Core

This project is the core management framework for a security appliance, providing the primary infrastructure for firewall management, network intrusion prevention, and high-availability networking. It serves as the centralized system for controlling network security policies, filtering traffic, and administering a security appliance dashboard.

The system is distinguished by its high-availability capabilities, which include synchronizing configurations and connection state tables across redundant nodes to enable automatic hardware failover. It also features a modular plugin architecture for extending backend logic and user interfaces, alongside a JSON-based API for programmatic management of firewall rules and system settings.

The platform covers a broad range of capability areas, including network configuration for IPv4 and IPv6, secure VPN tunneling, captive portal administration, and comprehensive monitoring and observability tools. It further integrates identity management with multi-factor authentication and provides tools for configuration backup, version tracking, and deployment across x86-64 hardware.

Features

Firewall Failover Clusters - Pairs firewalls in failover clusters using virtual IP addresses and CARP for seamless stateful failover.
Firewall Management - Provides a centralized system for configuring network-level access restrictions, traffic filtering, and firewall rule management.
Firewall Management Interfaces - Provides a comprehensive graphical interface and API for controlling firewall settings and system behavior.
DHCP and DNS Services - Integrates DHCP and DNS services to provide automatic IP assignment and local hostname resolution.
Node Maintenance Modes - Toggles maintenance mode to gracefully migrate traffic to a backup node for zero-downtime updates.
Configuration Synchronization - Schedules periodic synchronization of settings to backup nodes via background tasks to ensure high availability.
CARP Failover Implementations - Implements Common Address Redundancy Protocol (CARP) to enable automatic hardware failover between firewalls.
High Availability Deployments - Implements high-availability deployments that synchronize state and configuration across redundant nodes to ensure continuous uptime.
Infrastructure Redundancy Protocols - Coordinates failover and redundancy between firewall appliances using standard address redundancy protocols.
DHCP State Synchronization - Coordinates state between multiple DHCP servers to ensure service availability during failover.
State and Configuration Replication - Copies firewall rules and active connection state tables from a master node to a backup node.
Virtual IP Failovers - Manages virtual IP addresses across a cluster to ensure seamless failover and service continuity.
Gateway Reachability Monitoring - Tracks gateway reachability and triggers automatic routing changes when a connection fails.
Captive Portal Authentication - Validates user identities via local accounts, LDAP, Radius, or simple splash-screen interactions for network access.
Captive Portal Implementations - Implements a captive portal that forces user authentication or acceptance of terms before granting network access.
Connection State Synchronization - Replicates active connection tables and configuration settings across nodes to enable seamless hardware failover.
Default Gateway Selection - Determines the primary exit route using priority rankings and upstream status flags.
DHCP Address Distribution - Distributes IP addresses to clients using defined ranges and supports gateway discovery.
DHCP Address Provisioning - Configures address ranges and gateways to automatically provision network settings to clients.
High Availability Synchronization - Coordinates state between DHCP servers using split pools to prevent IP conflicts during failover.
Gateway Configuration - Provides tools for setting up routing paths and managing multi-WAN failover and IP assignments.
High Availability Networking - Ensures continuous network connectivity by synchronizing configuration and state across redundant routing paths.
IPv6 Address Assignment - Assigns IPv6 addresses to interfaces using static blocks, DHCPv6, or SLAAC.
Multi-WAN Routing Logic - Defines gateway enforcement and reply-to logic to manage traffic across multiple WAN setups.
Named Network Aliasing - Groups IP addresses, hostnames, or ports into named entities to simplify the management of firewall rules.
Network Routing and Traffic Management - Directs data packets between interfaces and gateways to support multi-WAN and high-availability networking.
