From Sophos to OPNsense
The Sophos SG UTM reached end of life on 30 June 2026. Since then there have been no security updates. Anyone still running a UTM is running an unpatched perimeter system. A switch is due anyway. The only open question is the destination.
At a glance
- Source
- Sophos
- Target
- OPNsense Business Edition
- Cutover
- usually 1–2 hours
- Fallback
- until sign-off
Starting point
Why operators switch
Sophos offers a move to Sophos Firewall (SFOS), usually with new XGS hardware. That is not an update but a full migration to a different platform with a different interface, different rule logic and new licence bundles. If the effort is coming anyway, it is worth comparing with OPNsense.
Typical reasons
- no more security updates for the SG UTM
- XGS means new hardware, a new interface and new licence bundles
- ongoing subscriptions for features that OPNsense provides at no extra cost
- preference for open code and a European vendor
Features
What becomes of your Sophos features
| Sophos | OPNsense | Note |
|---|---|---|
| Network definitions | Aliases | hosts, networks, groups and FQDNs transfer cleanly |
| Firewall rules | Interface rules, floating rules | logic is translated, not copied |
| NAT, DNAT, SNAT | Port forward, outbound NAT, 1:1 NAT | fully supported |
| Intrusion Prevention | Suricata IPS | ET Open, optional commercial rule sets |
| Web Protection | Proxy or Zenarmor | policies are rebuilt |
| Application Control | Zenarmor | Layer 7 detection |
| Site-to-site VPN | IPsec (IKEv2) | peers are coordinated in advance |
| SSL VPN, remote access | WireGuard or OpenVPN with 2FA | new clients with ready-made profiles |
| RED devices | small OPNsense with IPsec or WireGuard | no direct equivalent |
| Web Application Firewall | HAProxy or nginx as reverse proxy | check feature scope case by case |
| Email Protection | – | separate mail gateway recommended |
| HA (active-passive) | CARP cluster with state sync | maintenance without interruption |
Approach
How we migrate
Process
- Export of the UTM configuration, analysis of hit counters
- Clean-up of unused rules and objects
- Translation of objects, rules, NAT and VPNs
- Rebuild of web and application filtering
- Coordination with VPN peers, testing in the lab
- Cutover in a maintenance window, the UTM remains as a fallback
- Follow-up support and handover of documentation
What to watch out for
- Email Protection: if the UTM also filters email, we plan a separate solution for it.
- RED branch offices: each RED is replaced by a small firewall. Usually more stable, but it needs hardware on site.
- SSL VPN clients: staff get a new client with a ready-made profile.
- Synchronized Security: the endpoint integration is dropped. Segmentation and SIEM integration close this gap.
The general process in five steps is described under Migrating to OPNsense.
FAQ
Questions about migrating from Sophos
Can I not just keep the UTM running?
Technically yes, responsibly no. A perimeter firewall without security updates is an open door. Under NIS2, KRITIS (German critical infrastructure regulation) or insurance requirements, that is hard to justify.
Can we reuse the Sophos hardware?
Some older SG hardware is x86-based and can in principle run OPNsense. For production we advise against it, because warranty and vendor support are no longer available.
How long does the switch take?
For a single site, usually a few days of preparation and a maintenance window of one to two hours. We migrate multiple sites in stages.
Contact
Send us your configuration export
We will tell you what can be transferred directly, what cannot and what the migration will cost.