OPNsense Open-Source Firewall, Router, VPN, and IDPS

I mainly use OPNsense for edge user firewall applications.

The functions I find most useful in OPNsense are basically the routes because we have a lot of routing that we do with it, VPN, and specifically WireGuard VPN. We also have the Zenarmor plugin because we do use the Zenarmor plugin, and disk monitoring log, ntop, as we also use it for ntop log monitoring.

When I talk about VPN, I am not completely satisfied with the VPN functions of OPNsense. What I have received so far is that sometimes the VPN route caches for some time and sometimes I want to change the route, but the route gets cached. So I have to sometimes delete it and then do another route again. Or if I want to use the same route but just change the gateway, it will not take effect unless I delete the whole thing and then do it all over again. That is the only issue, but that is acceptable.

In terms of real-time filtering, I think OPNsense can do more. Looking at other products, they do more of the filtering, and I think OPNsense can look at it. I want to have something like top talkers in a live view, and I want to have some amount of data being stored for maybe over a period of time. Instead of going through additional plugins with extra costs, if I am paying for a premium service on OPNsense, those features should come with it. I should not have to pay extra again.

For points of improvement, instead of going through VPN plugins and extra costs, they could just include it as part of the package and not make me pay extra. If I know I am paying for a premium service for a year, I should not have to pay for other features like ntop, especially for log monitoring, which is very necessary. I need to monitor my logs and be able to save some amount of data over a period of time. It should not always be live. Because if I have a day or let us say within forty-eight hours or more, I want to know the IPs and the packets going to and from. Since it is doing a lot of filtering, I want the data for what kind of filtering it has done over a period of time, illustrating which IP was trying to pass a packet of this nature towards this destination. I want all of that, something approaching using Wireshark to capture a packet. All those packets going through Wireshark are definitely going through OPNsense if I am capturing the packet from outside of my network. If I can have that data sitting somewhere and I have a problem, I can start troubleshooting from that data. I can say, okay, this IP is going to this destination, this is the packet being pulled, and this particular IP is a top talker. All of that would help me know where to look first without going through a whole lot of sequences just to get something small.

I have been working with OPNsense for four years now.

For stability, ten is the best mark, and I would give OPNsense an eight because sometimes when I put in a filter or a configuration, and then revert it, it caches the configuration. I have to actually delete the configuration when I disable it, which is not good. If I disable something, I expect it to work as disabled; it should not cache and still be working as if it is enabled. I think those are parts that can be worked on.

Regarding scalability, based on what I just said, I give it a seven for scalability.

My mark for OPNsense technical support is a four for the free version since they do not care when they realize you are using the free version; they just ghost on you. For the paid version, I give them a seven or eight because once you are paying, they want to pay attention to you, but if it is free, they do not care and just ghost on you.

For the initial setup of OPNsense, I find that it is very simple.

In my opinion, the main competitors for OPNsense in the market are Arista and Ubuntu, especially Untangle from our end. I prefer Untangle. Because I am using more of OPNsense, I will be partial here.

Regarding intrusion detection capabilities for network security, I think it is fine.

When it comes to the load balancing feature in OPNsense, I have seen it, but I have not used it. What I have actually been trying to use is the high availability—that is the groupings.

I cannot rate the pricing for OPNsense. I would rate this product an overall eight out of ten.

I mainly use OPNsense for routing and network security. That is the basic use: routing and firewall, basically for connecting to the internet as well as filtering my outgoing and incoming traffic.

In my opinion, the most useful functions or features in OPNsense are those that come packaged inside, such as WireGuard, if you need a VPN. It is not something you have to install afterward. Upon installing OPNsense, you can get WireGuard straight from the interface itself. You can also make it even more advanced by subscribing to certain features to enhance filtering capabilities, especially for filtering websites such as social media and specific traffic types. For pfSense, you cannot get those features straight. You have to keep adding on and installing add-on packages.

