Long term pfSense user here (4+ years). I have followed the discussion for pfSense issues in recent months, and overall agree. However, I think the situation is

Long term pfSense user here (4+ years). I have followed the discussion for pfSense issues in recent months, and overall agree. However, I think the situation is a little bit more nuanced towards the context pfsense is used: If you have open WAN ports, for hosting services, I would avoid pfSense as it is now. If you have a fully closed WAN, with several mechanisms added to block local access (VLANs etc.), then the difference between OPNSense/pfSense is really not that obvious. Even if you have a OpenVPN Server on a single port, lets say UDP, it is possible to add HMAC, 2-Factor-Auth etc. in pfSense, too. So the security risks atm still seem rather low in this use context. pfSense currently just has a bit better support for packages. pfblockerng-devel, radius server for 2FA, Telegraf etc. Those are not available in OPNsense yet. Using pfblockerng-devel GeoIP lists, I can add an extra layer of security, allowing only certain countries to even reach my OpenVPN port. There is no guarantee that OPNSense is any better, other than the mentality aspect. It is a critical project and I am hoping to make the hop as soon as possible. At the moment, given my use case, I still feel that there is some time.