Network Interface Management - Manages the assignment of physical ports to logical interfaces and configures IP, MTU, and MAC settings.
Weighted Route Failovers - Automatically switches traffic to an alternative gateway when the primary route becomes unreachable.
Network Traffic Segmentation - Isolates network zones and implements VLAN support to provide granular traffic control and segmentation.
Cross-Node Session Replication - Replicates active connection tables across nodes to maintain existing sessions during hardware transitions.
Connection State Management - Allows searching, filtering, and removing entries from the firewall state table to terminate connections.
Virtual IP Management - Assigns shared virtual addresses across multiple interfaces to enable seamless fail-over.
Virtual IP Routing - Configures outbound NAT rules to use virtual addresses for seamless transition between nodes.
VPN Tunnels - Establishes encrypted network tunnels using IPsec, OpenVPN, and WireGuard for secure remote connectivity.
Configuration Policy Synchronization - Copies configuration changes from a primary system to secondary firewalls to ensure consistent security policies.
Network Address Translation - Provides comprehensive network address translation to map private internal IPs to public external interfaces.
Intrusion Prevention Systems - Detects and automatically blocks malicious network activity using packet inspection and threat signatures.
Network Intrusion Detection - Inspects network traffic in real-time against rule sets to alert on or drop malicious packets.
Network Traffic Filtering - Defines security policies to allow, block, or reject network traffic based on interface and direction.
Secure Remote Access - Establishes encrypted tunnels using IPsec, OpenVPN, or WireGuard for secure site-to-site and remote user connectivity.
Signature-Based Threat Detectors - Provides the ability to download and update signature sets from third-party providers to detect known attack patterns.
Modular Plugin Architectures - Extends system functionality via a modular architecture that allows installing optional software packages with backend logic and UIs.
Cluster Monitoring - Tracks the state of high availability groups and manages maintenance mode for redundant nodes.
Firewall Log Analyzers - Records and inspects firewall events to monitor connectivity and troubleshoot security policy blocks.
Programmable Security APIs - Provides a programmatic API for managing backend security settings and firewall rules to bypass the graphical interface.
Infrastructure Service Deployment - Deploys and manages essential infrastructure tools including DHCP, DNS, and captive portals to ensure client connectivity.
Real-Time Traffic Monitoring - Displays a live stream of matched firewall rules filtered by source or destination in real time.
Security Event Monitoring - Views and analyzes triggered intrusion events to collect details about detected security threats.
Network Session Monitors - Provides real-time monitoring of active network traffic sessions, including source, destination, and protocol.
Security Operation Dashboards - Features a centralized dashboard for monitoring system status and configuring security settings in real time.
Administrative API Endpoints - Provides structured JSON endpoints for modifying system security data and executing administrative actions.
Perimeter Security Management - Filters and routes network data using rules and aliases to secure the network perimeter.
System Configuration Templates - Produces service and application configuration files from templates by merging them with system-specific variables.
Guest Access Vouchers - Creates time-limited access tickets for guest users and exports them to CSV files for distribution.
Static IP Reservations - Binds a specific IP address to a unique client MAC address to ensure consistent addressing.
Network Traffic Export - Extracts network traffic totals and flow records into CSV format for external security analysis.
Service Configuration Templates - Uses a built-in template engine to produce precise configuration files for installed services and applications.
Service - Synchronizes background service behavior across boot and shutdown stages using a phased event system.
System Package Managers - Tracks installed packages, verifies licenses, and manages version locking to prevent unwanted software updates.
System Service Managers - Provides an interface to track, start, stop, and restart background system services.
Boot Sequence Automation - Uses a phased hook system to automate the execution of tasks and scripts during the system boot process.
