From pfSense to OPNsense
OPNsense and pfSense share common roots: OPNsense started in 2014 as a fork and has been available since January 2015. Since then the two have diverged considerably. The migration is manageable, but there is no import button.
At a glance
- Source
- pfSense
- Target
- OPNsense Business Edition
- Cutover
- usually 1–2 hours
- Fallback
- until sign-off
Starting point
Why operators switch
pfSense is split into the free Community Edition and the commercial pfSense Plus. Many operators wonder what the future holds for CE. OPNsense offers a fixed release cycle, a consistent API and a European vendor.
Typical reasons
- uncertainty caused by the split into CE and Plus
- fixed release cycle in January and July
- consistent REST API for automation
- European vendor with an open development process
Features
What becomes of your pfSense features
| pfSense | OPNsense | Note |
|---|---|---|
| Interfaces, VLANs | Interfaces, VLANs | directly transferable |
| Aliases | Aliases | including URL tables |
| Firewall rules | Firewall rules | same engine (pf), transferred carefully |
| NAT | NAT | fully supported |
| IPsec, OpenVPN | IPsec, OpenVPN | including certificates and CA |
| WireGuard package | WireGuard (built in) | peers are transferred |
| pfBlockerNG | Unbound blocklists, URL aliases, CrowdSec | check case by case |
| HAProxy, ACME | HAProxy and ACME plugins | available |
| Squid, SquidGuard | Proxy plugin or Zenarmor | policies are rebuilt |
| CARP, HA | CARP, HA | same concept |
Approach
How we migrate
Process
- Backup of config.xml and the package list
- Matching each package to its OPNsense counterpart
- Transfer of interfaces, aliases, rules, NAT and VPNs
- Testing in the lab or in parallel
- Cutover in a maintenance window, pfSense as fallback
- Follow-up support and documentation
What to watch out for
- No direct import: the configuration files look similar but are not compatible.
- Packages: not every pfSense package exists as an OPNsense plugin in the same form.
- Same engine: both use pf, so the rule logic is familiar. That reduces the risk considerably.
The general process in five steps is described under Migrating to OPNsense.
FAQ
Questions about migrating from pfSense
Is migrating from pfSense easier than from other vendors?
Yes, because both are based on pf and use similar concepts. We still transfer in a structured way rather than by import.
What happens to pfBlockerNG?
OPNsense offers DNS blocklists in Unbound, URL tables as aliases and the CrowdSec plugin. Together they cover the typical cases.
Can we keep using the pfSense hardware?
With x86 hardware, usually yes, provided it is still under warranty and powerful enough. We check this in advance.
Contact
Send us your configuration export
We will tell you what can be transferred directly, what cannot and what the migration will cost.