Switching From PFSense, General Questions

[House Of Cards]

Good day,

I've been using PFSense for a decade, but the shift from community development to a paid model was the last straw.  I'm using this opportunity to rebuild as a chance to better configure my router, and I have a few questions.

First, I'm using CGNAT from T-Mobile, and that makes some challenges for remotely accessing my media server.  Before I create any rules or do any configuration, I was wondering if anyone has any advise for setting up remote access correctly/securely?

Second, on the rules topic...  One thing I greatly miss in the rules configuration is the ability to group rules under folders for organization.  Much like the interface has a "folder" for the automatically created rules, I was wondering if I'm missing something?  If there is no way to do that I'm missing, I'll have to find where to file a feature request.  That was handy to group rules.

Finally, I've noticed that OPNSense reports packet loss on the gateway pretty often.  I never saw this on PFSense with the same hardware.  I'm not sure what that's about.  Any ideas would be appreciated...

Thanks for helping with the transition!

[Greg_E]

I had PFsense running at home also with tmobile... You should have seen packet loss and probably connection loss if that feature has been turned on.

How were you getting around CGNAT with pfsense? There are no real static IP given to home users on tmobile, though some have been able to figure out how to get ipv6 to do this (like it was designed to do). Sorry, no additional details on this because I haven't sat down long enough to try and figure out how I can or can not.

[House Of Cards]

I switched to T-Mobile and never bothered to figure out the remote access thing again once I did it.  It was on the to-do list, but I never got around to diving into the issue.  I've heard some ideas about how to get around it with VPN tunnels or something, but now that I switched to OPNSense and need to reconfigure everything anyway...  now is a good time to figure it out once and for all...

I think I'm going to try to figure out Tailscale (www.tailscale.com) and see if that works. 

I'm pretty busy this weekend, but maybe we can follow along here in this thread to help others.  I'm going to follow this tutorial and see how it goes.

https://www.zenarmor.com/docs/network-security-tutorials/how-to-install-and-configure-tailscale-on-opnsense

[saulsutherland]

After taking about 2 weeks to wrap my head around WireGuard and get all my devices setup with it, I then found Tailscale and had all my devices switched over to it in less than 10 minutes.

Highly recommend it, be sure to read their thorough documentation.

[House Of Cards]

The tutorial I have here is for installing tailscale on OPNSense...  This could be handy if I want to use my home internet as an exit node...

For starters, I really want to limit this to my media server running in a docker container on UnRAID.  There is an UnRAID plugin for tailscale, but it seems to grant remote access to the whole server.  I'm looking into a way to limit tailscale to just the docker container, if that's possible...