OPNsense® Firewall/Router/VPN/IDPS

I am a Sales Engineer working for a consulting company. I use OPNsense  to take my lab environment on the road for demos. Initially, I built it to bring my demos from my own lab. Although the company has a lab, putting an OPNsense  firewall in there worked better because it was a colo. I run it both bare metal and virtualized, and in some cases, I do both.

The main features I find valuable are ease of use, code stability, and the ability to add features such as Zenarmor, which provides fourth-generation firewall capabilities with deep packet inspection. Additionally, integrating solutions like Tailscale  for VPN is very valuable for my uses.

They are trying to augment reporting with Grafana  dashboards. Some of those integrations could be improved to work better with Grafana .

I have used the solution for about four years.

The solution is extremely stable. At the latest code level, I haven't experienced any crashes. Initially, there were some performance issues with earlier versions, but it is very stable now.

So far, scalability has been good. I use Zenarmor, pinning it to one core for packet inspection, and the CPU performance seems very good. My use cases don’t drive a ton of bandwidth, but I’m looking at some AI applications that may increase that dramatically, and that's where we will test scalability.

The support is good. I mainly rely on community support since the solution is open source. I haven't had to open many tickets, just one or two under the Pro license.

Neutral

The initial setup was very straightforward. It took about an hour the first time, but I could probably do it in five minutes now.

There are dramatic operational impacts compared to Check Point and FortiNet.

The pricing is competitive when compared to vendors like Palo and FortiNet.

I have experience with FortiNet and Palo Alto network solutions.

Overall, I would rate OPNsense as nine out of ten. The ability to deploy easily and leverage fourth-generation features adds significant value, especially with Zenarmor.

On-premises

I use OPNsense  primarily for network security. It involves basic firewall operations and GeoIP location functionalities. I've got multiple versions running, some on hardware purchased and some on VPSs.

The most valuable features include the basic firewall functionality and the GeoIP location services. OPNsense  is very stable, easy to upgrade, and maintain. I can work efficiently, knowing it does what it needs to do.

OPNsense should improve its performance in handling large volumes of voice traffic. It needs more support for Vigoroute and extensive VPN technologies. Enhancing its performance for significant amounts of data traffic would make it closer to a perfect solution.

I've been working with OPNsense for about five years.

I rate OPNsense's stability as very high. I would give it a nine out of ten. The only challenge faced was its inadequacy to manage large voice traffic effectively, even with dedicated hardware. It couldn't keep up with the packet per second for voice load, requiring a revert in our setup.

OPNsense struggles to handle large volumes of voice traffic, indicating scalability issues in that specific use case.

I haven't used technical support. I rely on forums and manage the setup independently.

The only other similar product I can compare is FortiGate . Overall, I find OPNsense more user-friendly.

I consider the pricing of OPNsense to be high when compared with other market products. However, as a free firewall product, it is one of the best available currently.

I only evaluated FortiGate  alongside OPNsense, as they are the two offerings from my company.

For small to medium businesses, I recommend OPNsense. I'd rate it eight point five out of ten.

Qu'aimez-vous le plus à propos de the product?

la chose que j'ai aimée en utilisant OPNsense, c'est qu'il a un très bon filtrage de contenu et d'après mes supérieurs, j'ai entendu dire qu'il est très rentable pour notre entreprise. également, dans mon utilisation personnelle, j'ai constaté qu'il a une bonne authentification, mais en premier lieu, il a une interface conviviale. aussi, il a une bonne performance, le temps de réponse est très bon. également, je l'utilise comme tous les jours.

Que n’aimez-vous pas à propos de the product?

il n'y a pas beaucoup de choses à ne pas aimer ici, mais une chose que je veux souligner est que la configuration initiale est assez difficile si vous n'êtes pas très au courant de la technologie. aussi, pour un usage personnel, je parcourais la documentation, mais elle n'était pas très utile.

Quels sont les problèmes que the product résout, et en quoi cela vous est-il bénéfique?

il a une bonne sécurité réseau sans se connecter à cela je ne peux pas accéder au contenu de mon entreprise ce qui est une très bonne idée donc si quelqu'un a mon ordinateur portable sans se connecter à OPNsense il ne peut pas accéder au contenu aussi comme je l'ai mentionné plus tôt c'est rentable il a un bon filtrage web comme mon organisation ne nous permet pas d'ouvrir notre gmail personnel sur l'ordinateur portable de l'entreprise donc nous ne pouvons pas accéder à tout grâce à OPNsense

Qu'aimez-vous le plus à propos de the product?

OPNsense a une interface web conviviale, ce qui le rend facile à utiliser même pour les personnes qui ne sont pas très techniquement compétentes. La plateforme reçoit des mises à jour régulières, garantissant que les problèmes de sécurité sont corrigés rapidement et que de nouvelles fonctionnalités sont ajoutées. Le support client est bon et toujours disponible pour assistance.

Que n’aimez-vous pas à propos de the product?

Actuellement, nous ne faisons face à aucun défi. Tout va bien.

Quels sont les problèmes que the product résout, et en quoi cela vous est-il bénéfique?

Auparavant, nous faisions face à un défi de sécurité, tel que l'ouverture de sites web inconnus. Après avoir mis en place ce pare-feu, nous pouvons bloquer les sites web inconnus (sites HTTP) et également autoriser ou bloquer des sites web selon nos besoins.

I mostly rely on the solution's network intrusion detection and prevention system, along with other systems, CMs, and log management. We are currently satisfied with the solution's threat intelligence. It's a pretty much in-house developed solution because it's in a Wazuh server. We have several scripts around it, allowing us to improve our posture on threats.

SD-WAN (software-defined wide area network) is integrated into some restricted service providers for OPNSense.

I pretty much like the solution's APIs, but it's somehow limited. I would like the APIs to be more mature and more developed and have more options to automate threat hunting. Also, I would like to see more drill-down possibilities.

We have to rely on specific hardware for the in-depth analysis of NetFlow. Although we have an interface on OPNsense, it's not as easy to use on the security side as other solutions.

I have been using OPNsense since 2016.

I rate the solution ten out of ten for stability.

OPNsense is an extremely scalable solution. I played on one network with CARP, and I was pretty happy with what I achieved there.

Before OPNsense, we worked with the Cisco ASA 5505 product for three years. Although it included the FirePOWER part, it was quite a poor experience.

OPNsense has helped reduce the speed of threat detection and containment from 50 minutes to 15 minutes.

I have quite a background in Berkeley Software Distribution (BSD) systems. I was looking into BSD, especially for the packet filter side. While evaluating, OPNsense was the most solid solution. I was also considering pfSense as my first option, but it is not so strong on the file system side.

OPNsense is a strong and solid solution that is easy to interact with. I don't see much on the new generation of firewalls, and only a few solutions are available for OPNsense. OPNsense handles network traffic much faster during peak loads because it's on dedicated hardware. I would recommend OPNsense when no specific topic prevents me from recommending OpenSense.

Overall, I rate the solution an eight out of ten.