opnsense/core

Features

• Firewall Failover Clusters - Pairs firewalls in failover clusters using virtual IP addresses and CARP for seamless stateful failover.
• Firewall Management - Provides a centralized system for configuring network-level access restrictions, traffic filtering, and firewall rule management.
• Firewall Management Interfaces - Provides a comprehensive graphical interface and API for controlling firewall settings and system behavior.
• DHCP and DNS Services - Integrates DHCP and DNS services to provide automatic IP assignment and local hostname resolution.
• Node Maintenance Modes - Toggles maintenance mode to gracefully migrate traffic to a backup node for zero-downtime updates.
• Configuration Synchronization - Schedules periodic synchronization of settings to backup nodes via background tasks to ensure high availability.
• CARP Failover Implementations - Implements Common Address Redundancy Protocol (CARP) to enable automatic hardware failover between firewalls.
• High Availability Deployments - Implements high-availability deployments that synchronize state and configuration across redundant nodes to ensure continuous uptime.
• Infrastructure Redundancy Protocols - Coordinates failover and redundancy between firewall appliances using standard address redundancy protocols.
• DHCP State Synchronization - Coordinates state between multiple DHCP servers to ensure service availability during failover.
• State and Configuration Replication - Copies firewall rules and active connection state tables from a master node to a backup node.
• Virtual IP Failovers - Manages virtual IP addresses across a cluster to ensure seamless failover and service continuity.
• Gateway Reachability Monitoring - Tracks gateway reachability and triggers automatic routing changes when a connection fails.
• Captive Portal Authentication - Validates user identities via local accounts, LDAP, Radius, or simple splash-screen interactions for network access.
• Captive Portal Implementations - Implements a captive portal that forces user authentication or acceptance of terms before granting network access.
• Connection State Synchronization - Replicates active connection tables and configuration settings across nodes to enable seamless hardware failover.
• Default Gateway Selection - Determines the primary exit route using priority rankings and upstream status flags.
• DHCP Address Distribution - Distributes IP addresses to clients using defined ranges and supports gateway discovery.
• DHCP Address Provisioning - Configures address ranges and gateways to automatically provision network settings to clients.
• High Availability Synchronization - Coordinates state between DHCP servers using split pools to prevent IP conflicts during failover.
• Gateway Configuration - Provides tools for setting up routing paths and managing multi-WAN failover and IP assignments.
• High Availability Networking - Ensures continuous network connectivity by synchronizing configuration and state across redundant routing paths.
• IPv6 Address Assignment - Assigns IPv6 addresses to interfaces using static blocks, DHCPv6, or SLAAC.
• Multi-WAN Routing Logic - Defines gateway enforcement and reply-to logic to manage traffic across multiple WAN setups.
• Named Network Aliasing - Groups IP addresses, hostnames, or ports into named entities to simplify the management of firewall rules.
• Network Routing and Traffic Management - Directs data packets between interfaces and gateways to support multi-WAN and high-availability networking.
• Network Interface Management - Manages the assignment of physical ports to logical interfaces and configures IP, MTU, and MAC settings.
• Weighted Route Failovers - Automatically switches traffic to an alternative gateway when the primary route becomes unreachable.
• Network Traffic Segmentation - Isolates network zones and implements VLAN support to provide granular traffic control and segmentation.
• Cross-Node Session Replication - Replicates active connection tables across nodes to maintain existing sessions during hardware transitions.
• Connection State Management - Allows searching, filtering, and removing entries from the firewall state table to terminate connections.
• Virtual IP Management - Assigns shared virtual addresses across multiple interfaces to enable seamless fail-over.
• Virtual IP Routing - Configures outbound NAT rules to use virtual addresses for seamless transition between nodes.
• VPN Tunnels - Establishes encrypted network tunnels using IPsec, OpenVPN, and WireGuard for secure remote connectivity.
• Configuration Policy Synchronization - Copies configuration changes from a primary system to secondary firewalls to ensure consistent security policies.
• Network Address Translation - Provides comprehensive network address translation to map private internal IPs to public external interfaces.
• Intrusion Prevention Systems - Detects and automatically blocks malicious network activity using packet inspection and threat signatures.
• Network Intrusion Detection - Inspects network traffic in real-time against rule sets to alert on or drop malicious packets.
• Network Traffic Filtering - Defines security policies to allow, block, or reject network traffic based on interface and direction.
• Secure Remote Access - Establishes encrypted tunnels using IPsec, OpenVPN, or WireGuard for secure site-to-site and remote user connectivity.
• Signature-Based Threat Detectors - Provides the ability to download and update signature sets from third-party providers to detect known attack patterns.
• Modular Plugin Architectures - Extends system functionality via a modular architecture that allows installing optional software packages with backend logic and UIs.
• Cluster Monitoring - Tracks the state of high availability groups and manages maintenance mode for redundant nodes.
