The release of the OPNsense 24.7 firewall distribution has been published. Nine years ago, it separated from the pfSense project with the goal of developing a fully open distribution that could match the functionality of commercial solutions for deploying firewalls and network gateways. Unlike pfSense, this project is positioned as independent from any single company, developed with direct community involvement, and has a completely transparent development process. It also allows the use of its developments in third-party products, including commercial ones. The source texts of the distribution components and the tools used for building are distributed under the BSD license. The builds are available as LiveCD and system images for writing to flash drives (488 MB).
The basic filling of the distribution is based on the FreeBSD code. Among the features of OPNsense, one can highlight a fully open build toolset, the ability to install as packages on top of standard FreeBSD, load balancing tools, a web interface for organizing user connections to the network (Captive portal), mechanisms for connection state tracking (stateful firewall based on pf), setting bandwidth limits, traffic filtering, and creating VPN based on IPsec, OpenVPN, and PPTP, LDAP and RADIUS integration, DDNS (Dynamic DNS) support, and a system of visual reports and charts.
The distribution provides tools for creating fault-tolerant configurations based on the CARP protocol, allowing the deployment of a backup node alongside the primary firewall, which will be automatically synchronized at the configuration level and take over the load in case of a primary node failure. For administrators, a modern and simple interface for configuring the firewall is offered, built using the Bootstrap web framework and Phalcon MVC.
Among the changes:
- The transition to the FreeBSD 14.1 codebase has been completed (previously, FreeBSD 13.2 code was used).
- A new implementation of the dashboard has been proposed, notable for its modern design and transition to a new widget format (support for old widgets has been discontinued).
- The establishment of connections in the WireGuard-based VPN has been significantly accelerated. Support for generating QR codes for quick setup of mobile clients has been added.
- OpenVPN now supports the DCO (Data Channel Offload) mechanism, which offloads encryption operations, packet processing, and connection management to a kernel-level module. DCO eliminates the overhead associated with context switching, optimizes performance through direct access to internal kernel APIs, and avoids slow data transfer between the kernel and user space (encryption, decryption, and routing are handled by the module without sending traffic to a user-space handler).
- Interfaces for managing GIF and GRE tunnels, as well as configuring trust chains, fault tolerance, and one-to-one NAT address translation have been updated to use the MVC framework. Web APIs have been added to automate network configuration management.
- DHCPv6 support has been enhanced.
- Support for the dynamic creation of IPsec VTI (Virtual Tunnel Interface) tunnels has been added.
- Versions have been updated: Python 3.11, hostapd 2.11, libpfctl 0.12, phalcon 5.8.0, openvpn 2.6.12, wpa_supplicant 2.11.
- Plugins have been updated: os-acme-client 4.4, os-caddy 1.6.1, os-dec-hw 1.1, os-etpro-telemetry 1.7, os-freeradius 1.29.4, os-nginx 1.34, os-theme-cicada 1.37, and os-theme-vicuna 1.47.
Source: opennet.ru
