OPNsense is an open-source, FreeBSD-based firewall and routing platform developed by Deciso, designed as a comprehensive network security solution for home, small business, and enterprise environments. It combines the feature set of expensive commercial firewalls with the transparency of open-source software, offering a stateful firewall, intrusion detection and prevention, VPN connectivity, web filtering, traffic shaping, and two-factor authentication — all managed through an intuitive web interface.

Originally forked from pfSense in 2015, OPNsense has evolved with a focus on code quality, security auditing, and a clean modern user interface. It uses a hardended FreeBSD base and includes Suricata for inline intrusion prevention, Netflow for traffic analysis, and a plug-in system for extending functionality. The platform is free and open-source under the BSD 2-Clause licence, with optional commercial support subscriptions from Deciso.

Key Features

• Stateful inspection firewall — High-performance packet filtering with state tracking, NAT, port forwarding and rule-based access control
• Intrusion Detection and Prevention (IDS/IPS) — Suricata integration for real-time traffic analysis and automated threat blocking
• VPN gateway — OpenVPN, IPsec, WireGuard, L2TP, and PPTP with easy-to-configure site-to-site and remote-access tunnels
• Web filtering — Integrated proxy, content filtering with blacklists, and additional filtering via plug-ins (ZenArmor, Sensei)
• Traffic shaping — Limit bandwidth per-rule or per-queue with ALTQ and dummynet for QoS management
• Multi-WAN — Load balancing and automatic failover across multiple internet connections
• Captive portal — Guest network authentication with voucher support and external RADIUS integration
• Dynamic DNS — Built-in client for over 30 DDNS providers
• Two-factor authentication — TOTP, YubiKey, and Google Authenticator support
• Traffic monitoring and reporting — Netflow export, RRD graphs, real-time traffic visualisation, and per-rule statistics
• REST API — Full API for automation and integration with external systems
• Plugin system — Extend functionality with over 100 community and official plug-ins

Differences from pfSense

OPNsense provides a modern, responsive web interface with a more frequent release cadence (monthly community updates). It includes Suricata IDS/IPS out of the box, offers a comprehensive REST API, and follows a more open development process with publicly audited code. OPNsense also uses an Auto-Updater for one-click upgrades between major versions, whereas pfSense requires manual upgrade paths for major version jumps.

Use Cases

• Home network firewall — Replace consumer router firmware with enterprise-grade firewall protection
• Small business gateway — All-in-one firewall, VPN concentrator, and traffic management for SMEs
• Edge security appliance — Deploy at network perimeter for IDS/IPS and multi-WAN load balancing
• Remote access VPN — WireGuard and OpenVPN server for secure remote worker connectivity
• Site-to-site VPN — Connect branch offices with encrypted IPsec or WireGuard tunnels
• Network lab and testing — Virtualised firewall for learning and testing network topologies

Platform

x86_64 (Intel 64 / AMD64) · FreeBSD-based (hardened) · Installable ISO, USB image, or virtual machine (VMware, Hyper-V, VirtualBox)

Licence

BSD 2-Clause Licence — fully open source with optional commercial support subscriptions from Deciso

Website

opnsense.org