I believe the most significant line items to capture in your tests are those important line items for which no published information exists on the Internet. And which Ubiquiti flat out refuses to provide:
What is the respective throughput for the site-to-site VPNs supported by both Ubiquitiās gateways and pfSense? Which are the throughputs for:
Wireguard
IPSec
OpenVPN
To compare apples-to-apples, the throughput tests should be performed with IDS turned off.
Here is, verbatim, the response that Ubiquiti gave me when I asked for the throughput numbers for their various higher-end gateways:
Thank you for reaching out. I am Peter from the UniFi Security & VPN Team. I will be assisting in your case today.
We understand your concern regarding the VPN speeds across Site-to-Site VPNs. Regrettably, we donāt have specific values for the speeds that can be achieved.
However, we appreciate your feedback on this matter, and we will share it with our product team for consideration in future updates and improvements.
If you have any further questions or concerns, please donāt hesitate to reach out. Weāre here to assist you in any way we can.
Thank you for your understanding and cooperation.
It is high time for somebody to determine the performance figures that Ubiquiti refuses to provide to their customers. Iāll let you speculate on the reasons for that refusal.
When comparing engines, a V8 against a V8 is a good comparison. However, some of us also need to drive a car. I can get to work faster with a V6 if itās in āa carā, than looking at a beautifully tuned V8 sat on a workbench
That would be fantastic and you would do the community a great service. Nobody else in the vastness of Ubiquti product review channels and sites has published the results of Ubiquiti gateways VPN throughput testing. By contrast, Netgate has (some) of those performance figures on their product pages.
I have been with pfsense for over 8 years. But with the recent business decisions trying to push users to the āfreeā plus version and then bait and switch got me to not like them. I know they said it was going to be $129 but it was a terrible way to do it. I have supported them with submitting bug reports and paying for plus. The only thing that has me hanging on is no one else can compare to pfsense and my needs with it.
As soon as UniFi or someone else can get there I am jumping ship for sure. I donāt want to support a business that operates like netgate does.
The one thing that I did not cover but may cover in a future video is VPN speeds. Netgate contributes a lot to the crypto libraries (they are also a major code contributor to FreeBSD) and has much faster VPN speeds than many other systems. As far as I know, UniFi does not currently publish their speeds and that is something of contention because that matters to a lot of people.
Just between you and me, you will never leave pfsense, right??
I can admit I will almost certainly never abandon my bare knuckles linux firewall. Unless the next version of unifi can do my taxes. That might get me to jump ship.
What they did to opnsense a while back was shameful. Says a lot about the character of their mgmt team. Not sure they even apologized.
I know that the SSH keys in the Unifi Controller GUI only support RSA and not elliptical keys. Also the SNMP key in the controller has to be downgraded from a max of 31 to 10 characters as soon as a Unifi switch is added. I donāt have a UBM to test, but its something to keep in mind.
No I am ready to move away from pfsense. Iāve been in research mode evaluating everything from enterprise to open source. Or to possibly build my own solution or a mix of different options.
Oh sorry, I was responding to two posts there. Just poking at Tom a little bit, all in fun.
I kind of gathered you are sniffing around for something else. Surprised you are thinking about build your own. I wonāt get on my soap box except to say if you want true freedom, nothing comes close. No more leash tied to any company.
And if you do go down that road post your experience here if you feel comfortable. It would be fun to see what you do and compare notes. I know I can learn a thing or two from you.
But like pfblocker, haproxy etc itās an add in, some of which are not supported/covered by Netgate - i know Acme is a Netgate item though but others arenāt so caveats apply?
But obviously added value for pfsense over unfi is the existence of the 3rd party package ecosystem?
