Messages

Hi Seimus,

Feedback, even if it hurts, but if delivered with class and grace like yours is exactly the kind we want more of. So, thanks for chiming in.

On communication: well noted and agreed. If direct questions to ZA went unanswered, that's a failure on our side, my apologies. I want to own that plainly. I'll investigate this internally.

On why you haven't heard of SASE Starter before now: it's not a secret, but it's just young. We started with a very small circle and have been expanding it gradually rather than announcing it all at once, so the lack of visibility so far is a stage we're in. This thread is, in a sense, turned out to be a part of that gradual expansion. We'll have more on this later this year.

On the mismatch: fair, and it doesn't change the situation. SASE Starter gives you the full platform, but you're at liberty to configure or use any of it. Leave TLS inspection, CASB, SWG, whatever off. The same goes for cloud. If you don't need centralized policy management, do not enable Zenconsole and you're good to go.

Given the troubleshooting time, the bug reports, and the attack-vector work you've put in with our engineers, the same applies to you as to dinguz and cookiemonster above: email support -at- zenarmor.com, mention this thread, we'll get you set up.

Hi dinguz and cookiemonster

Rest assured. You're not, and will not be forgotten.

I'm Murat, founder and CEO of Zenarmor. dinguz, I know you from the very early days in the forum, so I wanted to reply directly.

I'd like to use this opportunity now to have a hear-to-heart conversation about our Home offering, because home subscription has been one of our hardest balancing acts since day one.

The challenge is to find a fine balance between providing the most value to our valued practitioners at a reasonable price point and also make sure what we're doing here is not hurting our B2B business revenue.

This is a real challenge because we have the privilege of working with such amazing people like you who have such advanced networks that you can only find in sophisticated organizations... homelab networks with 42U racks, active/active hypervisors running Active Directory, Active/Passive Firewalls, file servers, kubernetes clusters.., you name it.

We have done multiple iterations of improvements to the home plan, all based on practitioner feedback. The most recent one was back last year, and it seems to have met with satisfaction at large. On the other hand, I must say although we're explicitly telling the home plan is for non-commercial use, we were surprised to become aware of some large scale deployments of home subscription in some organizations. To that end, on the other hand, for some businesses, home subscription is even very powerful.

Our intention has been and will be not to remove any functionality that is already present in our home and even on our free offering. They're there to stay.

However, I understand that home tier might still be missing some functionality that some power practitioners might expect, or some newly introduced capability might also be useful for them.

Our solution to this is the "SASE Starter" program. It's the extended version of our prior Zenarmor Tinkerer Club (ZTC). Here, we're providing the entire feature-set to you with pricing reduced to home plan pricing. It has all the bells and whistles of our most advanced offering like full TLS inspection, multi-core support, CASB, SWG and even ZTNA. 

Similar to ZTC, it's invite-only and there's a vetting process, but unlike ZTC, inclusion criteria is not limited to SASE experience, but IT/network/security practitioners are eligible to benefit from the program for their personal, non-commercial use. If you are interested, simply reach out to us by sending an email to support - at - zenarmor.com and let us know you would like to be included in the program. There's a quick vetting process, but since you two and also many in this forum are already known to us, it'll be quite fast.

I also want to be clear about how the Home plan fits into our broader direction as a company.

The main trajectory for the company is to continue shipping and improving the industry's first and only ubiquitous, single-stack, single-pass and single-app enterprise network security stack. It's getting more and more recognition in the industry and is introducing a completely novel way to protect modern distributed networks for hybrid organizations.

Regarding the standard Home plan.. Our intention is to keep it, and to keep improving it where we can. That's not because it's a significant part of our revenue — it's a small percentage of it — but because we owe a debt of gratitude to practitioners like you who helped build this product in its early years.

Thank you both for years of pushing us to be better. That's not something we take lightly.

@Taunt9930,

Thanks for your response & feedback.