Auditable Configuration Histories - Compares historical configuration versions using a diff format to identify changes and revert to previous states.
Network Control APIs - Provides an API to programmatically update IP entries for host, network, and external aliases to automate address mapping.
Release Lifecycle Management - Manages the operational lifecycle of software releases with curated upgrade paths to ensure enterprise stability.
Service Lifecycle Management - Coordinates service behavior across boot and shutdown stages using a hook-based lifecycle management system.
Network Traffic Flow Visualizers - Provides graphical visualizations of network traffic patterns to identify top users and destination ports.
Cellular Connectivity Modules - Integrates 3G and 4G LTE modems to serve as primary or backup WAN interfaces.
Cellular WAN Management - Configures internal wireless networks and manages cellular modem connections for internet access.
IPv6 Prefix Advertisements - Sends router advertisements to clients to facilitate automatic IPv6 network configuration.
Prefix Delegations - Provides IPv6 prefix delegation to downstream routers using dynamic leases or static mappings.
DHCP Client Tagging - Assigns labels to clients based on vendor IDs to deliver customized settings via DHCP.
DHCP Request Relaying - Routes DHCP requests received on one interface to a designated server on another network.
DHCP Request Relaying - Forwards DHCP requests from one interface to a server on a different network.
DNS Registration - Automatically maps DHCP-assigned IP addresses to hostnames for easier local device discovery.
Lease Statistics - Tracks IP assignments and client hostnames to provide diagnostics on DHCP lease usage.
Alias Resolution - Handles resolution frequency and certificate validation for external hostnames used in network aliases.
Rule Categorizations - Assigns labels to firewall rules to enable filtered views and simplified ruleset maintenance.
GeoIP-Based IP Blocking Tools - Blocks or allows network traffic based on geographic country data using integrated GeoIP databases.
Remote List Synchronization - Fetches IP address tables from remote servers in text or JSON format on a predefined schedule.
MAC Address Reservations - Maps client identifiers or MAC addresses to fixed IP addresses to ensure consistent network identity.
IPv6 Tunneling - Creates IPv6 over IPv4 connectivity using tunneling protocols to enable traffic over older infrastructure.
Logical Interface Grouping - Combines multiple interfaces into a single logical entity to apply uniform security policies.
NAT Reflection Controllers - Implements NAT reflection to allow internal clients to access local services via their public WAN IP.
IP Alias Management - Adds extra network addresses to an interface to bind services or define rules.
Network Address Set Management - Specifies source or destination addresses using CIDR notation, aliases, or interfaces for traffic filtering.
Route Tracing - Maps the route traffic takes to a destination to identify hops and network latency.
Packet Capture Implementations - Intercepts traffic on specified interfaces using filters to capture packets into pcap files for analysis.
Network Traffic Normalization - Standardizes inconsistent protocol packets on a per-interface basis to protect internal machines from protocol-based attacks.
Network Task Offloads - Allows disabling hardware checksumming and segmentation to ensure compatibility with intrusion prevention systems.
Daemon Control Sockets - Executes system actions and controls daemons via a centralized service using a socket-based interface.
Static DHCP Mappings - Links a client identifier to a specific IP to ensure a constant network address via DHCP.
IPv6 Traffic Suppression - Implements mechanisms to ignore IPv6 configurations and block all transit IPv6 traffic.
Traffic Normalization Rules - Enforces TCP/IP constraints such as maximum MSS and minimum TTL based on firewall criteria to normalize traffic.
x86_64 Device Support - Provides full kernel-level and operational support for x86-64 architectures across diverse hardware form factors.
System Data Template Generators - Generates environment-specific system configuration files from templates to ensure consistency across nodes.
Daemon API Interfaces - Provides a specialized socket-based interface for starting, stopping, and controlling background system daemons.
Access Control Lists - Defines specific permissions and access rules for users to restrict or grant access to system resources.
API Access Security - Secures API access by controlling which endpoints are accessible to specific API keys based on user privileges.
