The release of the OPNsense 25.1 firewall distribution has been published. This project split from pfSense in 2015 with the goal of developing a completely open distribution that could match the functionality of commercial solutions for deploying firewalls and network gateways. Unlike pfSense, this project is positioned as independent of any single company, developed with direct community involvement, and boasts a fully transparent development process. It also allows the use of any of its developments in third-party products, including commercial ones. The source code of the distribution components, as well as the tools used for building, are distributed under the BSD license. Builds are available as LiveCD and system images for writing to Flash drives (497 MB).
The base of the distribution is based on FreeBSD code. OPNsense features include a fully open build toolkit, support for installing as packages on top of standard FreeBSD, load balancing tools, a web interface for connecting users to the network (Captive portal), mechanisms for stateful connection tracking (stateful firewall based on pf), bandwidth limiting, traffic filtering, and creation. VPN based on IPsec, OpenVPN, and PPTP, LDAP and RADIUS integration, DDNS (Dynamic DNS) support, and a system of visual reports and charts.
The distribution can be used to create high-availability configurations based on the CARP protocol, allowing the launch of a standby node alongside the main firewall that will automatically synchronize at the configuration level and take over the load in case of a primary node failure. A web interface for configuring the firewall is offered to the administrator, built using the Bootstrap web framework and Phalcon MVC.
Among the changes:
- A new user interface design has been proposed, supporting both light and dark themes.
- The transition to the FreeBSD 14.2 codebase has been carried out (previously using FreeBSD 14.1 code).
- Interfaces for managing users, groups, and privileges, as well as the high-availability status page and settings page, have been migrated to use the MVC framework and are now also accessible via Web API for automating network configuration management.
- The implementation of security zones has been improved, allowing the creation of groups of network interfaces and binding firewall rules to them (for example, creating zones for a secure internal network, external network, externally accessible services, and systems for external users).
- Support for ZFS snapshots has been added.
- The inclusion of custom extensions in sshd_config has been allowed.
- Support for RFC 5549 has been added for announcing IPv4 routing information using IPv6 Next Hop. The code for creating static routes has been refactored.
- The notification output mechanism has been improved. Support for persistent notifications and pinned banners has been added.
- A widget has been added to track certificate lifespan expiration and facilitate quick certificate updates.
- Experimental support for traffic shaping configuration (inline shaper) has been added to the packet filtering rules.
- An implementation of the 9P file system (p9fs) has been added.
- Updated versions of PHP 8.3.15, lighttpd 1.4.77, openvpn 2.6.13, and radvd 2.20.
- Plugins updated: os-acme-client 4.8, os-caddy 1.8.1, os-cpu-microcode 1.1, os-haproxy 4.5, and os-tailscale 1.2.
Source: opennet.ru
