Printable View
Untangle, I tried.. I tried to love you. But you hurt me with this last one. I gotta move on: http://www.oxygenimpaired.com/untangle-unravels
Seriously fellas. UT has a good thing going here and I hope it succeeds, but why play fast and loose with the core distro configs? Not cool.
Sorry, If you make unsupported modifications and then upgrade this will happen.
Thats why we put warnings everywhere when you log into terminal and why we insist that making changes at the terminal level are not supported. It has nothing to do with "warranty."
Feel free to do it, but it will break.
Yes.. I get it. I should have known better than to try to do anything else on an Untangle box than what's explicitly provided by the instruction manual. I colored outside the lines and I got slapped for it.
Come on though guys.. I realize dinking around in the vm would expect to screw things up and be overwritten, but the core distro configs, really? Hacking up a little extra functionality is the innovative core of most open source based projects. I posted all my mods back for the community. You can't leave a little room for us to do this by honoring standard practices for updating the core OS? Seems to be a divergence from your project's own open source roots.
And what's the point of being able to list "protected" files in the admin interface if UT's just going to piss on them anyway? If there's certain file protections that UT's going to ignore, would it be so hard to toss us a little documentation so we'd know in advance? I read though all the docs/wiki/forum ahead of time and tried hard only to customize the system in ways shouldn't have any reason to run afoul of updates, so I was a little surprised when UT curb stomped on the base Debian standards with the update.
Take the feedback as you wish.. but in this market of growing competitors it is offered as food for thought. Not to bash.
Guess I'll take my crayons and go now. Thanks.
if they leave room are you going to be the one person who goes out to sites who have a UT box that goes down because someone modded something they didn't need to and screwed up, thus resulting in a dead box that UT would now have to support cause they allowed you to do it? Or because untangle ignore a file because of permissions you changed so now the upgrade fails half way and again your looking at a dead box.
Untangle isnt meant to be an open source "have some head room to play around with" box, if you want that go install OBSD / FBSD and built your system from the ground up.
UT is about stability, and for people who dont want to play around with core files, because they have no need to. I like to play with everything i can, but i leave untangle alone.
I am sure if you went over to pfsense and starting playing around with core files, and update would scrap that as well, or other UTM systems.
@Mathiau - Let's not have an argument I never tried to make. It should always be clear to any client that tinkering with stuff would void a support agreement and I've never tried to say UT should maintain or support user customizations. What I am saying is that they could at least avoid stomping on standards and intentionally breaking things they wouldn't have to by taking just a small amount of care.
I'm not even sure how to comment on "Untangle isnt meant to be an open source". The system is built on the back of Debian and packages provided by the opensource community. Most the core UT code is GPL'd.
And no, I'm not on to pfSense, I'm testing out another solution that's based on Ubuntu Server and initially appears to provide a more clearly defined interface with the core OS through standard package management and typical expected linux behaviors (and documentation that explains the relationship). I'm not going to mention names as I have no intention of pulling users away from UT (even if anyone cared what I think). UT is a good solution and I'm thankful I had the opportunity to use it. I personally just think it would be even better if they played a little nicer with the general hacking community to allow tweaks for those with the experience and environment to do so. "One size fits all" has never been the OS community way.
It isnt an argument, but it is what would happen if they left things the way you want them
so by not stomping on standards and allowing people to change things, which will result in UT it's self possibly breaking is a better option?Quote:
What I am saying is that they could at least avoid stomping on standards and intentionally breaking things they wouldn't have to by taking just a small amount of care.
this isnt an OS, it is a UTM, it has a specific job to perform, and this allowing people to do what they want with it would result in possible down boxes and thus creating headaches for many people who aren't experienced like your self deciding to play around with things.
You have to remember, the hardcore users are far and few between, we are a minority, i am willing to be that %99 of UT income come from boxes hosted for people who can barely SSH into the system...
Then someone better go tell RedHat, Ubuntu and a slew of other businesses built on OS projects that their model doesn't work.Quote:
Originally Posted by Mathiau
It's simple, you want an Ubuntu business support contract, then you'll be limited in your freedom to configure/customize. But for those that don't need a support contract, you're free to customize at-will. Nobody from Canonical's going to come help if you break things, but they won't do it intentionally either. Everything is documented, including the update behaviors, and everything follows LSB standards to the extent possible.