Regarding OPNsense's detection capabilities enhancing my network security, it does filter quite a lot. In terms of firewalling, I can really recommend it to someone who does not want to invest much on hardware and software that can really secure their network. As long as you have somebody who understands the product and is also willing to learn, even if they do not know initially, it is something to pursue at a very minimal cost.

When talking about real-time filtering inside the product, I am actually very satisfied with it. It is real-time. I like the way it does it. Upon effecting a rule, it automatically starts working. It is not something that delays or seems to hang the system. It effectively starts working immediately upon deploying the rule.

In my opinion, OPNsense could improve by incorporating either an open side of wireless management or a way that you can also manage your interconnected devices. You could easily have SNMP, Simple Network Management Protocol, incorporated in it so that you can easily manage the devices and easily get the information about the devices that you are managing. Additionally, the inclusion of Pi-hole would allow you to create an ad-free network instead of adding it on a separate device. I would prefer that incorporated into OPNsense, or if it is there, I would appreciate guidance on how to use it.

I have been working with OPNsense for about a year now.

For stability, I can give OPNsense a nine. It is very stable.

For scalability, I can give it about an eight.

For technical support, since I have not worked with one that requires external support, in my case, I think I can give it a ten, because I am able to manipulate whatever I want, and whatever I want it to do, it does. It does not disappoint. So for me, technically, it is a ten.

I have been working with firewall solutions for about two years. I first worked with pfSense, then I was looking for a difference. That is when I came across OPNsense and wanted to know the difference between the two of them and how OPNsense might be better than pfSense, and also the vice versa.

Regarding the initial setup for OPNsense, I find it fair and not that complex. As long as you have knowledge of Linux, it is simple and very straightforward.

When it comes to comparing OPNsense with other vendors, I cannot compare because currently OPNsense is fully open source. Compared to other vendors who claim to be open source but somehow they still have some interference with their product, yet they claim to be open source, OPNsense stands apart. I can only compare OPNsense with pfSense, since those are the only two I have worked with. pfSense currently, even the community, is not fully open.

I confirm that I am currently still working with OPNsense and still using their product. However, because of the hardware that I am using, sometimes it ends up freezing quite often, especially the interfaces, most of the busy interfaces. This is because I am not using the recommended network interfaces for that matter, as I have customized a normal desktop computer to work as an OPNsense router. Because of using the TP-Link cards, that is why I am getting frustrated. I was planning to find, either from the community, the best specification of a computer, maybe an old computer that one can use. Or, because I do not want to invest much on the hardware, I will buy network-dedicated cards, like the Intel cards, since it is not the CPU that has a problem.

In terms of OPNsense's VPN functions, I normally use it to access it from outside the workplace or to have some of the roaming users access the premise resources from outside the premise. Though, I was also looking at the SD-WAN capability of OPNsense because I wanted to find out if it is possible to have an SD-WAN solution with OPNsense. We are a business that has eight different branches, so I was looking for a way I can have each branch with an OPNsense, but then interconnect all of them through an SD-WAN solution instead of IPsec. This is so that you can communicate with the data center where we have hosted our servers, through OPNsense. I was looking for that to be one of the options: either use IPsec or use a public LAN such as Tailgate.

In terms of the reporting tools for my network traffic analysis, the reports are good. OPNsense has good reports in terms of the basics: the DHCP, the IPs already given out. In terms of whatever is blocked, whatever has been detected to be a potential threat, and the source of these threats, from which particular region, you can easily get the report from there. Also the bandwidth utilization, you can get it from there. I also deployed it some time back and I saw it had the capability, which of late I cannot see, to incorporate it with a wireless management system such as the Unifi.

Regarding the load balancing features in OPNsense, I have also used it in terms of load balancing and failover. It is also very effective and straightforward. You just need to have the knowledge on how to go about it. Since it is a community-based open source, you can easily get the information online in case of anything. I have tried both load balancing and failover and it has worked very effectively. In terms of quality of service also, it is very effective. I cannot complain.

