VLOG Thursday 503: pfsense, UniFi and the "Cloud", Homelab Q&A

Tom discusses why he's producing fewer pfSense videos, noting the community edition hasn't changed much in years while pfSense Plus is moving toward a closed-source, feature-split model 2:04-2:25. He argues that for many businesses—especially those managing distributed locations—UniFi's unified ecosystem without recurring licensing has become a more practical choice than standalone firewall solutions 7:22-8:05. He also emphasizes that endpoint security, not firewalls, is where modern threats are actually handled, and that the "move fast and break things" mentality is wrong for infrastructure 13:00-13:15.

Key Takeaways:
• pfSense Community Edition remains a solid open-source packet-pushing firewall, but the new Nexus UI and features like Core DNS are exclusive to the closed-source pfSense Plus, creating an effective fork 5:59-6:43.
• UniFi's edge-first architecture keeps the control plane local, meaning if the cloud goes down, firewalls keep passing packets—addressing a common criticism about cloud dependency 15:14-16:03.
• Firewalls alone don't stop modern threats; encrypted traffic limits their effectiveness, and most attacks now originate through browsers and endpoints, making EDR tools far more critical 12:05-12:53.
• Enterprise firewall pricing is inflated by sales pipelines, commissions, market development funds, and reseller lock-in—not just product development costs 44:00-46:06.
• Tom recommends revisiting products rather than forming permanent opinions based on first impressions, noting UniFi corrected its earlier cloud-registration requirement and now explicitly documents its edge-first philosophy 1:34:16-1:38:32.

Tom encourages a pragmatic, goal-oriented approach to tool selection—whether for firewalls, hypervisors, or hardware—rather than tribal loyalty to any single platform.

Sources:

• 2:04-2:25 Tom explains why he's making fewer pfSense videos and the Plus/Community split
• 5:59-6:43 New Nexus UI and Core DNS are pfSense Plus-only, not in Community Edition
• 7:22-8:05 Client with 2,000 locations moving to UniFi to escape subscription costs
• 12:05-12:53 Why endpoint security matters more than firewall inspection with encrypted traffic
• 15:14-16:03 UniFi's edge-first architecture keeps firewalls working when cloud is down
• 44:00-46:06 How sales commissions, MDF, and reseller lock-in inflate enterprise firewall pricing
• 1:34:16-1:38:32 UniFi's edge-first philosophy page and why revisiting products matters