Cloud-Synced Configurations - Saves system settings to encrypted cloud storage with integrated version history tracking.
Certificate Authority Management - Generates and manages the full lifecycle of client, server, and authority certificates, including signing requests.
Custom Detection Rules - Allows the creation of user-defined patterns and fingerprints to block specific sites or network traffic patterns.
Trust Store Managers - Manages system-wide trust constraints for intermediate CAs, CRL storage, and cipher protocols.
Revocation List Management - Creates and maintains Certificate Revocation Lists to verify the validity of digital certificates before they expire.
One-Time Passwords - Secures system access using time-based or event-based one-time password verification for multi-factor security.
Packet Normalization - Scrubs and cleans network packets to ensure they conform to standards and prevent evasion.
Rule Priority Logic - Defines priorities and actions for intrusion rules based on metadata to refine malicious traffic blocking.
Dependency Vulnerability Scanning - Scans installed system packages against known vulnerability databases to identify security flaws.
Exhaustion Prevention - Uses syncookies to defer memory allocation until a TCP handshake is completed to prevent state exhaustion.
Web Application Firewalls - Inspects and blocks malicious HTTP requests using a rule-based web application firewall.
TOTP Seed Generators - Generates one-time password seeds for multi-factor authentication that can be scanned by mobile devices.
Configuration Version Control - Integrates with Git to maintain a traceable and auditable history of all system setting modifications.
Engine Behavior Configuration - Allows behavioral tuning of the network inspection engine using custom YAML templates and tags.
Controller-Based Routing - Uses architectural patterns to map incoming network requests to specific backend operations via structured interface handlers.
Plugin Installation and Management - Provides a full lifecycle for building, installing, and managing plugins that extend backend logic and user interfaces.
Modular Plugin Extensions - Provides a modular plugin architecture for extending the system with new administrative features and UIs.
Remote Node Administration - Monitors service status and triggers restarts on backup servers from a centralized management interface.
Backend Service Execution - Implements a centralized backend service to execute system actions, run scripts, and manage daemons.
Configuration Backups - Exports system settings and statistics to password-protected files or remote cloud storage for backup.
DHCP Lease Managers - Triggers the release or renewal of IP addresses for interfaces using dynamic configuration.
DNS Resolution Testers - Includes tools to resolve hostnames to IP addresses directly from the system to verify DNS resolution.
Firewall Performance Metrics - Provides detailed metrics including packet counters per interface and active rule timeouts.
Log Analysis - Visualizes firewall log lines across various properties to identify network traffic patterns.
Traffic Shaping and Prioritization - Prioritizes applications and limits bandwidth consumption per user using traffic shaping queues.
Flow Record Querying - Allows filtering network flow records by date, interface, or IP to investigate specific traffic events.
Network Health Monitors - Provides real-time status, assigned IP addresses, and link details to verify network interface health.
Network Statistics Tracking - Provides real-time metrics and status updates on network traffic and interface activity.
System Health Monitoring - Runs diagnostic checks on connectivity and disk integrity to troubleshoot system update failures.
Reachability Testing - Sends ICMP echo requests to remote hosts to verify network reachability and routing.
Resource Monitoring Widgets - Ships a dashboard with widgets for real-time monitoring of CPU, memory, and disk utilization.
System Event Logging - Displays event logs for firewall components within the management interface to assist in troubleshooting.
System Configuration Restorers - Reinstates previous configuration states while allowing the exclusion of hardware-specific console settings.
Dashboard Widgets - Ships modular interface components for at-a-glance monitoring and quick function access on the system dashboard.
Service Control APIs - Allows controlling the operational state and configuration of background services through programmable API calls.
JSON APIs - Provides programmable endpoints using JSON payloads to modify security data and execute administrative actions.

