sfx2000
Part of the Furniture
And personally, I don't understand why so many people are raving about pfsense. I experimented with it one afternoon at work, and was left rather unimpressed by it. And I could never get snort to work correctly with it (it refused to update itself, claiming I had no ruleset defined when I definitely did have one GPL ruleset enabled). So things aren't perfect there either.
I ran pfSense a long time back, and out of sheer frustration, recently returned - it's not perfect, and it's a pretty steep learning curve to make the most of it, but on decent low power HW, it works...
I think part of the challenge moving from Linux to FreeBSD, is that pfSense uses pf, not ip tables, and how to build/maintain rulesets is like apples and oranges - it's different enough that one has to learn it over again...
A few days later I experimented with ipfire, which allowed me to get snort working within a few minutes, however the lack of ability to create outbound firewall rules was a deal breaker. So I'll be sticking with CentOS + Shorewall for our firewall at work.
Haven't played around with ipfire, but I've heard it's decent enough...
ShoreWall is very good...
Should note that many of the FOSS router distro's are a bit more challenging - it's the flexibility and many options/knobs/levers that drive folks in their direction - and for some - it's jumping into a great unknown.
Even OpenWRT can be very daunting once past basic setup... and it's a very powerful small footprint distribution.
Most OEM's are going to shy away from that level - mostly out of support concerns - so pick the 20 percent that 80 percent of the people use, and implement that in the BigBox all-in-one Router/AP/Switch combo devices - good enough ships - and shipping means money... and those boxes fill most people's needs - fair enough...
But...
If one is on this thread - you're probably part of that two percent that is looking for a bit more than what the OEM's have to offer.. Heck, consider the RMerlin builds which do give folks a bit more (and fix a lot of OEM bugs/glitches/etc - a true gift to the community) - is this a good thing? Or is it a sign that the OEM's are missing the mark?
This is a widespread issue across virtually any software in 2016. Lots of legacy code, features shipping broken, plenty of useless features implemented while others actually useful but not great bulletpoint in a marketing presentation are missing.
Goes back to what I was saying earlier - OEM's are putting priority for Router/AP's in the wrong place - Features first (check box on the marketing), then performance... while Stability and Security take a back seat... and get that box on the shelf and move on to the next one...
My personal opinion? Software has grown too complex, and shipping deadlines aren't delayed to accommodate for this fact. Many companies see software as a necessary evil to justify selling a box. Lots of companies ship great hardware, but horrible software.
So no matter which solution you chose, someone has to compromise somewhere.
Completely agree.