Distribution for creating firewalls , which is a branch of the pfSense project, created to form a fully open distribution capable of providing commercial-level functionality for deploying firewalls and network gateways. Unlike pfSense, the project is positioned as not controlled by any single company, developed with the direct participation of the community, and possesses a completely transparent development process, as well as providing the ability to use any of its developments in third-party products, including commercial ones. The source texts for the distribution components, as well as the tools used for assembly, under the BSD license. Builds available as LiveCD and an image for writing to Flash drives (420 MB).
The basic framework of the distribution is based on the code , which supports a synchronized fork of FreeBSD, integrating additional protection mechanisms and techniques against vulnerability exploitation methods. Among of OPNsense, one can highlight the fully open build toolkit, the ability to install in the form of packages over standard FreeBSD, load balancing tools, a web interface for organizing user connections to the network (Captive portal), mechanisms for tracking connection states (stateful firewall based on pf), setting bandwidth limits, traffic filtering, creating VPNs based on IPsec, OpenVPN, and PPTP, integration with LDAP and RADIUS, support for DDNS (Dynamic DNS), and a system of visual reports and graphs.
Additionally, the distribution provides tools for creating fault-tolerant configurations, based on the use of the CARP protocol, allowing a backup node to be launched alongside the primary firewall, which will be automatically synchronized at the configuration level and take on the load in case of a primary node failure. For the administrator, a modern and simple interface for configuring the firewall is offered, built using the Bootstrap web framework.
In the new version:
- Added support for DHCPv6 Multi-WAN for connecting through multiple channels;
- Enabled the possibility to define custom pages displayed on connection errors through a web proxy;
- The implementation of the intrusion detection and prevention system has been updated to ;
- The base system is synchronized with HardenedBSD 12.1, a fork of FreeBSD 12.1, which integrates additional protection mechanisms and techniques to counteract vulnerability exploitation methods;
- A report with a tree view of network connection information has been added;
- An API for managing the firewall has been implemented;
- Enhanced capabilities for filtering logs on the fly.
Source: opennet.ru
