Review: 5 open-source alternatives for routers/firewalls

Open-source software offers an economical and flexible option for deploying basic home, SMB or even enterprise networking. These open-source products deliver simple routing and networking features, like DHCP and DNS. Plus, they are combined with security functionality, starting with a basic firewall and possibly including antivirus, antispam and Web filtering.

These products can be downloaded and deployed on your own hardware, on a virtual platform, or in the cloud. Many of them sell pre-configured appliances as well if you like their feature-set or support, but don’t want to build your own machine.

We reviewed five products: ClearOS, DD-WRT, pfSense, Untangle and ZeroShell. We found that ClearOS, pfSense and Untangle could be appropriate for home use all the way up to the enterprise environment.

• ClearOS is quite feature-rich, including many extra functionalities such as web filtering, antivirus, and a RADIUS server, but lacks a good captive portal—which all of the other solutions provide.
• Untangle also provides extra functionality beyond routing and firewall protection, but some features require recurring monthly subscriptions.
• The pfSense OS offers a more basic feature set, but seems to be the most “free” option.
• DD-WRT and ZeroShell are targeted more toward home and SMB usage, rather than enterprise. Both support Wi-Fi, but their deployment options differ. The can both be installed on x86 machines—like the other three solutions as well—but DD-WRT can also be flashed onto wireless routers with their custom Linux-based firmware.

Here are the full reviews (see screenshots of these products):

ClearOS

ClearOS is more than a simple router, it’s a unified threat management (UTM) solution that offers more than 120 functions via add-ons they call apps, all configurable via their web-based interface. ClearOS is the downloadable OS you can install on your own hardware or virtual machine with their CD (.iso) image. ClearBox is their hardware line with ClearOS pre-installed. There’s also ClearVM, which is a management solution you can utilize to deploy multiple VMs of ClearOS, other Linux distributions, and even Windows OSs on your physical server.

ClearOS version 7 has three editions with varying support and functionality: Community, Home, and Business. ClearOS Business pricing ranges from $108 to $1,308 per year, based upon which subscription you choose with varying functionality and support. Additional fees apply for some of the apps. The ClearVM solution is offered free for limited usage and monthly pricing options are offered for increased usage limits.

We installed ClearOS Business edition (version 7.2.0) to a VirtualBox VM. After a typical install wizard, you’re prompted to configure the network interfaces and then it goes to a simple GUI console displaying the IP of the machine, which you can enter to access the test console for CLI access. However, you’ll likely want to access the web GUI from another computer on the network.

The first time accessing the web GUI you are prompted with another setup wizard to configure the main settings, including the network connection, registration, domain names, and apps. The common apps, such as DHCP server, DNS server, and firewall, are installed by default, but you can choose others to install now or wait till later.

Once you’re in the web GUI, you’ll find a simple interface with four shortcuts on the top: Dashboard takes you to a customizable overview of the system, Marketplace lets you search for and install additional apps, Support brings you to all the support options, and Root is where you can change the system password or sign out. On the left side of the GUI is the main menu to access all the apps and settings, categorized by Cloud, Server, Network, System, and Reports.

On all pages of the web GUI, there’s a documentation icon (looks like a book/manual) that conveniently brings up the online documentation to the particular app or settings you’re currently configuring.

DD-WRT

DD-WRT is primarily known as a free and open alternative firmware for supported consumer-level wireless routers. It contains features and functionality typically only seen in business and enterprise class products, such as multiple SSIDs, VLANs, captive portals, and VPN server/client. In addition to consumer routers, it can be used with embedded hardware and even x86 platforms. They sell some hardware and also offer professional services for customizing the firmware interface and/or features.

You can put a router model number into the DD-WRT router database and it will list the compatibility details and show download links for the supported firmware versions. The firmware can typically be freely used on consumer-level routers, whereas using it with some business and enterprise class products requires the Professional Activation that starts at around $20.

Once you find and download the supported firmware version and edition for your particular router, you must flash it to the router. For some routers, this is a quick process using the firmware upgrade page on the factory web GUI, while a longer process for some routers involving TFTP transfers and other methods. We downloaded DD-WRT v24-SP2 and quickly flashed it to a spare Linksys E2500 we had lying around.

After logging into the web GUI of the DD-WRT firmware, you see a multi-tabbed interface that has a typical router look and feel. The main menu on the top categorizes the settings with most of those pages showing a sub-menu of additional related pages. The Setup page is where you’d set the WAN, DHCP, DDNS, routing, VLANs, and other general networking settings. The Wireless page is where you find the basic and advanced Wi-Fi settings, including the ability to create multiple SSIDs.

The Services page allows you to customize the DHCP and DNS options, configure SSH and Telnet access, configure the VPN server and/or client, and enable hotspot functionality. The Security page allows you to configure the firewall and log options. The Access Restrictions page lets you define WAN access policies and block services and websites. The NAT/QoS page is where you configure port forwarding and triggering, UPnP, DMZ, and QoS settings.

