Backup ISP and Firewall Configuration

[Fastline]

Hello guys,

I got some time these days and thought to ask for help from you guys once again

Pardon me if this topic is not that relevant to be posted in this forum

If you remember, i posted a thread months ago and then i got my basics cleared regarding the pfSense/OpenSense Firewall to secure my networks as some are exposed to the internet for some duration. You can find the link below for the existing thread:

Switch Recommendation

Hello Guys, I’m not sure if this is the right place to ask this question. If not, please move the thread to the appropriate forum. So, now i’m mostly finishing the setup and want to include a pfSense Firewall device to secure the network as some of them will be exposed to the internet. I got to know that for the best security practices, its suggested to use a managed switch which supports VLAN. So, now as I’m moving to 25G and 100G, I’ve my old switch (still in use) with the old NAS device an…

So, today, I’m here to implement a backup ISP and continue using the pfSense i setup with the help of you guys.

Being into video production, i gotta upload gigabytes of videos which require high bandwidth and uptime. So, to my existing configuration, i plan to include a way to use two ISP so that if one fails, the other can act as a backup/failover. Upon researching this, i got to know about TP-LINK VPN Router and these are the models i came across:

G36
G611
ER605
ER7212PC
ER8411

My choice is G611 as it’s white which will match the look n feel with the existing devices i have and it has got redundant power supplies along with FANs, which will maintain airflow.

Can anyone confirm if it will work fine as a failover when using multiple ISPs? For now, I’ll be using a normal 1Gb/s Base-T from both ISPs. But someday, when i expand, i would prefer to use SFP/SFP+ for high bandwidth connection.

Also, how do i configure my pfSense after buying this new VPN Router? I really don’t prefer to use TP-LINK Router for firewall purposes. Let me know what are your thoughts on this. I’m not an expert in networking, but i don’t think TP-LINK has that many security features or advantages over pfSense or OpenSense.

Thanks

[pmh]

In my opinion this auestion is way out of scope of this forum and better taken to the pfSense or OPNsense forum instead - depending on which you are using, which is not entirely clear to me. Writing OPNsense/pfSense does not make much sense. While they are both based on FreeBSD they are two entirely different products today.

[MBILC]

Note you can do failover in pfsense, you don’t need a separate router or anything. Your ISP will or should provide their modem and what ever is needed to connect into your pfsense box. (RJ24/Fiber termination)

Buying the TP router is a waste of money and does nothing to help your configuration if you already have a working pfsense system in place.

[Fastline]

I understand that. But previously no one was able to answer the basics at those forum. Hence, i had to knock here

[Fastline]

Wow. So, even if i use two ISPs, i should be able to configure failover via pfSense or OpenSense? Is that for real?

Also, would i need a different NIC for another WAN or i can use existing NIC? The existing NIC has four ports. Would that work?

How fast is the failover switching between two ISPs?

[pmh]

Of course both OPNsense and pfSense support Multi-WAN and failover. The switch is more or less instantaneous. The details are in no way related to TrueNAS but to the firewall system and the uplink configuration alone.

I run only OPNsense, sorry, I cannot help with pfSense.

[Fastline]

Thank you for the information. Appreciate that

BTW, any specific reason to use OpenSense over pfSense? Unlike UNRAID and TrueNAS, where TrueNAS is more rock solid and optimized and is the real NAS software in opensource market, is it same with the pfSense and OpenSense?

[dan]

@Fastline

any specific reason to use OpenSense over pfSense?

pfSense vs. OPNsense

About five years back, I started a thread on this question on the old forum which ended up being surprisingly active and long-running, with discussion frequently restarting after Netgate managed to once again shoot themselves in the foot. In the thought that it might still be helpful to folks here, I’m sharing the link here. Any further discussion can continue in this topic.

Both pfSense and OPNsense support multi-WAN failover, and the documentation for each product describes how to configure it.

[pmh]

@Fastline

BTW, any specific reason to use OpenSense over pfSense?

I like the product and its features better? Also the “open source first, community first” development model is what I prefer. I have submitted a dozen pull requests with bug fixes or features by now.

[Fastline]

Sounds good. Thanks for the confirmation dear @dan

[Fastline]

So, its like UNRAID vs TrueNAS and i think the same reason applies here when comparing pfSense and OpenSense, yeah?

[pmh]

Er … no?

What do you mean by that analogy? pfSense and OPNsense are just two different products - both very capable and feature rich - by two different companies, with two different development models, two different communities, different features, most importantly (for me) two radically different UIs …

They have in common that they both run on FreeBSD and that’s where any similarity ends. Oh, and they are both firewalls. OPNsense started out as a pfSense fork, but the vast majority of the code has been replaced by now.

I use OPNsense because for me the pfSense UI sucks. Simple as that. I never can find anything I am looking for. But depending on the way your personal brain works it might just be the other way round for you.

[Fastline]

@pmh

What do you mean by that analogy? pfSense and OPNsense are just two different products - both very capable and feature rich - by two different companies, with two different development models, two different communities, different features, most importantly (for me) two radically different UIs …

I know both are different. Just like UNRAID and TrueNAS. At least i feel like TrueNAS is enriched and has several advantages over UNRAID. So, i thought, maybe it was same for pfSense and OpenSense case.

@pmh

I use OPNsense because for me the pfSense UI sucks. Simple as that. I never can find anything I am looking for. But depending on the way your personal brain works it might just be the other way round for you.

Gotcha!

[MBILC]

OPNSense also tends to get the benefits of PFSense and their commits to FreeBSD, sure they had drama in the past, myself I prefer PFSense as it is just more tried and tested. Lawrence touches on some of it, but in the end, use what you prefer and works best for you

Why I am Not Using OPNSense