Zenarmor
Layer 7 application control and web filtering.
OPNsense overview
An open-source firewall and routing platform based on FreeBSD, developed by Deciso B.V. in the Netherlands and available since January 2015. Functionally on a par with commercial next-generation firewalls, but different in licensing and transparency.
Fact sheet
- Vendor
- Deciso B.V., Netherlands
- Base
- FreeBSD, pf packet filter
- Licence
- BSD-2-Clause
- Releases
- January and July
- Since
- January 2015
Origins
Where OPNsense comes from
OPNsense started in 2014 as a fork of pfSense, with the aim of rebuilding code quality, security and openness from the ground up. Since then the platform has been fundamentally reworked: a new interface, a consistent REST API and a modular back end.
Architecture
- FreeBSD as the operating system
- pf as the firewall engine
- Suricata for IDS/IPS
- Unbound for DNS, strongSwan for IPsec
- every setting also available via API
Security at the core
- regular security updates from signed package repositories
- two-factor authentication for the web interface and VPN
- role-based permissions for administrators
- no telemetry to the vendor, no mandatory cloud
Features
Feature set
| Area | Features | Typical use |
|---|---|---|
| Firewall | stateful packet filter, aliases (hosts, networks, ports, GeoIP, URL tables), rule groups, schedules, floating rules | zone separation, segmentation, access control |
| NAT | port forwarding, outbound NAT, 1:1 NAT, NPTv6, NAT reflection | publishing internal services |
| Routing | gateway groups, multi-WAN with failover, policy-based routing, OSPF and BGP via FRR | two providers, site networks, data centre |
| VPN | IPsec (IKEv1/IKEv2), WireGuard, OpenVPN, client export | site-to-site links, home working, field staff |
| IDS/IPS | Suricata in IDS or inline IPS mode, ET Open rules, optional commercial rule sets | detecting and blocking known attacks |
| Web and applications | proxy with category filtering, optionally Zenarmor for Layer 7 control | web filtering, making shadow IT visible |
| DNS and DHCP | Unbound with blocklists and DNS over TLS, Kea or Dnsmasq | central name resolution, blocking malware domains |
| High availability | CARP, pfsync, configuration sync | maintenance and hardware faults without downtime |
| Authentication | local users, LDAP/Active Directory, RADIUS, TOTP | securing VPN and admin access |
| Operations | configuration history with rollback, automatic backups, REST API, NetFlow, Telegraf, Zabbix | traceability, automation |
Plugins
Extensible without bending the base
CrowdSec
Shared blocklists against known attacker IPs.
Wazuh agent
Connection to SIEM and SOC, for example at NEOSEC.
ACME
Automatic Let’s Encrypt certificates.
HAProxy and nginx
Reverse proxy and load balancing for published services.
FRR
Dynamic routing with OSPF and BGP.
Editions
Community or Business Edition
Licensing is per firewall, not by users, throughput or features.
| Community Edition | Business Edition | |
|---|---|---|
| Cost | free of charge | annual licence per firewall |
| Code base | identical core | identical core |
| Releases | new features first | mature releases with a time lag |
| Additional features | – | including OPNcentral for multiple firewalls |
| Package source | community mirror | commercial repository |
| Our recommendation | lab, testing, small environments | production use in companies, medical centres and hospitals |
To be honest
Where OPNsense fits, and where it does not
Ideal for
- perimeter firewall with IDS/IPS
- segmentation of internal networks and OT
- site-to-site connectivity and home-working VPN
- high-availability clusters
- environments with documentation obligations
Where we advise against it
- if a vendor cloud is mandatory for management
- if endpoint integration such as Sophos Synchronized Security is central to your concept
- if the email gateway is to run in the same box
Release cycle: OPNsense releases a new major version twice a year, in January and July (scheme YY.1 and YY.7). In between, security and bug fixes follow regularly. This lets you plan maintenance windows a year in advance.
FAQ
Frequently asked questions
Is OPNsense the same as pfSense?
No. OPNsense emerged from pfSense in 2014 but has since been developed independently and largely rewritten. The interface, API, release cycle and vendor are different.
Does OPNsense also run virtually?
Yes, on Proxmox, VMware, Hyper-V, KVM and in the cloud. As a perimeter firewall we usually recommend dedicated hardware.
What happens when the Business licence expires?
The firewall keeps running in full and can be switched to the community package source.
Contact
Is OPNsense right for your network?
We will give you an honest answer, even if it is no.