We have indeed done several surveys with our existing home users - I was referring to the result of these surveys [1]. About 5% of the respondents had asked for support for multi-gigabit throughputs. Zenarmor's (and OPNsense) home user base is all tech savvy tech professionals who are very specific about their requirements when it comes to home security.

Quick question: You should be able to easily do 900 Mbps even with single-core as of now, with a fairly standard hardware.

Can you tell me a little bit about your hardware?


[1] https://www.zenarmor.com/blog/whats-new-in-zenarmor-home-more-devices-more-policies

Hello @jlficken,

Glad to hear you're excited about the new 5-policy limit — that one came straight from the majority of requests we've been hearing, so we're happy to make it part of the Home subscription.

On multi-core support: we definitely see the value for power users like yourself, but at the same time it's not something the broader Home community has been asking for, and if we make it too powerful, we start seeing the Home plan misused in business environments (which the license isn't meant for). That's why we've kept the Home subscription balanced for personal use while still growing it step by step.

That said — we do want to support the advanced setups that some of our most passionate users are running. We're considering a SASE Starter tier that would fit more of lab-builder needs.

This isn't ready yet and will likely be invite-only rather than a generally available tier — but if that sounds interesting, feel free to reach out to us directly and we'd be happy to explore it with you.

@mimugmail, thanks for putting this together! Much appreciated.

Hi @aleco,

Any chances you might have "Anonymize IP address" settings enabled in Zenarmor -> Settings -> Privacy?

We published a video to serve as a guide for first time ZA users:

https://www.youtube.com/watch?v=xGgG-ki-KvQ&t=300s

Video will start right from the Policy configuration, but feel free to start from the beginning.

Hope this helps as well .

Hi @GuruLee,

OPNsense 24.1 RC1 has the wireguard kernel mode netmap support available. Any chances you can give that a try? Or alternatively you can wait for 24.1 to be generally available.

With OPNsense 24.1 and Zenarmor 1.16.1 and forward, Zenarmor (and Suricata in IPS mode) is able to handle kernel mode wireguard as well.

Hi @Monviech,

That's a very helpful initiative, thanks.

Zenarmor (or Suricata in IPS mode) will be just between Ingress Interface and Scrub; and for the Egress path, it'll be between Traffic Shaping and Egress Interface.

Hope this inforamtion is helpful.

Got it, can you also run below command:

Code Select Expand


/usr/local/opnsense/mvc/app/library/OPNsense/Zenarmor/CLI.php settimestamp

Hi @gaurhoth,

We've heard this from a few more users and trying to get to the root cause.

In the meantime, a quick question and a workaround:

- Do you also use zenconsole cloud management ?
- If so, can you restart the cloud-agent to see if this resolves your problem? (You can do so either on the console (service senpai restart) or on Zenconsole FW dashboard.

Hey @franco,

Thanks for the heads-up. Yes, it the tun patch is not in 23.7, that must be the reason.

Looking forward to the test kernel; team will go ahead and test it.

WRT wireguad-kmod netmap support, we're working on it to see whether it would be feasible to develop/maintain. We'll reach out to the team once we have some meaningful progress.

That's good to hear indeed. Another reason why we should focus on improving emulated mode.

Let us check this on our lab as well.

Got it, with IPv6+wan tracking interface initialization take a bit more longer because OPNsense tries to re-initialize the WAN interface as well.

Another question: when you use emulated netmap mode, is it better?

Hi JasMan,

When you start/stop zenarmor engine, zenarmor (same with suricata in IPS mode) issues a call to netmap to start/stop inspecting packets for your protected interfaces respectively.

Once this is requested, netmap re-initializes the interface causing down/up events for the particular ethernet interface.

When OPNsense code notices a link down/up event; it tries to re-initialize and refresh interfaces and services.

This is expected. The thing I'm surprised in your case is that it takes so long for things to "calm down".

Quick question: do you have IPv6 enabled in your network or is it just IPv4?