OPNsense: Firewall and Router Ledger 2026 Scorecard
OPNsense ships two majors a year on dates fixed since 2015, keeps every feature free and carries no CISA KEV entry, while ARM and central management stay thin.
Each square is one capability area in one year. The brighter it is, the more the area gained in the Firewall and Router Ledger that year; 1, 2 and 3 mark that year's biggest pushes.
’16
’17
’18
’19
’20
’21
’22
’23
’24
’25
’26
Routing and WAN
1
2
1
Firewall and NAT core
2
VPN and remote access
1
1
1
Threat protection
1
2
3
Network services
2
2
Platform and hypervisor freedom
1
High availability and performance
3
Management, API and automation
2
3
1
1
Observability
1
Platform security and lifecycle
2
no change+0.5+1+1.5 or moreScores out of 5 per area.
Biggest pushes overall: Threat protection (+2.5), Routing and WAN (+2), Management, API and automation (+2). Already strong in 2015: Firewall and NAT core, Network services, High availability and performance.
Top focus each year: 2016 Threat protection; 2017 VPN and remote access; 2018 Routing and WAN; 2019 VPN and remote access; 2020 Observability; 2021 Platform and hypervisor freedom; 2023 VPN and remote access; 2024 Management, API and automation; 2025 Management, API and automation; 2026 Routing and WAN. 1 of 11 years show no gain in any area.
Owner: Deciso B.V. (Middelharnis, the Netherlands; private, founded 2000; launched OPNsense on 2015-01-02 as a pfSense fork)
Engine: FreeBSD with pf, Suricata, Unbound, Kea and Dnsmasq; FRR as a plugin; HardenedBSD protections until 19.1
Licence: 2-clause BSD for the Community Edition, free with no feature, node or throughput limits. Business Edition 149 EUR per installation per year or 399 EUR for three years (shop, 2026-10-15), adds a slower commercial repository, GeoIP data, an OVA image and OPNcentral; Business Support Subscription 329 EUR per year. Zenarmor (Sunny Valley Networks) is a third-party layer 7 plug-in with a free tier and paid editions, sold also through the OPNsense shop; it is a plug-in here, not a Ledger entry
Latest release: Community 26.7.7 (2026-10-13); major 26.7 (2026-07-15) on FreeBSD 15.1; Business 26.4.2 (2026-08-14 on the release page)
Support lifecycle: Two majors a year on fixed dates (January and July for Community, April and October for Business); point releases every one to three weeks; only the current series receives fixes; in-place upgrades through the firmware tool; no LTS branch and no published end-of-life dates
Next milestone: 27.1 planned for January 2027: native NAT64, endpoint-independent NAT, WireGuard peer generator revamp; PPTP and L2TP on PPP devices and IKEv1 to be removed
Security record: 0 entries on the CISA KEV catalogue for 2023 to 2026 (feed of 2026-10-15, 1,746 entries); no deduction. Security fixes ship in point releases, for example the shell escaping revamp in 25.7.8 and the FreeBSD rtsold fix in 25.7.10
Hypervisors: Documented on VMware ESXi, Hyper-V (generation 1 and 2, Secure Boot off), KVM, Xen and XCP-ng, plus AWS and Azure marketplace images; Proxmox VE runs it as a KVM guest without a page of its own; no Google Cloud image found; amd64 images only, no official ARM build
Tier: Open-source platform
Archetype: Dependable builder
Evidence grade: A. The release notes for every major from 16.1 to 26.7, the roadmap page, the release feed, the virtualisation page, the download page and the Deciso shop were read from primary sources, and the CISA KEV feed was queried on 2026-10-15. Business Edition prices before 2026, the partner programme and the security advisory page were not read; the pfSense fork lineage and the 2015 baseline rest on the project's own history.
Scope of the scores: The scores cover the Community Edition. The Business Edition runs the same code one step behind and adds OPNcentral and an OVA image. Zenarmor adds layer 7 application control as a plug-in and is not scored; without it OPNsense has no application identification of its own.
