OPNsense partner since 2016
OPNsense protects your network with IDS/IPS, VPN and high availability, without licences per user or per feature. We plan the appliance, move you safely off your current firewall, run it for you and, if you wish, connect it to the 24/7 SOC of our partner NEOSEC.
Two paths, one familiar ending
Most organisations end up with one of two models. Both work for a while.
Path 1
Path 2
OPNsense combines both: open code and enterprise features, run like a commercial firewall.
Features
Everything included as standard, with no extra charge per feature.
Intrusion detection and prevention in inline mode, with open and optional commercial rule sets.
IPsec for sites, WireGuard and OpenVPN for mobile staff, each with two-factor authentication.
Two devices in a CARP cluster with synchronised connections. Updates and hardware replacement without interruption.
As many VLANs and zones as you need for administration, production, medical technology, guests and IoT.
Several providers with failover and load balancing, plus OSPF and BGP via plugins.
Every setting via REST API, configuration history with comparison and rollback.
Comparison
| Criterion | Typical commercial UTM | OPNsense |
|---|---|---|
| Licensing model | subscription bundles, some features licensed separately | Community Edition free, Business Edition per firewall |
| After licence expiry | protection features and updates often stop | firewall keeps running in full |
| Feature set | depends on the bundle | IDS/IPS, VPN, HA and web filtering included |
| Source code | proprietary | open (BSD licence) |
| Management | often vendor cloud | local, via API or centrally with OPNcentral |
| Release cycle | vendor-dependent | two major versions a year, in January and July |
| Switching later | expensive, proprietary configuration | open formats and complete documentation |
Migration
For each source system we describe what can be transferred, how, and what you need to watch out for.
Approach
A migration rarely fails because of the new firewall, but because of forgotten rules and special cases. That is why we start with what you already have.
Configuration export, discussion with your IT team, analysis of rules, NAT, VPNs, certificates and special cases. The hit counters show which rules are actually used.
Conversion into OPNsense logic: aliases, interface rules, NAT, VPN tunnels, user integration. We map vendor-specific features with built-in tools or plugins.
Set-up in the lab or in parallel in a test segment. We check critical applications, VPN tunnels and special cases against a shared checklist.
Cutover in a maintenance window following a runbook. The old firewall stays cabled and ready, and going back takes minutes.
Log analysis for blocked legitimate connections, fine-tuning of the rule set, handover of the documentation.
SOC with NEOSEC
If you wish, logs from OPNsense flow into the SIEM of our security partner NEOSEC. Depending on the level, NEOSEC monitors, supports or takes over the response, up to 24/7 operation.
Level 1
How do I start with structured monitoring?
NEOSEC sets up and runs the SIEM. Firewall, endpoint and network events are collected centrally and checked against proven rule sets.
Level 2
How do I get active support?
Managed detection and response: NEOSEC maintains the rule sets, assesses alerts and responds together with you along predefined paths.
Level 3
Who responds at night and at weekends?
Security operations centre around the clock. NEOSEC monitors, responds independently within agreed limits and documents every incident.
AI and MCP
Our in-house OPNsense MCP server gives AI assistants structured access to rules, interfaces, VPNs and logs. Every action is classified by risk, and critical changes require confirmation. If you wish, the AI runs entirely on your premises.
Which rules at the North site have not been used in the last 90 days?
Read rules, query hit counters
7 of 64 rules have no hits, including 2 permits for a VPN that has been shut down. Shall I disable them? I will create a restore point first.
Yes, disable them.
Create restore point, disable rules (risk level medium, confirmed)
Done. Restore point created, 7 rules disabled, can be undone at any time.
Who it is for
Several sites, home working, production and administration on the same network. Enterprise security without an enterprise licensing model.
OPNsense for mid-sized companiesMedical devices without updates, Germany’s telematics infrastructure (TI) and audit obligations. The firewall becomes the tool for segmentation and evidence.
OPNsense in healthcareWhy us
Not: copying lines
We analyse which rules actually match and transfer the logic, not the legacy clutter.
Not: hoping at cutover
The old firewall stays cabled until you sign off. Going back takes minutes.
Not: knowledge as lock-in
Structured so that another service provider could take over.
FAQ
The Community Edition is free of charge. Costs arise for hardware, optionally for the Business Edition (annual licence per firewall), and for setup and operation. There are no licences per user, feature or throughput.
The core components of OPNsense, such as the pf packet filter, Suricata, strongSwan and Unbound, are among the most thoroughly reviewed security projects. Deciso stands behind it as the vendor with commercial support, and we are there on site.
The cutover itself usually takes one to two hours in a maintenance window. Preparation and testing take from a few days to several weeks, depending on scope.
If you wish, our security partner NEOSEC. The logs flow into its SIEM, and depending on the level NEOSEC responds around the clock. More under SOC with NEOSEC.
Contact
An initial conversation with an OPNsense engineer, not a sales pitch. If OPNsense is not the right fit, we will tell you.
