My Thoughts on Untangle

Networking & Firewalls
1

So I thought I’d write a text-based review on Untangle here for everyone to see.

Just a TLDR; on my background, I had a very successful IT company doing everything from Break-Fix and starting MSP back in 08-09. I love Open Source and developed my own Firewall back in 2002. Took a break from IT services to Teach Cyber Security Training as that was my strongest skill (Penetration Testing) I Have been breaking stuff since the mid-'80s :slight_smile:

In any case, onwards to Untangle. I remember when they first came out. I am always a huge fanboy of rolling my own stuff, *nix from scratch? Yeah. That is all up my alley.

Just test drove PFsense, OpnSense etc the past few days and I have to say I have had trouble getting basic things going. Introduce Untangle. I literally got all of the things running in a few minutes (Minus a Manual tweak for my Ubuntu 16.04 having an outdated package of OpenVPN client) – No fault of OpenVPN or Untangle for that matter. The fault is on Ubuntu, however I will be upgrading here this week to 18.04 to be current.

In any case, Untangle really nailed it. The Ease of Use and setup/config is one of the greats. For instance in the latest pfsense, I had it running in a VM and despite my best efforts, the VPN connection (which should have worked fine) randomly kicked me out, randomly had to restart services on the VM etc. Logs were exactly 0.00% help in that matter. I finally burned it to the ground, started over and 8 times later, no luck. Untangle, again worked out of the box in less than half the time of others – despite my issues on my Ubuntu end. The issue was with compression and the mode of which untangle + openVPN rolls it out. Yes there is a setting in there to turn of compression and likely I wouldn’t run into this issue in the windowZ world, but glad I figured it now and not under deployment!

I know Untangle costs money, but if I am serving up a full UTM to my clients, I want it to mostly stress-free and hassle-free.

Onto monitoring and Maintenance – WHAT?! A centralized dashboard, with no real setup? Plus remote control in one-click. Yep, I am sold. Ain’t doing that with PF or OPN.

Resource usage was on par with the rest. Maybe even slightly better, but I didn’t load it up either.

Reporting – Just OMG is all I have to say. Very Nicely done!!

Now, I Have yet to pentest the UTM of Untangle, but I am fairly certain from what I Have seen so far, it’s gonna be rock soild for the most part.

Support – When SHTF (and you know it always does on a Random Friday at 4:59PM) I have someone to call which is included in the buy price. Neat, I like that.

Branding – Just look at PFSense. You can’t sell it pre-loaded on any device anymore. Untangle, “Yeah, hey BTW You can rebrand this as your own with your license. Let’s make money together” – I LOVE THIS!!! Clients can always google the brands and see if you tried to make money. When you can rebrand, you just look better and more serious.

PF and OPN serve their rights in their respective use cases, but Untangle has me all wrapped in it.

I hope this helps someone. @LTS_Tom – thank you for your wonderful review on Untangle. You hit the nail on the head!

4 Likes
2

I’ve been an Untangle reseller/partner for…I think over 12 years now. Since it was version 5. We’re up to “Star” level partnership with them now, so the recurring revenue is great (35%). I think we have about 80 installs out there, many of them on monthly, some on annual…depends on the clients particular MSP plan each month. It’s nice that Untangle gives you both options for billing.

Their support is great. Open a ticket, or call, and they remote in and work their magic, often notifying you it’s all set.

We love the flexibility Untangle gives you in creating larger networks. I have some installs out there on big 1U servers with 6 or 8 Intel ethernet interfaces…some with 2 or 3 WAN ports, several internal/LAN ports. Its ability to work with multiple public IPs…even on the same ETH interface, is great. And ability to control traffic via firewall rules to go out a certain IP…such as control which public IP or ETH interface outbound SMTP goes out on.

WAN failover and WAN balancer work GREAT.

Stability is excellent…as long as you install it on quality business grade hardware (a good rule of thumb for ANYthing). But you often see people complain in the Untangle forums about it locking up or needing reboots…but then you see they bought some el cheapo 200 dollar piece of junk with realtec NICs and some AMD based system. Yeah, get what you pay for…meanwhile my appliances on good hardware can run for years on end without so much as a hiccup!

Both VPN options work well.

Bandwidth manager works well, I’ve had some clients with heavy internet usage such as all O365 users with large mailboxes…on small bandwidth, and the seat of the pants feel of browser performance made you think they were on a much faster connection, when in fact they were on an old slow 3 meg bonded T-1!

It’s ability to let you create different “racks” (policies)…and apply them to certain groups of users, you can define that in so many different ways…but that’s a great feature. Such as for a school…you can create a tight/strict “policy” and apply that to students, and a “loose” policy for staff.

Directory Connectors allows you to bind a username with activity in reports, or sessions.

Sessions is a great way to instantly drill down and see what each user is doing, live active sessions right then and there!

HTTPS (SSL) inspector…needed these days since the larger percentage of traffic is now httpS. If you aren’t having your UTM sniff that…you’re missing MOST of the traffic! Each to deploy this, and works well. I just push it out via a group policy at most clients.

We install it on our own hardware. Untangle got in and out of the hardware game a couple of times over the past decade plus! We’ve gotten a few of their units but we just have a good experience getting quality hardware from 2 other vendors. Lets us build/easily support our clients platforms…and we keep spares at our office. Quick and easy to “swap out” if needed.

We’ve certainly used other UTMs…and we sold/installed a quite a few Sonicwalls and PFSense units. Although I love PFSense (I’ve played with it since its earliest BETA days)…it’s not a UTM. It’s a damn fast lean and mean distro though with great routing and traffic shaping. And Sonicwall…eh. Also used Fortinet a bit…and played with Sophos (and Astaro…back in the day…which is the product Sophos purchased and renamed into their own). I used to love playing with lots of *nix firewall distros…I used to build/play with a new one every few months…IPCop, Copfilter, Endian, m0n0wall, IPFire, Smoothwall, ClearOS (Loved that one!), and a few others I can’t recall right now. Fun hobby!

1 Like
3

@YeOldeStonecat - So much great knowledge in your reply. We have become partners with them last week. I love that company and it’s staff so much! I actually have another (3rd) meeting with them tomorrow and for once I am actually looking forward to a vendor meeting.

Can I ask (you can message me if you prefer) what kind of hardware config you are rolling out? I don’t want My first deployments to be disappointments :slight_smile: – Thanks!

4

@YeOldeStonecat and I thought I was bad. Finally settled on pf-Sense tried Untangle some years back but it did not measure up to pf-Sense. Now it is a different story so after watching Tom’s review I have been evaling Untangle again. Haven’t deployed yet but might work well in certain cases. Pf-Sense will remain my go to first choice.

5

Two different products for two different purposes…love PFSense too! I always called it “The Ferrari of firewall distros!”

2 Likes
6

Weren’t you on {H} ? :slight_smile:

7

Hi. New here. I’ve just signed in.

Agree. That’s the reason that I use both at my home network, pfSense followed by Untangle in Bridge, an awesome combination IMHO.