• Firewall Log Analyzers - Records and inspects firewall events to monitor connectivity and troubleshoot security policy blocks.
• Programmable Security APIs - Provides a programmatic API for managing backend security settings and firewall rules to bypass the graphical interface.
• Infrastructure Service Deployment - Deploys and manages essential infrastructure tools including DHCP, DNS, and captive portals to ensure client connectivity.
• Real-Time Traffic Monitoring - Displays a live stream of matched firewall rules filtered by source or destination in real time.
• Security Event Monitoring - Views and analyzes triggered intrusion events to collect details about detected security threats.
• Network Session Monitors - Provides real-time monitoring of active network traffic sessions, including source, destination, and protocol.
• Security Operation Dashboards - Features a centralized dashboard for monitoring system status and configuring security settings in real time.
• Administrative API Endpoints - Provides structured JSON endpoints for modifying system security data and executing administrative actions.
• Perimeter Security Management - Filters and routes network data using rules and aliases to secure the network perimeter.
• System Configuration Templates - Produces service and application configuration files from templates by merging them with system-specific variables.
• Guest Access Vouchers - Creates time-limited access tickets for guest users and exports them to CSV files for distribution.
• Static IP Reservations - Binds a specific IP address to a unique client MAC address to ensure consistent addressing.
• Network Traffic Export - Extracts network traffic totals and flow records into CSV format for external security analysis.
• Service Configuration Templates - Uses a built-in template engine to produce precise configuration files for installed services and applications.
• Service - Synchronizes background service behavior across boot and shutdown stages using a phased event system.
• System Package Managers - Tracks installed packages, verifies licenses, and manages version locking to prevent unwanted software updates.
• System Service Managers - Provides an interface to track, start, stop, and restart background system services.
• Boot Sequence Automation - Uses a phased hook system to automate the execution of tasks and scripts during the system boot process.
• Auditable Configuration Histories - Compares historical configuration versions using a diff format to identify changes and revert to previous states.
• Network Control APIs - Provides an API to programmatically update IP entries for host, network, and external aliases to automate address mapping.
• Release Lifecycle Management - Manages the operational lifecycle of software releases with curated upgrade paths to ensure enterprise stability.
• Service Lifecycle Management - Coordinates service behavior across boot and shutdown stages using a hook-based lifecycle management system.
• Network Traffic Flow Visualizers - Provides graphical visualizations of network traffic patterns to identify top users and destination ports.
• Cellular Connectivity Modules - Integrates 3G and 4G LTE modems to serve as primary or backup WAN interfaces.
• Cellular WAN Management - Configures internal wireless networks and manages cellular modem connections for internet access.
• IPv6 Prefix Advertisements - Sends router advertisements to clients to facilitate automatic IPv6 network configuration.
• Prefix Delegations - Provides IPv6 prefix delegation to downstream routers using dynamic leases or static mappings.
• DHCP Client Tagging - Assigns labels to clients based on vendor IDs to deliver customized settings via DHCP.
• DHCP Request Relaying - Routes DHCP requests received on one interface to a designated server on another network.
• DHCP Request Relaying - Forwards DHCP requests from one interface to a server on a different network.
• DNS Registration - Automatically maps DHCP-assigned IP addresses to hostnames for easier local device discovery.
• Lease Statistics - Tracks IP assignments and client hostnames to provide diagnostics on DHCP lease usage.
• Alias Resolution - Handles resolution frequency and certificate validation for external hostnames used in network aliases.
• Rule Categorizations - Assigns labels to firewall rules to enable filtered views and simplified ruleset maintenance.
• GeoIP-Based IP Blocking Tools - Blocks or allows network traffic based on geographic country data using integrated GeoIP databases.
• Remote List Synchronization - Fetches IP address tables from remote servers in text or JSON format on a predefined schedule.
• MAC Address Reservations - Maps client identifiers or MAC addresses to fixed IP addresses to ensure consistent network identity.
• IPv6 Tunneling - Creates IPv6 over IPv4 connectivity using tunneling protocols to enable traffic over older infrastructure.
• Logical Interface Grouping - Combines multiple interfaces into a single logical entity to apply uniform security policies.
• NAT Reflection Controllers - Implements NAT reflection to allow internal clients to access local services via their public WAN IP.
• IP Alias Management - Adds extra network addresses to an interface to bind services or define rules.
• Network Address Set Management - Specifies source or destination addresses using CIDR notation, aliases, or interfaces for traffic filtering.
• Route Tracing - Maps the route traffic takes to a destination to identify hops and network latency.
• Packet Capture Implementations - Intercepts traffic on specified interfaces using filters to capture packets into pcap files for analysis.
• Network Traffic Normalization - Standardizes inconsistent protocol packets on a per-interface basis to protect internal machines from protocol-based attacks.
• Network Task Offloads - Allows disabling hardware checksumming and segmentation to ensure compatibility with intrusion prevention systems.
