pfSense 2.7.x ├── Squid 6.x (maintained by pfsense-packages team) │ └── requires ClamAV 1.x via c-icap │ └── c-icap compatibility with Squid 6 not guaranteed └── Suricata 7.x (separate update cycle) └── rule format may break with 7.0 → 7.1 minor update
pfSense 2.7.x ├── Squid 6.x (maintained by pfsense-packages team) │ └── requires ClamAV 1.x via c-icap │ └── c-icap compatibility with Squid 6 not guaranteed └── Suricata 7.x (separate update cycle) └── rule format may break with 7.0 → 7.1 minor update
pfSense 2.7.x ├── Squid 6.x (maintained by pfsense-packages team) │ └── requires ClamAV 1.x via c-icap │ └── c-icap compatibility with Squid 6 not guaranteed └── Suricata 7.x (separate update cycle) └── rule format may break with 7.0 → 7.1 minor update - Web proxy: squid package
- URL filtering: squidguard or pfBlockerNG
- Antivirus: clamav package (via ICAP integration with Squid)
- IDS/IPS: snort or suricata package
- WAF: modsecurity (limited integration path) - Check each installed package's compatibility with the target base OS version
- Read changelogs for breaking changes in each package
- Test in a staging environment
- Update base OS
- Update each package individually, verifying functionality after each - Additional processes running on the appliance
- Additional network ports that may be exposed
- Additional configuration files that must be secured
- Additional update surface requiring ongoing patching - Need deep per-component configuration control → plugin-based (pfSense / OPNsense)
- Need operational simplicity, coordinated updates, minimal maintenance overhead → integrated appliance (CacheGuard)
- Need a specific feature not available in integrated platforms → plugin-based