Star history

opnsensecore

Name: opnsense/core
Author: opnsense

View on GitHub

4,493 stars957 forksPHPBSD-2-Clause8 viewsopnsense.org

Core

Features

Firewall Failover Clusters - Pairs firewalls in failover clusters using virtual IP addresses and CARP for seamless stateful failover.
Firewall Management - Provides a centralized system for configuring network-level access restrictions, traffic filtering, and firewall rule management.
Firewall Management Interfaces - Provides a comprehensive graphical interface and API for controlling firewall settings and system behavior.
DHCP and DNS Services - Integrates DHCP and DNS services to provide automatic IP assignment and local hostname resolution.
Node Maintenance Modes - Toggles maintenance mode to gracefully migrate traffic to a backup node for zero-downtime updates.
Configuration Synchronization - Schedules periodic synchronization of settings to backup nodes via background tasks to ensure high availability.
CARP Failover Implementations - Implements Common Address Redundancy Protocol (CARP) to enable automatic hardware failover between firewalls.
High Availability Deployments - Implements high-availability deployments that synchronize state and configuration across redundant nodes to ensure continuous uptime.
Infrastructure Redundancy Protocols - Coordinates failover and redundancy between firewall appliances using standard address redundancy protocols.
DHCP State Synchronization - Coordinates state between multiple DHCP servers to ensure service availability during failover.
State and Configuration Replication - Copies firewall rules and active connection state tables from a master node to a backup node.
Virtual IP Failovers - Manages virtual IP addresses across a cluster to ensure seamless failover and service continuity.
Gateway Reachability Monitoring - Tracks gateway reachability and triggers automatic routing changes when a connection fails.
Captive Portal Authentication - Validates user identities via local accounts, LDAP, Radius, or simple splash-screen interactions for network access.
Captive Portal Implementations - Implements a captive portal that forces user authentication or acceptance of terms before granting network access.
Connection State Synchronization - Replicates active connection tables and configuration settings across nodes to enable seamless hardware failover.
Default Gateway Selection - Determines the primary exit route using priority rankings and upstream status flags.
DHCP Address Distribution - Distributes IP addresses to clients using defined ranges and supports gateway discovery.
DHCP Address Provisioning - Configures address ranges and gateways to automatically provision network settings to clients.
High Availability Synchronization - Coordinates state between DHCP servers using split pools to prevent IP conflicts during failover.
Gateway Configuration - Provides tools for setting up routing paths and managing multi-WAN failover and IP assignments.
High Availability Networking - Ensures continuous network connectivity by synchronizing configuration and state across redundant routing paths.
IPv6 Address Assignment - Assigns IPv6 addresses to interfaces using static blocks, DHCPv6, or SLAAC.
Multi-WAN Routing Logic - Defines gateway enforcement and reply-to logic to manage traffic across multiple WAN setups.
Named Network Aliasing - Groups IP addresses, hostnames, or ports into named entities to simplify the management of firewall rules.
Network Routing and Traffic Management - Directs data packets between interfaces and gateways to support multi-WAN and high-availability networking.
Network Interface Management - Manages the assignment of physical ports to logical interfaces and configures IP, MTU, and MAC settings.
Weighted Route Failovers - Automatically switches traffic to an alternative gateway when the primary route becomes unreachable.
Network Traffic Segmentation - Isolates network zones and implements VLAN support to provide granular traffic control and segmentation.
Cross-Node Session Replication - Replicates active connection tables across nodes to maintain existing sessions during hardware transitions.
Connection State Management - Allows searching, filtering, and removing entries from the firewall state table to terminate connections.
Virtual IP Management - Assigns shared virtual addresses across multiple interfaces to enable seamless fail-over.
Virtual IP Routing - Configures outbound NAT rules to use virtual addresses for seamless transition between nodes.
VPN Tunnels - Establishes encrypted network tunnels using IPsec, OpenVPN, and WireGuard for secure remote connectivity.
Configuration Policy Synchronization - Copies configuration changes from a primary system to secondary firewalls to ensure consistent security policies.
Network Address Translation - Provides comprehensive network address translation to map private internal IPs to public external interfaces.
Intrusion Prevention Systems - Detects and automatically blocks malicious network activity using packet inspection and threat signatures.
Network Intrusion Detection - Inspects network traffic in real-time against rule sets to alert on or drop malicious packets.
Network Traffic Filtering - Defines security policies to allow, block, or reject network traffic based on interface and direction.
Secure Remote Access - Establishes encrypted tunnels using IPsec, OpenVPN, or WireGuard for secure site-to-site and remote user connectivity.
Signature-Based Threat Detectors - Provides the ability to download and update signature sets from third-party providers to detect known attack patterns.
Modular Plugin Architectures - Extends system functionality via a modular architecture that allows installing optional software packages with backend logic and UIs.
Cluster Monitoring - Tracks the state of high availability groups and manages maintenance mode for redundant nodes.
