A fan of pfSense, I've used/deployed it a number of times to customers, and for some previous employer bits. Current version doesn't have an API, but is fine for what I do with it.
I did see people hating on it here, and while I cannot/will not speak to their specific issues, I look at it as a much better tool than the integrated hardware units you can buy online for ~$100USD, with also integrated back-doors, courtesy of the development effort.
I know perfectly well that I could build what I need using IPtables ... but have you used IPtables? I'm a CLI guy, and heck ... I want a GUI for IP tables ...
I've not yet played with the nftables, and frankly, I am looking for a generally simpler model of putting some of these things together. pfSense does a pretty good job of this.
One note on the php on the stack ... yeah, this is a concern for me as well. So I don't generally expose the admin access to the interwebs. And I lock that aspect down pretty hard (only specific addresses are allowed to even connect to the admin port). This isn't perfect, but its far better than setting up a web port, and suddenly presenting the pfSense gui out (yeah, this sorta happens by default if you don't move the gui to a different port, and do some other config).
This all said, it is pretty good for what it does, and a few of my previous customers have bought the support for it directly from the team.
I did see people hating on it here, and while I cannot/will not speak to their specific issues, I look at it as a much better tool than the integrated hardware units you can buy online for ~$100USD, with also integrated back-doors, courtesy of the development effort.
I know perfectly well that I could build what I need using IPtables ... but have you used IPtables? I'm a CLI guy, and heck ... I want a GUI for IP tables ...
I've not yet played with the nftables, and frankly, I am looking for a generally simpler model of putting some of these things together. pfSense does a pretty good job of this.
One note on the php on the stack ... yeah, this is a concern for me as well. So I don't generally expose the admin access to the interwebs. And I lock that aspect down pretty hard (only specific addresses are allowed to even connect to the admin port). This isn't perfect, but its far better than setting up a web port, and suddenly presenting the pfSense gui out (yeah, this sorta happens by default if you don't move the gui to a different port, and do some other config).
This all said, it is pretty good for what it does, and a few of my previous customers have bought the support for it directly from the team.