OPNsense open source firewall
OPNsense is an open source firewall built on FreeBSD. inett designs the rule set, sets up VPN and failover, and keeps the system up to date.
The problem
A firewall rule set tends to grow by accretion. Rules get added for a project and never removed. After a few years nobody can say why a port is open or which rule still matters. Commercial appliances add another constraint: features such as VPN users, intrusion prevention or high availability sit behind separate licences, and the renewal can cost more than the hardware.
Many sites still rely on a single firewall. When it fails, the whole site loses its internet connection and its VPN links.
What inett does
We deploy OPNsense as the firewall and VPN gateway for your network. The work starts with an inventory: which networks exist, which traffic must pass between them, and which services must be reachable from outside. From that we write a rule set with a description on every rule, so your team can read and maintain it.
For site-to-site links and remote users we configure WireGuard or IPsec, depending on what the other end supports. Where the firewall must not be a single point of failure, we build a pair of nodes with CARP. The backup node takes over the shared IP addresses when the primary fails, and connection states are synchronised so most sessions survive the switch.
OPNsense runs on dedicated hardware or as a virtual machine, for example on Proxmox VE. Once it is live, we install updates, review rules and certificates, and help when something breaks. Checkmk can monitor the firewall alongside the rest of your infrastructure.
inett is an OPNsense Certified Training Partner.
Technical details
- Current version
- Community Edition 26.7 (as of October 2026)
- Release cycle
- two major releases a year, in January and July, with minor updates roughly every two weeks (roadmap)
- Business Edition
- paid edition from Deciso, the company behind OPNsense; released in April and October, each based on a Community release that has already been in the field for some months
- Licence
- Community Edition: 2-clause BSD, free for commercial use
- Platform
- FreeBSD on 64-bit x86 hardware (amd64)
- VPN
- WireGuard, IPsec, OpenVPN
- High availability
- CARP with state synchronisation (pfsync) and configuration sync between two nodes
- Further features
- Suricata intrusion detection and prevention, captive portal, traffic shaping, plugins
- Management
- web interface and API
- Documentation
- docs.opnsense.org
Both editions share the same core features. The Business Edition adds a slower, more conservative update path, vendor support and a few extras such as OPNcentral for managing several firewalls from one place.
What is included
- Review of your network and existing firewall rules
- Design of network segments, rule set and NAT
- Installation and base configuration on hardware or as a VM
- Site-to-site and remote access VPN with WireGuard or IPsec
- High availability pair with CARP
- Migration of rules from an existing firewall, after review
- Documentation of the rule set and a handover session for your team
- Ongoing updates, rule maintenance and troubleshooting
inett also supplies the hardware and licences: OPNsense appliances and subscriptions for OPNsense Business Edition.
Who it is for
OPNsense suits companies, public bodies and IT service providers that want to understand their own firewall and do not want to pay per feature. It is a good fit for connecting several sites over VPN and for replacing an appliance whose licence is about to expire.
It is a weaker fit if your security policy is tied to one vendor’s central management across many devices and cannot change. And if nobody on your side wants to look after the firewall, plan for a support agreement: an unmaintained firewall falls behind on security updates.
Frequently asked questions
Do we need the Business Edition?
Most deployments run well on the Community Edition. The Business Edition makes sense if you want a more conservative update path, vendor support or central management of several firewalls.
Can OPNsense run as a virtual machine?
Yes, for example on Proxmox VE. For the firewall at the internet edge we recommend dedicated hardware, or at least dedicated network interfaces, so that a hypervisor fault cannot expose the network.
How often does OPNsense need updating?
Minor updates arrive roughly every two weeks and major versions twice a year. Install security updates promptly. In a CARP pair you update one node at a time, so the network stays up apart from a short failover.