If you define and document the VM hooks and dependencies then folks can easily make their own decisions. Again, the difference is between commercial supported product and community. UT is certainly free to ignore the greater OS community and make a go only on commercial product, but that business model hasn't proven successful for most that have tried. To me it feels like UT tolerates the OS community because they have to, but would much rather see us go away. I got the hint, and won't bother trying to contribute where it's not wanted.Quote:
Originally Posted by Mathiau
You are deducing our stance towards the open source community and our desire for your contributions from our upgrade policy? You keep asking about documentation. It *is* clearly documented that changes made at the command line are not supported. You chose to make them anyway. I know you saw the warning, because you set a shell password which requires you to read the warning *every* time you open the terminal.
It is also quite clear that dpkg is set to non-interactive and aggressive options are --force-confnew and --force-yes are used on dist-upgrades, and that will clobber file-level changes. You keep talking about Ubuntu and Debian but their upgrade process is irrelevant, this is Untangle. It is not Debian nor Ubuntu. (Maybe you're confused because is uses dpkg?) Untangle upgrades happen 99.9% of the time in the background and are non-interactive processes. Unlike Debian and Ubuntu, It can not ask questions of the user because the user is not there. The whole upgrade process has a different design. If you disagree with this design, thats fine, but your crazy wild deductions about our stance to the open source community and your contributions based on this are just silly.
@dmorris - I'm not making that statement based on "upgrade policy". I'm making it based on the statements that any customization "will break". I can understand "not supported", but that's vastly different from "will break".
How about "here's a community guide to customize UT (at your own risk and not supported)". Toss a page/section on the wiki that documents behaviors such as the "--force-confnew" and others that would need modified if folks want to do CLI customization of the system to add a few packages. Simply telling folks "no modification" and hanging no trespassing signs all over the system is not embracing open source. Neither is putting up a "hacks" section just to post "it's going to break" across half the threads.
I'm glad to hear you clarify "we're not Debian". I wish I would have understood that better before starting with UT. I (and likely others) only considered trying UT because it's based on an open, standards based operating system like Debian. I naively figured that would give me the flexibility I'm accustomed to with a linux platform and UT would "play nice" with community tweaks. I didn't realized going in you guys considered it a closed platform, and that's my fault; but in all fairness, your guys' OS "marketing" paints a different picture:
http://www.untangle.com/About-Us/The-Untangle-Story
Look.. again (again, again, again)...... I think UT is a good project with lots of potential. I personally feel it would be better off and develop more quickly with a more open approach to the "community edition" side of things.. but that's just my two cents. I can be wrong (hell, ask my wife, she'll tell you). It's your project, you'll do what you want.. this is just the honest opinions of one lonely user trying to provide some feedback.
they may not be so open because they do need a form of revenue to come in to pay for costs, so if they opened things too much they would become moonwall or another project which sites tale, even pfsense, for years on the same version with little to no innovation.
@Mathiau - never asked or expected UT to open up the proprietary add-ons. I'm talking about the core "Lite" system that the community uses. It's GPL'd. The code is legally available to everyone. That's a non-issue.
Revenue comes from propriety add-ons and support. My experience is that the "hacking" community for personal projects is often the same group of techies influencing IT purchasing decisions at work.
so since the code is legally available to everyone, UT is free to do with it as they wish :) to make their product work the best way they can which includes writing over custom files via upgrades.
i know it is nice to be able to open everything wide up, but in the end , to me, i think it is more headaches than it is worth for the likely very very few people who would actually venture into modding it as you have.
err.. okay. thanks.
For what it's worth, I like Untangle (despite its idiosyncrasies) and we are using it as the gateway to a rather large (430 node) network for one of our excellent clients, but the prices for the pro modules for Untangle are just too high for the budget I am allotted by my client. I like the interface--but my client doesn't care about how pretty the GUI is nor about how easy or hard it is to configure. Our solution is going to have to migrate to pfSense and we'll use interns from ECPI to program it. I know there's lots of potential nightmares in this scenario, but it is what it is. I really encourage the good folks of Untangle to re-examine their pricing schema. Untangle appeals to open source server environments, not MS Windows environments--so there is no "expectation" to pay high prices like there is in a shop where Microsoft is gouging their budgets already or where it is being compared to other proprietary solutions like Baracuda, Cisco, etc. Just my two cents...