The Administration page is where you configure the admin access settings, including web and remote access, keep alive and Wake-On-LAN settings, and access the router reset, upgrade, and backup options. Also in the Administration settings is the Commands functionality that allows you to run custom commands and scripts, or save for the router’s startup or firewall. The Status page contains sub-tabs of details and stats categorized by the component or type, which includes simple graphs showing bandwidth usage for the LAN, WLAN, and WAN interfaces.

On most pages, there’s a Help column displaying descriptions for a few of the settings on that particular page and a link to a pop-up a window with usually more documentation on the settings. In addition to the help in the web GUI, DD-WRT also provides online documentation via a Wiki with tutorials and other details on installing and using the firmware.

pfSense

PfSense is similar to Untangle, but lacks some of the extra functionality like web filtering and antivirus, sticking more to the traditional router and firewall feature set. However, there are more than three dozen third-party add-ons for easy install via the package manager. The pfSense OS is based off of FreeBSD with a custom kernel that you can install on your own hardware or virtual machines with their CD (.iso) image or their USB or Embedded (.img) image. You can also buy pfSense preloaded on their hardware or even quickly deploy in the cloud via Amazon Web Services.

In addition to their professional support and services, they offer a fold membership for $99 per year. For support and services, you get resources like a library of developer lead videos and digital book on pfSense, plus automatic backups.

We downloaded the CD image of Community Edition 2.3.1 and ran it on a VirtualBox VM. We used their DOS-like GUI to install the OS onto the virtual drive. When the CLI booted up, we configured the WAN and LAN interfaces. Then we were taken to the console interface where you can further configure the network interfaces, utilize the CLI, enable SSH, and perform other admin tasks. It also displays the IP addresses for the WAN and LAN interfaces.

After logging into the web GUI for the first time, you’re presented with a wizard to help configure the host and domain names, time server configuration, network interface settings, and the admin password. Once the wizard is completed, you’re taken to their web GUI opened to the Status Dashboard page. It has the look and feel of a typical network appliance. On the top of the pages you see the main menu; clicking on the categories shows a drop-down menu of the pages or tasks. Some pages are single-paged whereas some contain a tabbed interface with additional related pages.

From the System category of the main menu you can access the general, advanced, update, and high availability settings, and the certification, package, and user managers. The Interfaces category is where you configure the WAN and LAN network interfaces. The Firewall category is where you can configure the aliases, NAT, rules, schedules, traffic shaper, and virtual IPs. The Services category is where most of the settings are for the servers and services, such as DHCP, load balancing, and captive portal. The IPsec, L2TP and OpenVPN settings, however, are under the VPN category.

Under the Status menu are pages for showing the stats and usage details for many of the different components of the server. Under Diagnostics you find many different server and network troubleshooting tools, such as an ARP table, Command Prompt access, DNS lookup, and packet capturing. Under the Help menu you find links to the documentation and other useful content.

On every page of the web GUI, you see a help button (question mark icon) that takes you directly to the online documentation for that particular page.

Untangle

Untangle is most similar to ClearOS. It’s a Linux OS currently based off of Debian 8.4. The basic network router functions are provided free and paid apps add additional functionality and features, all managed via a web-based interface. The technical name for the OS is NG Firewall. You can install the OS on your own hardware or virtual machine, or buy an appliance with NG Firewall pre-installed.

+ ALSO: Untangle turns ordinary PC into security box +

Beyond the free basic network features, you can purchase individual apps for $5 to $25 each per month to add functionality or features. Furthermore, you can buy the NG Firewall Complete subscription that includes all apps starting at $50 per month or $540 per year for up to 25 users. For residential non-commercial use, they provide a Home license for only $5 per month or $50 per year. Keep in mind, they do offer a 14-day free trial for their complete subscription.

The NG Firewall can be downloaded as a CD (.iso) image, USB (.img) image, or a VMware (.ova) image. We downloaded and ran the CD (.iso) image (version 12.0.1) in a VirtualBox VM. Once it booted up, we choose the graphical install option. Then we were prompted with the typical Linux OS installation options. After the first boot of the OS, you’re prompted with a wizard to configure the basic settings and login or create an Untangle account.

After clicking around the GUI, we noticed it’s a web-based interface in a Chromium browser, the same interface you’d see when accessing the web interface from other local computers. Closing the web browser shows the very basic custom Debian OS with a menu on the bottom for bring up the web interface, restarting or shutting down the machine, accessing recovery utilities, and bringing up Terminal access to the OS.

The web interface has a main menu on the left. The Dashboard page conveniently shows the main stats and reports of the OS, host machine, network and other basic server details, which can be customized to your liking.