I have used pfsense before as the main gateway, load balancer, traffic shaping, proxy, firewall, virus/malware protection, enterprise wifi solution for an entire office of 50+ users. Yet I have received criticism from top IT companies who have done an audit on our IT infrastructure calling this solution immature and insecure. While top security experts I have consulted with have told me "using pfsense for everything is of poor quality and most likely cannot handle all of these tasks efficiently".
Yet these same companies that made such claims have been attacked with viruses such as WannaCry, while our infrastructure was maintained without incident.
My reasoning for choosing pfsense are due to the following points:
- No Cost due to open source free software.
- Large community support.
- Capability of handling many services at once.
- No subscription costs for anti-virus and/or other services.
The setup consisted of the following hardware:
- Quad Core Intel Pentium Processor
- 8GB of DDR3 RAM
- 500GB HDD
- 4 x 1Gbps NICs
Services used:
- Anti-Virus protection: ClamAV
- Proxy & Caching: Squid Proxy
- Enterprise Wifi Management & Authentication: FreeRADIUS
This firewall has handled security very well and load balancing/traffic shaping without any drop-outs. All the services mentioned above were running without straining the CPU while also having MAC Address routing enabled which is known to be CPU intensive.
I have read articles where some of these mentioned IT consultants actually discourage the use of open source firewalls due to the fact that they have contracts with large providers like Fortinet and Cisco. I'm sure that with proper configuration pfsense can be as secure as commercial offering if not maybe even more secure.
Questions:
- Is this setup truly insecure as mentioned by other IT companies and what are best practices for securing such a setup?
- Are large security companies truly afraid of such solutions rendering their products obsolete, looking at the most used servers and firewall operating systems world wide Linux is used over commercial offerings like Microsoft?