I'll give you the pricing needs work, numbers pulled from the Untangle store
1 Year Premium Bundle
10 Users: $540 | $54 / User
50 Users: $1,080 | $21.6 / User
150 Users: $3,240 | $21.6 / User
500 Users: $5,400 | $10.8 / User
1500 Users: $10,800 | $7.2 / User
So either the 10 user price is way too high, or the 50 user price is way too low.
Also, I suspect in your case you've simply sold the product wrong. Because the price of Untangle at present values + hardware in every case I've deployed it has been at least half the price of the nearest competing product from Cisco / Baracuda / whatever.
I'm not ok with the "open source must be cheap" thinking. It's silly. PFSense will never do what Untangle does. It simply wont, if your client is OK with that then go for it. For me, UT's defensive faculties are sufficient enough for me to tell customers you simply won't get viruses anymore. That statement alone is worth the money because it saves every penny UT costs in downtime every year.
That said I wish they'd straighten up the price line up... it makes my OCD twitch!
Ok, so a quick network scan reveals my client has 445 unique devices on the network, which means that the annual cost for the Premium Package would be $9,612-- so subscribing to Untangle is more expensive than the billable time for my staff to duplicate all the functions of Untangle (yes, I know this is not a perfect 1:1 comparison, but it's close enough) using existing open source tools and software. I'm sorry, but "convenience and ease of use" is just not enough of a draw when the only people who will actually program the unit will be highly qualified systems administrators anyway...
Let's do the math... $9,612 equals about 565 man-hours per year. I feel pretty certain that they can manage an Untangle replacement in less than three and a half months of working on nothing else...
Again, not trying to be argumentative... just trying to make a point about why the client to whom I am referring will never subscribe to any of the packages.
^^^ if they can do that they should release it then the public...
if they can do it then why hasn't pfsense, or moonwall, or the numerous other open source projects with teams working behind it then?
Ditto, You cannot do what you're saying.Quote:
Originally Posted by Mathiau
Untangle is sitting on YEARS of development time and while it is a collection of open source products, the way it's deployed makes it much more than a sum of the parts. The Web Filter isn't some fly by night thing, that zVelo monster is the best filter on the planet, and Untangle is the CHEAPEST WAY to get access to it. There isn't a community filter on the market that comes close.
The Virus blocker, either the new Commtouch or Kaspersky version is irrelevant is similarly priced.
My point is, the Web Filter alone costs what Untangle is asking for the entire premium bundle when purchased anywhere else. There are some exceptions where you can get a Web Sense or similar filter for less month than Untangle wants, but if you start adding in the time savings for the customer it rarely makes any sense to use something else.
I've run the number too, and I've got the experience to do what you're describing. Heck I used to DO what you're describing. It can't be done, not in a way that is fair to your client.
I submit that if you are indeed replacing Untangle with several devices manually configured, you weren't using Untangle to start with.
There are many projects sitting on top of years of development-- take the Elastix distribution of Asterisk as a prime example. That is not an argument in and of itself.
You are probably right that Untangle has achieved a specific mix of integration which has been customized to a large degree-- no argument on that part.
But, ultimately, the issue is that Untangle should charge what the market will bear. And at least my little corner of the market cannot bear to go to one of my larger clients in good conscience and recommend the premium package at its current price, no matter how well it is coded--but I wish the good folks of Untangle all the success they can earn.
And why is that? The number doesn't match a preconceived threshold?
Please don't misunderstand me, I understand what you're saying. What I'm trying to point out is Untangle's real competition is MORE expensive.
Of course if you can duplicate enough of UT's features with free products, and sell that integration to your customer as labor, then you get to keep a larger percentage of the project as profit. I'm in the same boat with Intouch.
Heck Untangle is so good at preventing viruses that it actually negatively impacts my bottom line because I do fewer virus removals. That said, I HATE doing that work so watching it go away isn't entirely bad.
So I guess I want to ask, what products have you researched to come to the conclusion that Untangle is "too expensive"?
Quote:
Originally Posted by sky-knight
Bluecoat on a Zyxel USG series comes to mind.
.
I am still trying to figure out the quote below? if you have 445 devices, you noted $9612 of an annual cost? According the the Untangle store, UPTO 500 seats is $5400/yr, where is the other $4212 in expenses coming from? I admit I just skimmed this thread, but I am never deciphered this one?
