Goodbye OpnSense

Sat, 24 Oct 2026 11:19:03 +0200

Short history of my home networking

When I first left home in 2004 I quickly got my first own firewall. Not part of a router from my ISP, but my own. It was a pcengines board running OpenBSD, with PF.

A board from pcengines.ch remained my firewall at home for several moves to new apartments, it wasn’t until Turris Omnia released their first router in 2016 that I considered migrating away from OpenBSD.

I used my new Turris router on the inside just for Wifi, but after a while I actually replaced OpenBSD with Turris.

The main incentive was the difficult process of upgrading my OpenBSD firewall, it required a serial cable to see what was on the screen. Turris handled it with their web interface.

Turris actually worked well for several years, it wasn’t until 2023 (I think) that I replaced it with a little Intel N100 firewall device from a local Swedish store, that came with OpnSense.

My thinking was that OpnSense will make things even easier, and even more secure for me. It’s now running FreeBSD with PF, but I have a fancy and modern web interface to manage it with.

Disappointment

Using OpnSense has just been one disappointment after another.

First of all I am a person who loves simplicity, in a sense I believe simplicity leads to higher security.

OpnSense seemed to complicate everything. I had already setup several wireguard servers and clients, but doing it in OpnSense required carefully following their guide, and doing things I just couldn’t understand from my CLI-based perspective.

Thankfully I found an Ansible module to automate creation of rules, but it’s made by some weird company and you never know what their motives are. I was only able to automate rules, not NAT, because trying to do that locked me out of my firewall a couple of times because something was wrong with their module.

After being able to automate my OpnSense config with Ansible I finally hear that OpnSense are changing their entire API for firewall rules, so all that stuff is being thrown out, and replaced. And now you have to migrate all your rules if you want to upgrade OpnSense.

The final straw was this damn storm of PHP vulnerabilities in October 2026, realizing that both pfSense and OpnSense have admin interfaces made with PHP, and I can’t update mine because of the rules migration. Even worse, another pfSense I had wasn’t able to be upgraded at all, it had to be reinstalled completely.

My wish for a modern firewall to make things easier for me had been crushed.

Back to basics

So, I’m going back to basics, not OpenBSD but RHEL 10 with nftables.

Since I setup my first OpenBSD firewall I have become a Linux fanboy, and advocate, and I just can’t go back to any of the BSDs anymore. That’s a separate discussion and blog rant.

Besides that, when comparing the two options side by side I can’t understand why I didn’t do this sooner. Both OpnSense and pfSense are terrible options for a firewall device, their LTS specifically is terrible compared to Red Hat.

Red Hat is the leading Enterprise Linux LTS provider on the market, so why not use them as a firewall?

Anyways I have now added firewall.yml to my big old homelab git repo, and so far so good.

How’s it going?

Update a week later on 2026-11-01.

It’s been a week since I migrated from OpnSense to RHEL10.2 on my Firewall, how is it going? Absolutely amazing!

It feels liberating to have a Firewall I can configure with ordinary Ansible, and Linux-methods that I already know very well. In that short week I have done more things with my new RHEL firewall than I did for over a year with OpnSense.

The function of the Firewall can be restored instantly with Ansible IaC, it has no state data that needs backing up in case I have to re-create it.

Every change is of course tracked by git, which is good because I’ve done a lot of things on it that I never did on OpnSense. Like my own “pihole” using a simple bash script, systemd timer, unbound. Metrics and dashboards with Prometheus exporters.

Networking on Swehack

Goodbye OpnSense

Short history of my home networking

Disappointment

Back to basics

How’s it going?