Frequently asked questions about OPNsense
The objections we hear in almost every initial conversation, and our honest answers.
FAQ
Frequently asked questions about OPNsense
What does OPNsense cost?
The Community Edition is free of charge. Costs arise for hardware, optionally for the Business Edition (annual licence per firewall), and for setup and operation. There are no licences per user, feature or throughput.
Is open source not a risk for a business?
The core components of OPNsense, such as the pf packet filter, Suricata, strongSwan and Unbound, are among the most thoroughly reviewed security projects. Deciso stands behind it as the vendor with commercial support, and we are there on site.
How long does a migration take?
The cutover itself usually takes one to two hours in a maintenance window. Preparation and testing take from a few days to several weeks, depending on scope.
Who monitors the firewall at night?
If you wish, our security partner NEOSEC. The logs flow into its SIEM, and depending on the level NEOSEC responds around the clock. More under SOC with NEOSEC.
Is OPNsense the same as pfSense?
No. OPNsense emerged from pfSense in 2014 but has since been developed independently and largely rewritten. The interface, API, release cycle and vendor are different.
Does OPNsense also run virtually?
Yes, on Proxmox, VMware, Hyper-V, KVM and in the cloud. As a perimeter firewall we usually recommend dedicated hardware.
What happens when the Business licence expires?
The firewall keeps running in full and can be switched to the community package source.
Why not just use a mini PC?
For lab and test use there is nothing against it. In production, what counts is network chips with stable drivers, endurance under continuous load, warranty and spare parts. That is why we rely on tested hardware.
What happens if the hardware fails?
In an HA cluster the second device takes over without interruption. For single devices we restore the backed-up configuration onto replacement hardware.
Is the Business Edition included in the price?
We include it in our quote if you wish. It is licensed annually per firewall.
Can we simply import the old configuration?
No, and that is a good thing. Even between pfSense and OPNsense there is no reliable direct import. The structured translation is the opportunity to get rid of legacy clutter.
What happens if something does not work after the switch?
The old firewall stays cabled and ready until sign-off. If in doubt, we switch back within minutes, analyse the issue and try again.
Do our staff need to do anything?
If the VPN technology changes, they install a new client. We provide preconfigured profiles and a short guide.
How often do you install updates?
Security-relevant updates promptly, major versions after a maturing period in agreed maintenance windows.
Do you need remote access for this?
Yes, via a secured management access with 2FA that you can block at any time.
Can we continue to make changes ourselves?
Of course. We agree roles and permissions so that changes remain traceable.
Do we need our own SIEM for this?
No. NEOSEC sets up and runs the monitoring. You get access to the customer portal with status and reports.
Which data leaves our network?
Security-relevant events from the firewall and connected systems. We agree scope and retention in advance, and processing is governed by contract.
Does this work without OPNsense?
Yes. NEOSEC also monitors other firewalls, servers and endpoints. With OPNsense the connection is particularly simple, because the Wazuh agent is available as a plugin.
Which AI assistants work with it?
All assistants and tools that support the Model Context Protocol, as well as local models via Ollama. We advise you on the choice.
Can the AI take the firewall down?
Only with the permissions you grant. Critical actions such as a reboot require explicit confirmation and are rate-limited. The read level is sufficient for analyses.
Is this included in operations?
The managed firewall includes a regular AI configuration analysis with a report. In the maintenance contract it is optional.
We do not have a network specialist. Can this still work?
Yes. We take over setup and operation entirely or support your IT where it needs backing.
How do we connect production securely?
Via a dedicated segment with minimal permissions. Remote maintenance by machine manufacturers runs only via VPN with time-limited access.
Does OPNsense help with NIS2?
The firewall provides segmentation, logging and access control. For risk management, incident reporting and SOC we work with NEOSEC, see SOC with NEOSEC.
Does the firewall affect the TI connection?
No, if it is configured correctly. We know the communication relationships of the connector and card terminals and map them precisely.
What about medical devices without updates?
Segmentation is crucial precisely for these devices. They only talk to the systems they actually need.
Can manufacturers still carry out remote maintenance?
Yes, via VPN with 2FA, time-limited and logged. That is more secure than permanently open access.
Who is liable if something goes wrong?
As with any firewall, this is governed by your contract with us and the manufacturer’s warranty for the hardware.
Does OPNsense meet the requirements of NIS2, B3S or cyber insurance policies?
The firewall provides the technical building blocks: segmentation, IPS, 2FA, logging and high availability. Compliance comes from technology plus documentation and processes, and we provide both.
Do we need our own OPNsense expertise?
No. We take over operations entirely or train your team as far as you wish.
Contact
Your question was not answered?
Ask an OPNsense engineer directly.