17.1: ASLR, SEGVGUARD and SafeStack from HardenedBSD (ASLR since 16.1); TLS 1.2 minimum in 21.1; 0 CISA KEV entries 2023 to 2026, so no deduction; no Secure Boot, series supported for six months
2017
VPN and remote access
2.5 → 3
+1.2
17.1: TOTP two-factor through PAM; 18.1 OpenVPN multi-remote
2018
Routing and WAN
1.5 → 2.5
+2.4
18.1: FRR plugin with BGP and OSPF
2018
Threat protection
2 → 3
+2.4
18.1: ET Pro and Snort VRT rulesets in the IDS plugin; Unbound blocklists
2019
Management, API and automation
1.5 → 2
+1.0
19.1: alias API complete
2019
VPN and remote access
3 → 3.5
+1.2
19.1: two-factor with LDAP plus TOTP; 20.1 IPsec public key authentication and EC certificates
2020
Management, API and automation
2 → 2.5
+1.0
20.1: logging API; the MVC rewrite moves more pages onto the API each release
2020
Observability
2 → 3
+1.2
20.1: logging frontend rewritten with an API; 22.1 RFC 5424 logging with severity filters
2020
Routing and WAN
2.5 → 3
+1.2
20.1: VXLAN and loopback devices; dpinger gateway monitoring since 19.1
2021
Firewall and NAT core
3 → 3.5
+1.2
21.1: rule categories; NAT logging (19.1), plugin-capable NAT and alias backend rewrite (18.1), dynamic IPv6 host aliases (22.1); no layer 7 identification without Zenarmor
2021
Platform and hypervisor freedom
2 → 3
+2.0
21.1: UEFI serial image; guest tool plugins for VMware, QEMU and Xen; AWS and Azure marketplace images (marketplace start dates not read); no ARM, no hardware acceleration
2021
Threat protection
3 → 3.5
+1.2
21.1: policy-based IDS rule management; Suricata 7 (24.1) and Suricata 8 inline divert mode (26.1); no TLS inspection or sandbox
2023
Network services
3 → 3.5
+0.8
23.1: Unbound blocklists rewritten with DNS statistics; captive portal rewritten in 16.1
2023
VPN and remote access
3.5 → 4
+1.2
23.1: IPsec on swanctl with a connections UI and API, WireGuard kernel module by default; 24.1 WireGuard in core with CARP tracking; 24.7 dynamic VTI; 26.7 OpenVPN 2.7 with TLS-Crypt v2; no vendor ZTNA client
2024
High availability and performance
3 → 3.5
+0.8
24.1: Kea DHCP high availability and CARP VHID tracking for OpenVPN and WireGuard; PIE and FQ-CoDel shaping since 19.1; active-passive only
2024
Management, API and automation
2.5 → 3
+1.0
24.1: firewall filter and source NAT API; GRE, GIF and 1:1 NAT on the API
2024
Network services
3.5 → 4
+0.8
24.1: Kea DHCPv4 with high availability; 25.7 Dnsmasq DHCP and Kea DHCPv6; 26.7 captive portal IPv6, Kea DDNS and dynamic prefix delegation
2024
Observability
3 → 3.5
+0.6
24.7: streaming dashboard; Unbound DNS statistics (23.1); packet capture in the UI
2025
Management, API and automation
3 → 3.5
+1.0
25.1: user and group management API; 26.7 gateway groups and interface assignment on the API; OPNcentral central management in the Business Edition; no vendor Terraform or Ansible content
2026
Routing and WAN
3 → 3.5
+1.2
26.7: gateway groups and interface assignment on the MVC API; still no VRF, MPLS or probe-based path selection beyond gateway groups
Direction, 2023 to 2026
Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).
