From Lancom to OPNsense
In many networks a Lancom router handles internet access, VPN and firewall at the same time. That works until segmentation, attack detection and documentation obligations come into play. Separating routing and security then brings clarity.
At a glance
- Source
- Lancom
- Target
- OPNsense Business Edition
- Cutover
- usually 1–2 hours
- Fallback
- until sign-off
Starting point
Why operators switch
Lancom routers with an integrated firewall are solid devices. However, a full IDS/IPS, segmentation across many zones and central logging for SIEM and audits are not their focus.
Typical reasons
- router firewall without a full IDS/IPS
- licensed add-on options for VPN and security
- wish to separate routing and security
- central logging for SIEM and audits
Features
What becomes of your Lancom features
| Lancom | OPNsense | Note |
|---|---|---|
| Router firewall (stateful inspection) | Interface rules | logic is translated |
| IPsec VPN | IPsec (IKEv2) | peers are coordinated |
| Advanced VPN Client | WireGuard or OpenVPN with 2FA | new client profiles |
| Content Filter | Proxy categories or Zenarmor | policies are rebuilt |
| VRRP | CARP cluster | high availability with state sync |
| Routing, multi-WAN | Gateway groups, static and dynamic routing | fully supported |
| LANconfig, LMC | Web interface, API, OPNcentral | different concept, same goal |
Approach
How we migrate
Process
- Inventory of all devices that contain firewall logic
- Decision: the Lancom stays as router or modem, or is replaced
- Transfer of rules, VPNs and routing to OPNsense
- Testing and cutover in a maintenance window
- Follow-up support and documentation
What to watch out for
- Distributed logic: firewall rules are often spread across several devices. We record the entire network.
- Provider connection: with DSL or fibre, the Lancom often stays in front as modem or router.
The general process in five steps is described under Migrating to OPNsense.
FAQ
Questions about migrating from Lancom
Do we have to get rid of the Lancom routers?
No. The Lancom often stays in use as router or modem, and OPNsense takes over the firewall behind it.
What happens to the Lancom VPN client?
We switch to WireGuard or OpenVPN with 2FA and provide ready-made profiles.
Contact
Send us your configuration export
We will tell you what can be transferred directly, what cannot and what the migration will cost.