• Daemon Control Sockets - Executes system actions and controls daemons via a centralized service using a socket-based interface.
• Static DHCP Mappings - Links a client identifier to a specific IP to ensure a constant network address via DHCP.
• IPv6 Traffic Suppression - Implements mechanisms to ignore IPv6 configurations and block all transit IPv6 traffic.
• Traffic Normalization Rules - Enforces TCP/IP constraints such as maximum MSS and minimum TTL based on firewall criteria to normalize traffic.
• x86_64 Device Support - Provides full kernel-level and operational support for x86-64 architectures across diverse hardware form factors.
• System Data Template Generators - Generates environment-specific system configuration files from templates to ensure consistency across nodes.
• Daemon API Interfaces - Provides a specialized socket-based interface for starting, stopping, and controlling background system daemons.
• Access Control Lists - Defines specific permissions and access rules for users to restrict or grant access to system resources.
• API Access Security - Secures API access by controlling which endpoints are accessible to specific API keys based on user privileges.
• Cloud-Synced Configurations - Saves system settings to encrypted cloud storage with integrated version history tracking.
• Certificate Authority Management - Generates and manages the full lifecycle of client, server, and authority certificates, including signing requests.
• Custom Detection Rules - Allows the creation of user-defined patterns and fingerprints to block specific sites or network traffic patterns.
• Trust Store Managers - Manages system-wide trust constraints for intermediate CAs, CRL storage, and cipher protocols.
• Revocation List Management - Creates and maintains Certificate Revocation Lists to verify the validity of digital certificates before they expire.
• One-Time Passwords - Secures system access using time-based or event-based one-time password verification for multi-factor security.
• Packet Normalization - Scrubs and cleans network packets to ensure they conform to standards and prevent evasion.
• Rule Priority Logic - Defines priorities and actions for intrusion rules based on metadata to refine malicious traffic blocking.
• Dependency Vulnerability Scanning - Scans installed system packages against known vulnerability databases to identify security flaws.
• Exhaustion Prevention - Uses syncookies to defer memory allocation until a TCP handshake is completed to prevent state exhaustion.
• Web Application Firewalls - Inspects and blocks malicious HTTP requests using a rule-based web application firewall.
• TOTP Seed Generators - Generates one-time password seeds for multi-factor authentication that can be scanned by mobile devices.
• Configuration Version Control - Integrates with Git to maintain a traceable and auditable history of all system setting modifications.
• Engine Behavior Configuration - Allows behavioral tuning of the network inspection engine using custom YAML templates and tags.
• Controller-Based Routing - Uses architectural patterns to map incoming network requests to specific backend operations via structured interface handlers.
• Plugin Installation and Management - Provides a full lifecycle for building, installing, and managing plugins that extend backend logic and user interfaces.
• Modular Plugin Extensions - Provides a modular plugin architecture for extending the system with new administrative features and UIs.
• Remote Node Administration - Monitors service status and triggers restarts on backup servers from a centralized management interface.
• Backend Service Execution - Implements a centralized backend service to execute system actions, run scripts, and manage daemons.
• Configuration Backups - Exports system settings and statistics to password-protected files or remote cloud storage for backup.
• DHCP Lease Managers - Triggers the release or renewal of IP addresses for interfaces using dynamic configuration.
• DNS Resolution Testers - Includes tools to resolve hostnames to IP addresses directly from the system to verify DNS resolution.
• Firewall Performance Metrics - Provides detailed metrics including packet counters per interface and active rule timeouts.
• Log Analysis - Visualizes firewall log lines across various properties to identify network traffic patterns.
• Traffic Shaping and Prioritization - Prioritizes applications and limits bandwidth consumption per user using traffic shaping queues.
• Flow Record Querying - Allows filtering network flow records by date, interface, or IP to investigate specific traffic events.
• Network Health Monitors - Provides real-time status, assigned IP addresses, and link details to verify network interface health.
• Network Statistics Tracking - Provides real-time metrics and status updates on network traffic and interface activity.
• System Health Monitoring - Runs diagnostic checks on connectivity and disk integrity to troubleshoot system update failures.
• Reachability Testing - Sends ICMP echo requests to remote hosts to verify network reachability and routing.
• Resource Monitoring Widgets - Ships a dashboard with widgets for real-time monitoring of CPU, memory, and disk utilization.
• System Event Logging - Displays event logs for firewall components within the management interface to assist in troubleshooting.
• System Configuration Restorers - Reinstates previous configuration states while allowing the exclusion of hardware-specific console settings.
• Dashboard Widgets - Ships modular interface components for at-a-glance monitoring and quick function access on the system dashboard.
• Service Control APIs - Allows controlling the operational state and configuration of background services through programmable API calls.
• JSON APIs - Provides programmable endpoints using JSON payloads to modify security data and execute administrative actions.

Star history