OPNsense
By Deciso
An open-source firewall and router platform forked from pfSense/m0n0wall in 2015, built on HardenedBSD with Suricata-based intrusion prevention in its base system, plus a plugin ecosystem for WireGuard/IPsec VPN and content filtering. Fully open with no crippled free tier — Deciso monetizes through support contracts and its own hardware rather than a paid software edition.
Verified Source: 1
- Product type
- Distribution
- Deployment
- On-premHybrid
- Organization size
- IndividualSMBMid-market
- Pricing tier
- Free
Capability checklist
NGFWHow OPNsense measures up against the full Next-Generation Firewall taxonomy.
- Application awareness — not supported
- Identifies and controls traffic by application, not just by port or protocol.
- Built-in intrusion prevention — supported
- Blocks known exploit attempts and attack patterns inline, without a separate box.
- Encrypted traffic inspection — not supported
- Decrypts and inspects TLS traffic to catch threats hidden inside encrypted sessions.
- URL & content filtering — supported
- Blocks access to malicious, risky, or policy-violating web categories.
- Cloud sandboxing — not supported
- Detonates suspicious files in an isolated environment to catch unknown malware.
- Centralized policy management — supported
- Manages rules and logs across many firewalls and sites from one console.
- VPN & remote access — supported
- Terminates site-to-site and remote-user VPN connections on the same appliance.
Alternatives
Other Next-Generation Firewall tools with overlapping capabilities, sized for similar teams.