Based on my experience, the main benefits OPNsense provides for me are due to the limitation in getting financials to implement the most marketable solutions available in the market. That pushed me to find other open-source-related solutions or cheaper solutions. That is how I came upon OPNsense and pfSense, but OPNsense was the choice in this decision. That is what brought me to finding a simple but also effective solution, but at a low budget.

I did not purchase OPNsense directly from the vendor or through marketplaces. I just downloaded the ISO file from OPNsense. In terms of price, I think OPNsense has a reasonable price compared to others, so I can give it about an eight or nine. I would rate this review as a nine overall.

I am using OPNSense at 5~6 Different Locations with different network requirements, having 40-80 clients each and fully depend on OPNSense and it is running satisfactorily.

After running OPnsense for 5 years at my primary location management has enaged another firewall solution.

Now my primary setup is shrink to 7 to 8 computers which is playground for me and my collegues. But we are successfully handling OPNsense at other locations remotely .

I find everything valuable in OPNsense. The configuration and reporting aspects are what we require. Reporting on user access and data consumed is fascinating in OPNsense, and the configuration offers a clear idea of everything that I have configured in DHCP.

The key metrics I track to measure the effectiveness of reporting tools include the graphic interface and real-time statistics, which are much better in OPNsense compared to Other products. If I want to export something, that is easy from OPNsense.

Managing Rules and implenting Policies are much easier than competitive products, Practically using IP blacklisting as well as whitelisting,

If we talk about port forwarding, is very straightforward. In OPNsense, everything can be done on a single screen: identifying the source of packets, determining what to do with them, and deciding where they should land is the most convenient aspect.

Additionally, making group of IP addresses in OPNsense is very easy, making the overall experience very user-friendly.

I assess OPNsense's intrusion detection capabilities through practical testing.

I find the load balancing features quite satisfactory as I am using two WANs with this system. The load balancing features have no negative impact on my operations, and I am satisfied with this aspect as it automatically takes over the network, directing load to the second WAN if one fails.

I have attempted to configure OPNsense VPN features, but I was not incomplete due to time constraints. However, I believe that with some effort, the VPN will work fine. I already using OpenVPN simultaneously for computer-to-computer communication, but not with OPNsense, though I am confident it will fulfill my needs. I want to implement a site-to-site VPN, but that project was dropped somehow.

As its is based on BSD sometime onboard as well as pciX Ethernet adapters refrences are little confusing, to overcome this we just unplug the cable and note the referene appearing on screen.

To use Intrusion detection and Anvitirus Plugin in is necessary to configure proxy Without a proxy, you cannot use the ClamAV antivirus plugin. I think that should be modified towork without configuring a proxy. This is the only aspect in which OPNsense is falling behind because implementing a proxy requires system-to-system attention. Alternatively, using a transparent proxy poses a threat if not properly configured.

Those takes laptops outside LAN feels difficulties if Proxy is configured on their system. It is suggested to consider this improvement.

I have been working with OPNsense for around five years.

I did not experience too many problems with the implementation or configuration of OPNsense in my system. The main thing to note is that OPNsense is based on BSD, so in some cases, changing the machine causes references of the LAN card to change. For instance, on a single machine, it might show en0, en1, while on a different machine, it shows enp0, enp1. This inconsistent naming convention can be confusing during configuration of LAN and WAN Points,

OPNsense is completely scalable for my needs.

N/A

Currently I introduced SonicWall a couple of months ago. I worked with the TZ series, specifically the TZ 270 model.

Intial setup is very strainghtforward.

None used. All done using tecnical articals available on internet.

Setup cost is almost zero as one can simulate the whole environment using open source version.

Pricing seems fair enough.

Open source license allows a beginner to have a complete firewall solution for practice and improve skill. Which is not possible in commercial solutions.

As it can be simulated using virutalbox and other Virtualization software, any one can master it using only a single physical machine with help of available Technical material found on Internet as well as on KB article web site.

Tried Untangle as well as PFSense in virtualized environment.