I read today about VyOS and I really like the idea and approach but I am not sure how it compares to Opnsense in terms of performance and features. I know it doesn’t have a GUI, which is a bit of a bummer for me.
I have purchased a mini router PC and I was thinking to build a dedicated router and firewall on it. I also have another PC that I am planning to run as a Proxmox host and install a couple of VMs and LXC containers, as well as Home Assistant along with Omada, as I am thinking of purchasing some TP-Link AP compatible with Omada.
But would love to hear some feedback from people who used both what they think.
Keep in mind that although I am technical and have a fair understanding of networking and VLANs I am not exactly an expert in networking. Does it make sense to go into the VyOS route in that case?
The end goal is to have a dedicated network and routing for the IoT network, dedicated Wireguard, guest WiFi, etc.
I’ve dabbled in VyOS and Opnsense, but ran Pfsense for close to a decade (which is basically Opnsense, but more proprietary). Between the two, I think Opnsense is likely your better option.
Updates: There is some nuance, but VyOS doesn’t give you a LTS release so you will be taking quarterly upgrades to the latest. You are more or less a beta tester.
Opnsense has I guess one could consider “normal” releases with their community edition and is pretty easy to upgrade. You don’t really expect breaking changes.
Tools: CLI is typically faster on VyOS (once you skill up) than the GUI for Opnsense. But Opnsense also provides CLI options to interact with it, so if you decide you want that later on you have it. Both have APIs to interact with too for automation later.
Firewall: VyOS is using netfilter underneath, aka things you may be familiar with like iptables and nftables. It’s a fine firewall option, and is similar to what you could find in a normal Linux install (more on that later).
Opnsense I believe, uses the PF package (that’s also where the original pfsense got its name). This is a package for FreeBSD, and in my 10+ years of using it, it has been reliable.
Hardware: VyOS being based on Linux will support more hardware out of the box.
Opnsense being based on FreeBSD may run into edge cases of not using your hardware correctly. (I had a thing on Pfsense (also FreeBSD) where it didn’t like my built-in NIC and would flap constantly. I gave up trying to use it and used an external NIC instead)
Opinion: Honestly, if I was stuck with just these two as my choices I would probably lean toward Opnsense. It is more popular in homelab community, and there are many many guides on how to manage it.
Another option: You could also just using any other Linux distro and build up the firewall yourself. In the datacenter, it is very common to find big switches or firewalls simply running Debian on them with whatever firewall package the admin wants. It’s also a great learning experience.
Offbeat option: Presented with the same inquiry as you, I actually switched to OpenWRT. Many people will tell you that it’s just for APs or Routers, but I have been using it for my managed switches and my main firewall for about half a year now. OpenWRT is just Linux underneath, and you get the same CLI access as you would with a normal Linux distro. Plus you do get the option to use LuCI to mange it in the GUI.
It’s not as shiny as the *senses but, it is certainly just as capable for this role in a homelab. Remember when I said I was on pfSense for years? I was able to port all of my firewall rules, VLANs, etc into OpenWRT just fine.