Firewall Log Analyzers - Records and inspects firewall events to monitor connectivity and troubleshoot security policy blocks.
Programmable Security APIs - Provides a programmatic API for managing backend security settings and firewall rules to bypass the graphical interface.
Infrastructure Service Deployment - Deploys and manages essential infrastructure tools including DHCP, DNS, and captive portals to ensure client connectivity.
Real-Time Traffic Monitoring - Displays a live stream of matched firewall rules filtered by source or destination in real time.
Security Event Monitoring - Views and analyzes triggered intrusion events to collect details about detected security threats.
Network Session Monitors - Provides real-time monitoring of active network traffic sessions, including source, destination, and protocol.
Security Operation Dashboards - Features a centralized dashboard for monitoring system status and configuring security settings in real time.
Administrative API Endpoints - Provides structured JSON endpoints for modifying system security data and executing administrative actions.
Perimeter Security Management - Filters and routes network data using rules and aliases to secure the network perimeter.
System Configuration Templates - Produces service and application configuration files from templates by merging them with system-specific variables.
Guest Access Vouchers - Creates time-limited access tickets for guest users and exports them to CSV files for distribution.
Static IP Reservations - Binds a specific IP address to a unique client MAC address to ensure consistent addressing.
Network Traffic Export - Extracts network traffic totals and flow records into CSV format for external security analysis.
Service Configuration Templates - Uses a built-in template engine to produce precise configuration files for installed services and applications.
Service - Synchronizes background service behavior across boot and shutdown stages using a phased event system.
System Package Managers - Tracks installed packages, verifies licenses, and manages version locking to prevent unwanted software updates.
System Service Managers - Provides an interface to track, start, stop, and restart background system services.
Boot Sequence Automation - Uses a phased hook system to automate the execution of tasks and scripts during the system boot process.
Auditable Configuration Histories - Compares historical configuration versions using a diff format to identify changes and revert to previous states.
Network Control APIs - Provides an API to programmatically update IP entries for host, network, and external aliases to automate address mapping.
Release Lifecycle Management - Manages the operational lifecycle of software releases with curated upgrade paths to ensure enterprise stability.
Service Lifecycle Management - Coordinates service behavior across boot and shutdown stages using a hook-based lifecycle management system.
Network Traffic Flow Visualizers - Provides graphical visualizations of network traffic patterns to identify top users and destination ports.
Cellular Connectivity Modules - Integrates 3G and 4G LTE modems to serve as primary or backup WAN interfaces.
Cellular WAN Management - Configures internal wireless networks and manages cellular modem connections for internet access.
IPv6 Prefix Advertisements - Sends router advertisements to clients to facilitate automatic IPv6 network configuration.
Prefix Delegations - Provides IPv6 prefix delegation to downstream routers using dynamic leases or static mappings.
DHCP Client Tagging - Assigns labels to clients based on vendor IDs to deliver customized settings via DHCP.
DHCP Request Relaying - Routes DHCP requests received on one interface to a designated server on another network.
DHCP Request Relaying - Forwards DHCP requests from one interface to a server on a different network.
DNS Registration - Automatically maps DHCP-assigned IP addresses to hostnames for easier local device discovery.
Lease Statistics - Tracks IP assignments and client hostnames to provide diagnostics on DHCP lease usage.
Alias Resolution - Handles resolution frequency and certificate validation for external hostnames used in network aliases.
Rule Categorizations - Assigns labels to firewall rules to enable filtered views and simplified ruleset maintenance.
GeoIP-Based IP Blocking Tools - Blocks or allows network traffic based on geographic country data using integrated GeoIP databases.
Remote List Synchronization - Fetches IP address tables from remote servers in text or JSON format on a predefined schedule.
MAC Address Reservations - Maps client identifiers or MAC addresses to fixed IP addresses to ensure consistent network identity.
IPv6 Tunneling - Creates IPv6 over IPv4 connectivity using tunneling protocols to enable traffic over older infrastructure.
Logical Interface Grouping - Combines multiple interfaces into a single logical entity to apply uniform security policies.
NAT Reflection Controllers - Implements NAT reflection to allow internal clients to access local services via their public WAN IP.
IP Alias Management - Adds extra network addresses to an interface to bind services or define rules.
Network Address Set Management - Specifies source or destination addresses using CIDR notation, aliases, or interfaces for traffic filtering.
Route Tracing - Maps the route traffic takes to a destination to identify hops and network latency.
Packet Capture Implementations - Intercepts traffic on specified interfaces using filters to capture packets into pcap files for analysis.
Network Traffic Normalization - Standardizes inconsistent protocol packets on a per-interface basis to protect internal machines from protocol-based attacks.
Network Task Offloads - Allows disabling hardware checksumming and segmentation to ensure compatibility with intrusion prevention systems.
