I have been using pfSense since 2005. One setup has been for myself running on a PC Engines WRAP (embedded) setup. The other setup has been salvaged Pentium II Dell PC hardware to replace a malfunctioning Linksys Router for one of my clients.

The WRAP hardware is now replaced by AMDs ALIX board, which should provide a little more horse power, however, for any average SOHO setup, the WRAP has and does provide plenty of omph (although I have seen my WRAP pfSense setup max out on CPU with large file transfers over 802.11g wifi). I purchased this hardware in Canada from Xagyl Communications .

The first point to make, is that this is rock solid. It is the one bit of hardware that never needs to be restarted what so ever. Secondly, this is a great (and much cheaper) alternative to Cisco, and Sonicwall firewalls. No VPN licenses to worry about, there is an active community driving the opensource project forward with new features and releases approximately once or twice a year. Lastly, there is even a commercial support option.

pfSense - use whitebox PC hardware, just add network cards for as many interfaces as you needAnother client recently has been having flaky performance from their Sonicwall - we suspect faulty hardware. So I took this as an opportunity to pitch an opensource solution, that will bring more features/option/flexibility and a lower cost. The other great feature, as you can see from the photo here, you can load pfSense up with as many interfaces as you need, including PCI wifi adapters.

With this 5 interface setup for this client, we have implemented Linksys WRT54GL routers, flashed with the Tomato firmware, as we didn't have any PCI wifi cards lying around (but we did have a bunch of 3Com ethernet cards!). We have DHCP enabled on the WIFI interface, setup a static IP on the Linksys that has a gateway address pointing to the WIFI interface IP address. DHCP is passed through to the clients connecting to the Linksys. Then we have a rule on the firewall (via an alias) for a NOT allow traffic from WIFI subnet to the alias subnets (the LAN for example) so that we can isolate WIFI traffic from the LAN.

Setting up firewall rules and port forwards (with port translation) is fricking basic to setup - compared to Sonicwall's Advanced OS for example. All done via web based gui. The next best thing is setting up PPTP VPN takes minutes - try setting it up on Windows Server, opening up the firewall and start accepting connections in less than 5 mins!

Symantec Corporate Edition was pretty much hassle free. It didn't take a whole lot of resources from the server/management end, and didn't bog down the clients with a light weight software foot print.

Along came Symantec Endpoint Protection shortly after Vista was released. The first reports was that it the included firewall component and locking off server, and bogging down computers.

You can read a long history of the buggy-ness of SEP 11 at the Symantec Forums - http://www.symantec.com/connect/security/forums/endpoint-protection

What I have ended up doing, resulting in a reliable install, is to follow this points:

• Had success with a Windows 2003 32bit Server for SEP Management Server role - at least 1 gig of memory (I do have it running on an old management server at a clients with 512meg ram - but it is slow)
• Setup Client Install Feature Set - ONLY include Antivirus and Antispyware Protection
  • Most of my clients do email virus scanning before it hits their email server
  • DO NOT install Network Threat Protection AND Proactive Threat Protection
• Setup Policies
  • make sure any scheduled scans happen after hours
  • do not enable start up scans (this kills computers on start up)
  • make sure that Missed Scheduled Scans is not selected
  • I usually set delete threats
• For laptops - I will set up a different LiveUpdate Policy to allow
  • User the default management server
  • AND Use a LiveUpdate server - this allows users to update when they are on the road

The point of this is to optimize SEP11 settings for the best performance. With everything enabled, it runs like a dog, and so far, the protection with the minimal setup options provided above are sufficient.