stack. Very pleased.
No issues with pfsense, but I’m thinking of doing the same just because I’m starting to dislike the company and pretty much all my hardware is ubiquity anyway. I also have a ubiquity gateway laying around.
I do use pfsense to an advanced level for a home lab so I’m worried ubiquity won’t match the features.
So the people that make the free version of the software and the paid version of the software decided others were taking advantage of the free eval version, and stopping giving that away for free. Why not just use the CE version? It’s been working fine for me for more than a decade. Is there functionality missing in the free CE version that you’ll be giving up, or are you just pissed off that something changed unexpectedly in the selection of free things that are available to you?
Is OPNsense really more “open and friendly?” I dunno, I know some of the guys at Netgate professionally, and they’re trying to run a business… and for some reason, giving away software for free. Probably as a combination of giving back to the community and having people do testing at the same time. Seems like a reasonable tradeoff.
it’s all about breaking the promises previously given
One option is ipfire. ipfire
IPFire devs lives in 1997 and don’t want to wake up to the world that is IPv6. They even list IPv6 as a significant security risk lmao
https://wiki.ipfire.org/optimization/start/security_hardening/reducing_attack_surface
Yeah, mostly true. It’s not perfect profuct, but option still. I gues that 98% home users don’t need ipv6 so it’s not so big thing to be disabled in default installation.
Never reward bait and switch.
Fuck this company
I recently did a i9 proxmox build and it became an opportunity to do a fresh install of opnsense from my pfSense install. It’s a bit different to get use to, UI wise, in some sense pfSense seemed a little more clunky but easier to read things like the firewall table. But I decided I was going to switch because of hearing the scummy things they do so this reinforced my decision and push getting use to opnsense. Good writeup
I’ve used both pfsense and opnsense. Given this was like 4+ years ago, but still. Used opnsense because userinterface had better ui/ux. Otherwise pfsense had much more to give, but I really never needed it so switched to lighter/easier to use version - opnsense. I really don’t see a problem with switching/reinstalling different version of pfsense if you don’t want to use “paid” version.
Now, the problem of AliExpress - this is true. The most important part of the network gear isn’t hardware, it’s software and drivers on said gear. Pfsense turns cheap shitty minipc worth $100 into powerful router on par with enterprise gear worth $10000 and capable of running thousands of users in multiple locations with site to site networks.
TL;DR often goes at the top of the post, not the bottom 😉
Just making sure you read the whole thing…
I can understand this topic can be personal, yet I see no issue. CE still available, homelab is their product and they have been allowing ppl to use for free. Now they decided not to allow it anymore, so be it. It is their product after all.
Maybe I’m missing something, if I do, please elaborate and I am happy to be corrected.When they pulled the shit against opnsense back in the day, I moved to sophos home edition and never looked back. Netgate as a company is cancer.
Either run opnsense or sophos home if you don’t mind closed source firewall.
Netgate / pfSense would have been better off with using a licensing scheme like most (ie. you get CE, and only CE off the website, your home+lab license is paid for ($10/yr or something nominal), and the full enterprise edition is whatever the cost is.
I’m using CE, but I’m considering switching to OPNSense if for no other reason than having Suricata pre-installed sounds really, really good.
My weekend job is working out how to migrate my VPN config over. Once I’ve done that in moving.