Daemon Control Sockets - Executes system actions and controls daemons via a centralized service using a socket-based interface.
Static DHCP Mappings - Links a client identifier to a specific IP to ensure a constant network address via DHCP.
IPv6 Traffic Suppression - Implements mechanisms to ignore IPv6 configurations and block all transit IPv6 traffic.
Traffic Normalization Rules - Enforces TCP/IP constraints such as maximum MSS and minimum TTL based on firewall criteria to normalize traffic.
x86_64 Device Support - Provides full kernel-level and operational support for x86-64 architectures across diverse hardware form factors.
System Data Template Generators - Generates environment-specific system configuration files from templates to ensure consistency across nodes.
Daemon API Interfaces - Provides a specialized socket-based interface for starting, stopping, and controlling background system daemons.
Access Control Lists - Defines specific permissions and access rules for users to restrict or grant access to system resources.
API Access Security - Secures API access by controlling which endpoints are accessible to specific API keys based on user privileges.
Cloud-Synced Configurations - Saves system settings to encrypted cloud storage with integrated version history tracking.
Certificate Authority Management - Generates and manages the full lifecycle of client, server, and authority certificates, including signing requests.
Custom Detection Rules - Allows the creation of user-defined patterns and fingerprints to block specific sites or network traffic patterns.
Trust Store Managers - Manages system-wide trust constraints for intermediate CAs, CRL storage, and cipher protocols.
Revocation List Management - Creates and maintains Certificate Revocation Lists to verify the validity of digital certificates before they expire.
One-Time Passwords - Secures system access using time-based or event-based one-time password verification for multi-factor security.
Packet Normalization - Scrubs and cleans network packets to ensure they conform to standards and prevent evasion.
Rule Priority Logic - Defines priorities and actions for intrusion rules based on metadata to refine malicious traffic blocking.
Dependency Vulnerability Scanning - Scans installed system packages against known vulnerability databases to identify security flaws.
Exhaustion Prevention - Uses syncookies to defer memory allocation until a TCP handshake is completed to prevent state exhaustion.
Web Application Firewalls - Inspects and blocks malicious HTTP requests using a rule-based web application firewall.
TOTP Seed Generators - Generates one-time password seeds for multi-factor authentication that can be scanned by mobile devices.
Configuration Version Control - Integrates with Git to maintain a traceable and auditable history of all system setting modifications.
Engine Behavior Configuration - Allows behavioral tuning of the network inspection engine using custom YAML templates and tags.
Controller-Based Routing - Uses architectural patterns to map incoming network requests to specific backend operations via structured interface handlers.
Plugin Installation and Management - Provides a full lifecycle for building, installing, and managing plugins that extend backend logic and user interfaces.
Modular Plugin Extensions - Provides a modular plugin architecture for extending the system with new administrative features and UIs.
Remote Node Administration - Monitors service status and triggers restarts on backup servers from a centralized management interface.
Backend Service Execution - Implements a centralized backend service to execute system actions, run scripts, and manage daemons.
Configuration Backups - Exports system settings and statistics to password-protected files or remote cloud storage for backup.
DHCP Lease Managers - Triggers the release or renewal of IP addresses for interfaces using dynamic configuration.
DNS Resolution Testers - Includes tools to resolve hostnames to IP addresses directly from the system to verify DNS resolution.
Firewall Performance Metrics - Provides detailed metrics including packet counters per interface and active rule timeouts.
Log Analysis - Visualizes firewall log lines across various properties to identify network traffic patterns.
Traffic Shaping and Prioritization - Prioritizes applications and limits bandwidth consumption per user using traffic shaping queues.
Flow Record Querying - Allows filtering network flow records by date, interface, or IP to investigate specific traffic events.
Network Health Monitors - Provides real-time status, assigned IP addresses, and link details to verify network interface health.
Network Statistics Tracking - Provides real-time metrics and status updates on network traffic and interface activity.
System Health Monitoring - Runs diagnostic checks on connectivity and disk integrity to troubleshoot system update failures.
Reachability Testing - Sends ICMP echo requests to remote hosts to verify network reachability and routing.
Resource Monitoring Widgets - Ships a dashboard with widgets for real-time monitoring of CPU, memory, and disk utilization.
System Event Logging - Displays event logs for firewall components within the management interface to assist in troubleshooting.
System Configuration Restorers - Reinstates previous configuration states while allowing the exclusion of hardware-specific console settings.
Dashboard Widgets - Ships modular interface components for at-a-glance monitoring and quick function access on the system dashboard.
Service Control APIs - Allows controlling the operational state and configuration of background services through programmable API calls.
JSON APIs - Provides programmable endpoints using JSON payloads to modify security data and execute administrative actions.

