The release of the distribution for creating firewalls OPNsense 25.7 has been published. In 2015, it separated from the pfSense project with the goal of developing a completely open distribution that could have the functionality of commercial solutions for deploying firewalls and network gateways. Unlike pfSense, the project is positioned as not controlled by a single company, developed with the direct participation of the community and having a completely transparent development process, as well as providing the ability to use any of its developments in third-party products, including commercial ones. The source code of the distribution components, as well as the tools used for assembly, are distributed under the BSD license. The assemblies are prepared in the form of LiveCD and a system image for recording on Flash drives (490 MB).
The distribution's core is based on FreeBSD code. OPNsense features include: a fully open source build toolchain, support for installation as packages on top of regular FreeBSD, load balancing tools, a web interface for organizing user connections to the network (Captive portal), connection state tracking mechanisms (stateful firewall based on pf), a bandwidth limiting system, traffic filtering, and creation VPN based on IPsec, OpenVPN and PPTP, integration with LDAP and RADIUS, DDNS (Dynamic DNS) support, a system of visual reports and graphs.
The distribution can be used to create fault-tolerant configurations based on the CARP protocol and allowing a backup node to be launched in addition to the main firewall, which will be automatically synchronized at the configuration level and will take over the load in the event of a failure of the primary node. The administrator is offered a web interface for configuring the firewall, built using the Bootstrap web framework and Phalcon MVC.
Among the changes:
- The transition to the FreeBSD 14.3 code base has been made (previously FreeBSD 14.2 code was used).
- The setup wizard has been moved to use the MVC framework and is now additionally available via the Web API to automate network configuration management.
- Dnsmasq is used as the default DHCP implementation instead of ISC DHCP. The optional ability to use the Kea DHCP server for DHCPv6 has been added.
- Work on separating privileges when working with the web interface has been carried out. An experimental option to launch the web interface under a separate user "wwwonly" instead of "root" has been added.
- The firewall now has an "expire" option for automatically cleaning tables via cron. A new alias caching model is enabled.
- Additional authentication profiles have been added to the Captive portal.
- By default, the FreeBSD-kmods repository is disabled and third-party plugins developed by the community are hidden (a button has been added to the plugins page to show such plugins).
- The intrusion detection toolkit now supports the JA4 traffic fingerprinting method.
- Improved user interface for automating firewall operations.
- Added plugin for saving backups via SFTP.
- The user interface uses the Tabulator JavaScript library instead of Bootgrid for tabular content layout.
- Updated plugins: os-acme-client 4.10, os-bind 1.34, os-crowdsec 1.0.11, os-frr 1.45, os-gdrive-backup 1.0, os-grid_example 1.1, os-openvpn-legacy 1.0, os-puppet-agent 1.2 and os-strongswan-legacy 1.0.
Source: opennet.ru