Quote:
Originally Posted by izrunas
I have to assume Untangle has carefully considered their pricing. Some of the modules include 3rd party license costs that they probably do their best to negotiate down to the minimum, but at the end of it they have to set a price that covers their development costs and pays their bills.
I agree that the small user-count prices are pretty steep. None of my clients would even consider the premium package, nor the slightly cheaper standard package. I finally have one about to buy WAN Fail-Over, only because they bought the UT box from me specifically for the purpose of putting in a backup WAN connection. I've talked with them and a couple others about a paid package, but the conversation ended quickly when the price came up (as I knew it would). Most small businesses just aren't going to pay those kinds of per-seat prices. In fact the only way I got Untangle in to most of those clients was the assurance that they'd pay one time for the box itself, and there'd be no on-going fees.
Hence the reason why over 90% of all of my sales go without subs.
The prices aren't unfair, the issue is one of perception on the part of the business owner. I have all of my supported customers on paying subs except one.
Why isn't that one on a paying sub? Easy... they didn't want Untangle. I wanted Untangle, and it's primary purpose is to give me an OpenVPN service to attach to so I can manage stuff.
Why? Because $500 is NOTHING compared to the cost of having a single station down with a single virus. If the SMBs want to buy cheap Walmart Dells to run on, then they pay the price in other areas. If they don't buy, they pay more in other fees to stay functional.
Use a downtime calculator, show them what they are loosing. Give them the option of recapturing the income. If they don't well you get to make even more money off them because they are making silly business decisions.
Of course the real issue here, most of my local clients... you can't get blood from a turnip. I don't know of a single customer that is doing "well". Most that are still open are just able to pay bills.
You simply aren't going to sell an Untangle to a client that is still thinking Linksys. They need to get hit hard by a massive virus, or employee misconduct before they'll even see a need in most cases.
Sonicwall, you get a device and subscriptions for the price of a 10 user untangle subscriptions. Also could mention cyberroam, gateprotect, etc and this is for unlimited users and is more based on the Internet connection speed and you size the hardware to your Internet connection or throughput you need.Quote:
Originally Posted by sky-knight
I think untangle biggest down fall is the hardware is just to expensive.
The venders above are pretty much giving away hardware.
I really think untangle needs to take in consideration that if they want a true SMB product they need to be in the range of $400 to $600 with hardware not closer to $1000 to $1200
Granted you could hack a server or buy a used one but how many people feel comfortable showing up on the door step of a customer with a used piece of hardware saying this is your new firewall?
I know you can run apps for free but they are limited and a tease we want the good stuff.
If untangle wants to get serious they need to sell and all in one solution hardware and all.
they do sell their own hardware...but they really don't need to. There are several very good resellers that provide hardware and the warranty plans as well. If somebody else's hardware is too expensive you can easily throw together your own hardware.Quote:
Originally Posted by rtrice81
lol, i knew someone would say this.Quote:
Originally Posted by hescominsoon
pain and simple i can't sell an untangle box to a client with 5 to 15 users as the price for the hardware and software is around 1k, when a sonicwall is around $600
have you checked the feature set with both at the same price? Have you looked at the weaknesses of sonicwalls cloud based dependence as compared to more localized on UT? The hardware on a sonicwall is really nothing more than a linksys type router that offloads everything off to the cloud. That works as long as you don't have any kind of instability between your router and sonicwall's cloud. I've looked at their products and frankly in many areas but most importantly performance they can't hold a candle to even one of sky's "low end" atom based appliances. Sure the sonicwall is cheaper. But at half the price there's quite a bit the sonicwall doesn't do compared to what the UT does not only for free..but if you pay the $549 extra the other benefits you get. Really it's a problem with not properly explaining the value..instead of just going for the bottom line.
BTw i am referring to sonicwalls lowest priced appliances since they are the only things comparable in price in regards to this thread.
If $400 is a make or break number for a client for such a vital piece of infrastructure, they would not be a client of mine. I don't deal with cheap. I deal with right.
If you want a cheap solution, there's plenty of other consultants who will happily provide that service. They are a dime a dozen. In fact, I'm pretty sure I seen a cardboard sign off the side of the road for Fred's computer repair right down the street. Call Fred, I'm sure he will help.
If you want the right solution, then give me a call. I'll do my best to provide the right solution for your situation. It isn't going to be the cheapest, but it will work the way I say it'll work and i'll stand behind it 100%.
