pfSense: Open source network firewall distribution
Last time I checked, pfSense was good at firewalling but bad at everything else security-wise.<p>- Web panel allows root code execution on the device (every XSS is full RCE!)<p>- Everything runs as root<p>- No ASLR or other hardening flags because FreeBSD<p>- Lots of XSS and CSRF opportunities (probably got better with the new UI)<p>- Did not replace SSL certificate after Heartbleed (on packages.pfsense.org!)<p>- No package signing, either (not sure if this is still true with pkgng)<p>- Did not even <i>have</i> SSL on packages.pfsense.org until one or two years ago<p>I'm also missing the fq_codel queueing discipline on my home network (prevents bufferbloat).<p>I still use it since it's awesome, but I hope their security posture has improved since.<p>Most of the commercial vendors are even worse, but still.