Justifying pfsense for home network

[djc]

Hi,

Looking for advice. Currently have a simple set up - standard Airport routers and pi-hole for ad blocking. I've seen quite the number of comments around the net of people standing up pfsense for their home network. I'm trying to understand the benefits of using pfsense at home. Is the firewall better than that on the Airport? I can run the pi-hole or another module in pfsense that does something similar, but am struggling to justify setting up pfsense. I'd likely go with something like the SG-3000 for simplicity and power saving (supports 1gig WAN), but unsure why I'd really want to implement pfsense besides maybe a bit of "shiny new box" syndrome.

Will I see an increase in network security? Would running DNS (unbound) be better than using standard ISP/google DNS? Any increase in security/privacy?

I don't want to say, "Sell me on pfsense" - just looking for use cases where pfsense works well for you in your home and why you went with it. I.e. increased DNS lookup and better DHCP management / client management than standard routers, etc.

Thank you for sharing in advance.

[Jailer]

When is the last time your router had any kind of update?

[kejianshi]

If you are the kind of person who asks questions like that then you should switch to pfsense. 

[hbauer]

Stuff that most Home Routers cant do

- Network Segmentation for IOT / VOIP Devices
- Bandwith management for your kids  / guests
- VPN Access

to name my most important features

[Harvy66]

Decent AQM/QoS management. Not perfect, but enough.

[kejianshi]

Updated more than once every 10 years...

[curtisgrice]

SNORT IDS/IPS, proper VLANS and routing, much more flexible NAT (PAT) for segmented internal networks, Built in packet logging, Lots more.

It can be as much as you would ever want for a home router or as simple as plug and play.

[mrkool]

if I was you I would setup a computer or a vm host based pfsense before investing on a 3000. I was on the same boat 3 weeks ago but I had a Box that I converted to pfsense so the only money I paid was for a Dual port Intel NIC which was 35 bux. I did it because

I am still figuring things out but I went to pfsense
1. I wanted to add snort (but every time I enable this sucker it breaks lots of other stuff) so still have not figured this out yet but with Kids following youtube links to God Knows what I would feel safer if I had more protection than just a firewall and AV
2. I like to tinker around and packages that are available on pfsense will keep me busy for a while save me money in the long run
3. I want to better control my home network with lots of IOT in my house
4. I had a dedicated openvpn VM running that I have shutdown and am using pfsense now
5. If you don't like OpenDNS filtering (which I am using) you can setup filtering using the proxy packages and publically available blacklists but I am ok with using openDNS for now
6. I am on Verizon FIOS and didn't like the visibility they had on my network so I needed to replace their router any way and none of SOHO solutions are up to par on features of pfsense (not even close)
7. I use Aruba Campus APs for wireless so didn't need a router with wireless built in.

this is all I can think of for now

[djc]

When is the last time your router had any kind of update?

Last month.

[djc]

SNORT IDS/IPS, proper VLANS and routing, much more flexible NAT (PAT) for segmented internal networks, Built in packet logging, Lots more.

It can be as much as you would ever want for a home router or as simple as plug and play.

Ah, VLANS. I have a few Netgear switches that I have been too lazy to set up with VLANS, but it would be wise to put IOT and my solar inverter on an Internet access only VLAN. Good call. Thanks.

[djc]

if I was you I would setup a computer or a vm host based pfsense before investing on a 3000. I was on the same boat 3 weeks ago but I had a Box that I converted to pfsense so the only money I paid was for a Dual port Intel NIC which was 35 bux. I did it because

I am still figuring things out but I went to pfsense
1. I wanted to add snort (but every time I enable this sucker it breaks lots of other stuff) so still have not figured this out yet but with Kids following youtube links to God Knows what I would feel safer if I had more protection than just a firewall and AV
2. I like to tinker around and packages that are available on pfsense will keep me busy for a while save me money in the long run
3. I want to better control my home network with lots of IOT in my house
4. I had a dedicated openvpn VM running that I have shutdown and am using pfsense now
5. If you don't like OpenDNS filtering (which I am using) you can setup filtering using the proxy packages and publically available blacklists but I am ok with using openDNS for now
6. I am on Verizon FIOS and didn't like the visibility they had on my network so I needed to replace their router any way and none of SOHO solutions are up to par on features of pfsense (not even close)
7. I use Aruba Campus APs for wireless so didn't need a router with wireless built in.

this is all I can think of for now

Good idea. Thanks for the suggestions - and thanks to everyone for their replies and help!

[Gertjan]

One more :
    Flawless IPv6 support .....