Right down to drop shipping drives and eating the cost to cover warranties...
SSD tech... what crap.
Anyway, I've got some fun stories about Sonicwall. My mere presence has the nasty tendency to cause the router to fry.
Oddly enough most of my support customers that use Untangle Premium were Sonicwall customers before. UT support may keep bankers hours, and they make their mistakes... but they are infinitely better than some clueless Indian in a call center.
Furthermore, have you run a port scan on the exterior of a Sonicwall? There's an SSH backdoor... Untangle has an IRC back door, but that is turned on and off with a tick-box.
I'll leave Instagate, Watchguard, Firebox, Threatwall, and Bluecoat out of this discussion because... well I'm not happy with them all.
I used to build my own custom firewalls on OpenBSD because of the insanity cause by those vendors. Have you ever seen the look on a customer's face when you install a "Linux box" at the edge of their network and show them a nice report of all the crap that one of those boxes lets through? This specific client had their entire network infected by a Chinese trojan and the Threatwall / Instagate combination didn't even have a clue it was there. Yet they lost internet connectivity every day at 5pm thanks to the bug firing up and moving illegal software and porn around.
I had to reformat that entire network in one shot... Untangle isn't perfect but because it lets me under the hood I have all the tools in the world to troubleshoot ANYTHING network related. It hands me stuff I can't get with high end Cisco equipment. For "free".
Anyway, I believe Untangle has shown some interest in doing the cloud based thing to get that price down. The future will bring many options I'm sure. Because, more than anything else, that's what I've seen Untangle be about since the beginning... Options.
No vendor lockin, just tools and performance.
SSD's work when properly supported....i don't think the current 9.1x kernels supports TRIM yet..dmorris?
it also depends on the SSD. If you aren't using Intel or OCZ you're taking a huge chance on how well the drive is going to work.
Exactly..:) I've downed many of these "routers" using simple tools on backtrack..not even the advanced stuff.Quote:
Originally Posted by sky-knight
Commenting from the SMB side, I didn't want to spend the money on the Premium subscription but for me:
The simplicity of configuration vs our current Cisco router, another VPN device, and at least more bandwidth needed, the subscription costs paid pretty much for itself.
I can't get this good of reporting and mgmt from multiple devices, I also can't touch many devices for as long as I can with Untangle and just come back without screwing it up when changing things.
The biggest thing for me was that it just works and I spend alot less time making changes and troubleshooting them compared to Cisco, use the premium package for awhile and you wonder what you did without it.
For a jack of all trades, I want easy things that work that I don't have to memorize.
Crucial, Corsair, Kingston, Micron, and OCZ...Quote:
Originally Posted by hescominsoon
They all fail at the same rates, check your warranty reports. The only name out there that doesn't is Intel, and those things cost more than the entire appliance in most cases.
In short, SSD tech is junk, but I'm stuck using it to meet price points. Fortunately, they do live at least a year in most cases. Jim and I spoke this morning, and due to the way these devices appear to be failing. We're no longer offering a "fan-less" device. The SSDs appear to be cooking... slowly. Anyone with one of my fan-less units is advised to pull the access panel off, attach the fan to the pin header, reboot the unit and turn on the thermal fan controls so it stays relatively silent. SSDs deployed in our other units with active cooling have shown ZERO returns... I don't think that's an accident.
I'm still trying to figure out how to make an official advisory out of this. But right now my health is dead... again. So I'm just drifting from thing to thing and doing what I can.
Don't mean to be a ball-buster, maybe I WAS right about the SSD in our NG-50F cooking :)Quote:
Originally Posted by sky-knight
It has been behaving just fine since we replaced the SSD and plugged in the cooling fan back in late Nov. I still haven't had a chance to test the SSD supplied with the NG-50F, but based on what you said above, I'm guessing it is no good. Want it back?
- Joe
If we've replaced it I'd appreciate it sent back so we can test it. If we didn't replace it then I need that drive so I can RMA it for you.
But yeah, yours was just one of the first. Most units are fine... that's the odd part. It's a small percentage that has failed, but it's significant enough for me to make some design changes. I don't like selling lemons.
And I wasn't doubting what you were saying, but at the time we only had 2 failures. Now we're something like 10... Which mind you is still within the statistical normal for drive failures. It's just that I can't ignore the fan enabled devices seem to not have the issue.
That's what I get for trusting manufacturer specs...