The release of the OPNsense 25.7 firewall distribution has been announced. This distribution was forked from the pfSense project in 2015, aimed at creating a fully open-source solution that could offer functionality comparable to commercial offerings for deploying firewalls and network gateways. Unlike pfSense, this project is positioned as independent and developed with direct community involvement, featuring a completely transparent development process and allowing the use of any of its findings in third-party products, including commercial ones. The source texts of the distribution components and the tools used for building it are distributed under the BSD license. It is available in the form of LiveCD and an image for writing to flash drives (490 MB).
The distribution is based on the FreeBSD code. Among the features of OPNsense are: a fully open build toolset, support for package installation on top of regular FreeBSD, load balancing tools, a web interface for user network connection management (Captive portal), stateful firewall mechanisms based on pf, bandwidth limiting, traffic filtering, and more. VPN based on IPsec, OpenVPN, and PPTP, LDAP and RADIUS integration, DDNS (Dynamic DNS) support, and a system of visual reports and charts.
The distribution can be used to create high-availability configurations based on the CARP protocol, allowing the launch of a standby node alongside the main firewall that will automatically synchronize at the configuration level and take over the load in case of a primary node failure. A web interface for configuring the firewall is offered to the administrator, built using the Bootstrap web framework and Phalcon MVC.
Among the changes:
- A transition to the FreeBSD 14.3 code base has been made (previously it used FreeBSD 14.2 code).
- The setup wizard has been transitioned to use an MVC framework and is now additionally available through a Web API for automating network configuration management.
- As the default DHCP implementation, Dnsmasq is used instead of ISC DHCP. An optional ability to use the Kea DHCP server for DHCPv6 has been added.
- Work has been done to separate privileges when using the web interface. An experimental option to run the web interface under a separate user 'wwwonly' instead of 'root' has been added.
- An 'expire' option has been added to the firewall for automatic table cleanup via cron. A new alias caching model has been implemented.
- Additional authentication profiles have been added to the Captive Portal.
- By default, the FreeBSD-kmods repository is disabled and third-party plugins developed by the community are hidden (a button has been added on the plugins page to show such plugins).
- Support for the JA4 traffic fingerprinting method has been added to the intrusion detection toolkit.
- The user interface for automating operations with the firewall has been improved.
- A plugin for saving backups via SFTP has been added.
- The JavaScript library Tabulator is used instead of Bootgrid for the tabular content layout in the user interface.
- Updated plugins: os-acme-client 4.10, os-bind 1.34, os-crowdsec 1.0.11, os-frr 1.45, os-gdrive-backup 1.0, os-grid_example 1.1, os-openvpn-legacy 1.0, os-puppet-agent 1.2, and os-strongswan-legacy 1.0.
Source: opennet.ru