Open-source alternatives to Core

Similar open-source projects, ranked by how many features they share with Core.

pfsense/pfsense
pfsense/pfsense
5,675View on GitHub
pfSense is an open-source operating system that turns a standard computer into a dedicated firewall and router with a web-based management interface. It runs on the FreeBSD kernel with the pf packet filter for stateful firewall and NAT processing, and manages all settings through a PHP-driven web interface that writes to XML configuration files. The platform provides a comprehensive set of network security capabilities accessible through its browser-based control panel. Users can configure packet filtering rules to control traffic flow between network segments, manage network address translat
PHPfirewallfreebsdpfsense
View on GitHub5,675
acassen/keepalived
acassen/keepalived
4,587View on GitHub
Keepalived is a high availability manager and virtual IP failover tool that ensures continuous service availability. It coordinates the migration of floating IP addresses between master and backup nodes using the Virtual Router Redundancy Protocol to manage router redundancy and seamless failover. The project distinguishes itself by integrating with the Linux kernel IPVS module to function as a transport-layer load balancer. It distributes network traffic across backend servers using various scheduling algorithms and forwarding methods such as NAT, direct routing, or tunneling. The system in
Cbfdcdaemon
View on GitHub4,587
nadoo/glider
nadoo/glider
3,685View on GitHub
Glider is a multi-protocol forward proxy, transparent proxy gateway, and network service provider. It functions as a DNS and DHCP server, a Linux IP set manager, and a network traffic load balancer. The project distinguishes itself through a protocol-translation bridge that translates traffic between different proxy schemes and a chain-based routing system that sequences multiple remote proxy servers. It supports transparent traffic interception at the system level and utilizes build-time protocol stripping to minimize the binary size of the executable. The system covers a broad range of net
Godhcpdnsdnsmasq
View on GitHub3,685
bol-van/zapret
bol-van/zapret
15,555View on GitHub
Zapret is a deep packet inspection bypass tool and packet manipulation framework designed to circumvent network censorship. It operates as a transparent network proxy and TCP traffic obfuscator that modifies packets to deceive network inspection systems. The project distinguishes itself through advanced desynchronization strategies, including the modification of TLS client hello handshakes and the use of fake packet injection. It utilizes a combination of TCP stream segmentation, sequence overlapping, and TTL adjustment to hide prohibited requests from firewalls while ensuring the destination
Canti-dpicensorship-circumventionfreebsd
View on GitHub15,555

See all 30 alternatives to Core

Frequently asked questions

What does opnsense/core do?

What are the main features of opnsense/core?

The main features of opnsense/core are: Firewall Failover Clusters, Firewall Management, Firewall Management Interfaces, DHCP and DNS Services, Node Maintenance Modes, Configuration Synchronization, CARP Failover Implementations, High Availability Deployments.

What are some open-source alternatives to opnsense/core?

Open-source alternatives to opnsense/core include: pfsense/pfsense — pfSense is an open-source operating system that turns a standard computer into a dedicated firewall and router with a… acassen/keepalived — Keepalived is a high availability manager and virtual IP failover tool that ensures continuous service availability.… nadoo/glider — Glider is a multi-protocol forward proxy, transparent proxy gateway, and network service provider. It functions as a… bol-van/zapret — Zapret is a deep packet inspection bypass tool and packet manipulation framework designed to circumvent network… lxc/lxd — LXD is a unified platform for managing both system containers and virtual machines through a single REST API and… raspap/raspap-webgui — This project is a wireless hotspot management interface for Debian devices. It provides a web-based controller for…