Date
Item
Theme
Driver
2023-01
23.1: IPsec moved to swanctl with a new connections UI and API; WireGuard kernel module by default
VPN
C
2023-01
23.1: plugin support tiers; legacy IPsec and OpenVPN pages moved to plugins as a step towards removal
Packaging
P
2024-01
24.1: Suricata 7
Threat protection
U
2024-01
24.1: Kea DHCPv4 with high availability replaces end-of-life ISC DHCP; Squid moved to a plugin
Network services
U
2024-01
24.1: WireGuard into core; CARP VHID tracking for OpenVPN and WireGuard
High availability
C
2024-01
24.1: firewall automation filter and source NAT on the API
Two majors a year on fixed dates since 15.1 (2015-01-05); the roadmap table shows every major delivered on its date; point releases every one to three weeks
Roadmap transparency
4
Public roadmap page with planned items per release, open GitHub repositories and issue tracker; no support windows or end-of-life dates published
Say-do
4
Roadmap items for 23.1 to 26.7 shipped in the named release; OpenVPN DCO stayed experimental from 24.7 with no GA found; 27.1 items pending
Velocity
3.5
Each release rewrites several pages onto the MVC API and brings one or two capabilities (Kea HA, Suricata 8 inline, Dnsmasq DHCP); fewer new features than migrations
Lifecycle stability
3
Six-month cycle with in-place upgrades and clean deprecation notices; the previous series stops receiving fixes at once; PPTP, L2TP and IKEv1 removal planned for 27.1
Commercial risk: 4.5 / 25 (lower is better)
Criterion
Score
Basis
Price and licence volatility
0.5
BSD licence unchanged; Business Edition listed at 149 EUR per year on 2026-10-15; no earlier price captured, no licence change found since 2023
Purchase constraints
0.5
Community Edition free with every feature; Business Edition per installation in any quantity; a cluster needs two subscriptions
Channel and access
1
Open download and open security fixes for everyone; Business repository lags the Community Edition by design; partner terms unpublished
Owner stability
1
Small private Dutch company, founder-led, no acquisition found; size is the dependency
Cost of staying supported
1.5
Updates are free, but staying patched means moving to a new series every six months; no LTS to stay on
Technical lock-in: 4.0 / 25 (lower is better)
Criterion
Score
Basis
Formats
1
One XML configuration file (config.xml) with documented backup and restore; plugins push backups to Git, Nextcloud, Google Drive and SFTP
Export path
1.5
No converter to or from other firewalls; pfSense XML is not directly compatible; rules rebuilt by hand or through the API
Stack coupling
0
Any storage, any switch; nothing beyond the host
Hardware / cloud coupling
0.5
Any x86-64 machine or hypervisor, fully offline; no ARM build
Skills and tooling coupling
1
FreeBSD and pf skills, less common than Linux; open REST API
Integrator fit: 10.0 / 20
Criterion
Score
Basis
Partner programme openness
2.5
Resellers exist (Thomas-Krenn and others) and Deciso sells direct; partner programme terms not found on opnsense.org or deciso.com
Multi-tenancy and self-service
2
OPNcentral in the Business Edition manages several firewalls; no tenancy, quotas or portal
API and infrastructure-as-code
3
MVC REST API covers most objects by 26.7; Terraform providers and Ansible collections are community-maintained
Skills and certification
2.5
Large community documentation and forum; Deciso training exists, no certification track verified
AI leverage: 2.0 / 20
How the product uses AI, scored per year like capability. Only GA counts.
Criterion
2019
2022
Today
Latest step
AI in threat detection
0
0
0
2015: None
AI platform stack
0
0
0
2015: None
AI-assisted operations
0
0
0
2015: None
Agent openness
1
1
2
2024: 24.1 onwards: REST API with key and secret covers firewall rules, NAT, aliases, VPN, DNS and DHCP; community MCP servers (vespo92/OPNSenseMCP 0.8.2, lucamarien) exist; an AGENTS.md file sits in the core repository; no official MCP server
AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. No AI item was announced by Deciso between 2023 and 2026.
OPNsense has no AI in its threat engine, no assistant in the console and no AI announcements; Suricata signatures and third-party rulesets do the detection. Its REST API is broad enough for agents to drive, which is why community MCP servers appeared in 2025 without any Deciso involvement.
Reading
OPNsense earns its credibility score the plain way: eleven years of majors on the dates the roadmap named, with every feature in the free edition and a point release whenever a fix is ready. Capability sits in the solid band across the board because the project keeps rebuilding its own pages onto the API rather than adding enterprise layers, so central management, VRFs, TLS inspection and ARM are missing while VPN, DHCP and firewall basics are complete. The commercial and lock-in scores are among the lowest in the Ledger because nothing is gated and the configuration is one XML file. A buyer should check how the six-month series change fits their change window, since the previous series stops receiving fixes as soon as the next one ships.
Open questions and items to re-score
Business Edition 26.4.2 carries two dates: 2026-08-14 on the release page and a forum post of 2026-10-06.
Business Edition prices before 2026 and the partner programme terms were not found; a blog claim of a 2026 increase to 199 to 249 EUR contradicts the shop and was not used.
OpenVPN DCO was experimental in 24.7; its status in 26.7 was not verified.
The security advisory page at opnsense.org/security was not read; the KEV result rests on the CISA feed alone.
NetFlow export and the Insight analyser predate the dossier's release notes; their first release was not dated.
Official ARM images: none on the download page; only unofficial community builds from 2019 to 2020 were found.
