So I’ve been using OPNsense for a few years. I have an extensive config inclduing vlans, plugins, policies, suricata, VPN, routes, gateways, HAProxy, etc.
Over the past few months, I’ve noticed certain bugs, weirdness, and slowness within OPNsense. I recently watched Tom Lawrence’s video on the licensing changes and he touched on the openssl vulnerability that OPNsense has yet to remediate.
The Plus license cost (per year) which entitles you to some limited support options is also appealing. Every time I get stuck figuring out something complex in OPNsense, I have to hope someone else has tried to do the same thing and posted about it so I can troubleshoot.
I also don’t like having to constantly update. A more “stable”/enterprise focused cycle like pfSense has seems like my pace. It broke on me last year with one of the upgrades and I had to clean install.
Don’t get me wrong, I love the UI (mostly), plugins, etc. in OPNsense, but these past few months have got me thinking.
I’ve also heard that people don’t like Netgate as a company, so that could definitely factor into not switching.
What are everyone’s thoughts?
If stability is what you’re after (both in terms of versioning and in the sense of as few unscheduled reboots as possible), then neither is a good option. Both update quite often and go with an “introduce feature now, worry about stability later” and end up having to constantly patch a bunch of stuff.
If you’re comfortable with a CLI, then I’d recommend Vyos and then going with the stable branch. It’s had 3 service patches since 1.3.0 released in 2021. The last being in june and before that, you have to go to september last year. Ofc, downside is that you’ll miss out on a lot of features. Like I don’t think stable has wireguard support yet, and not certain it will be ready for when 1.4 goes stable either (it’s currently in 1.4 rolling). You could implement some of it yourself because it’s built on Debian, but anything you do like that is tied to your current image. So if you upgrade, you have to do it again so I don’t recommend it.
Point is, if you need features, don’t, but if it’s the most stable you’re after, I can highly recommend at least having a look. Though I always recommend getting a proper router above any router os on amd64. You’ll get more out of it, cheaper, with less power consumption and lower latency.