3 ms·

This is so helpful thank you. I'm assuming opnsense competes with OpenWRT? What are the pros and cons?

jeroenhd 4y ago
I believe OpenWRT is intended as alternative firmware for your average off-the-shelf router, whereas pfSense/OPNSense are more intended as enterprise firewalls/network appliances. Take a look at the official OPNsense store (https://shop.opnsense.com/ https://shop.opnsense.com/) to get an idea about the types of devices and customers this tool is oriented at. Most OPNSense hardware is likely to be more powerful than your average OpenWRT router. OpenWRT can use a variety of interfaces and has many packages you can install, but the UI is less well-integrated with tools like intrusion detection and network traffic analysis. OpenWRT is supposed to be flashed to devices with 16MB (or less) of storage whereas OPNsense can take advantage of much larger install disks. On a technical level: OpenWRT is Linux-based, OPNSense is FreeBSD-based. This has an impact on hardware and software support, though I've rarely seen people running into software limitations with OPNSense. In terms of pros and cons: - Personally, I much prefer the OPNsense GUI over the OpenWRT one. - OPNsense comes with way more software out of the box; whether you need all that is an entirely different question, though. - OpenWRT often runs on routers you may already own - OpenWRT is generally easier to set up and use. It's comparable to an advanced stock router UI. - Because OpenWRT is built around WiFi-routers rather than security appliances, OpenWRT is much better for managing things like WiFi - OpenWRT is Linux-based so it potentially has much better WireGuard support. OPNsense can also host a WireGuard server, but the WireGuard protocol was originally developed around the Linux kernel implementation. OpenVPN and IPsec+L2TP are supported in both. - OPNsense has some very useful traffic shaping tools in the GUI for things like limiting the throughput of a guest network, though that will take some know-how to set up. - OPNsense provides enterprise features in the web GUI like failovers and multi-WAN that require editing config files over SSH and installing packages on OpenWRT. - OpenWRT does some quality-of-life tricks for you. For example, port forwarding is a lot easier on OpenWRT than it is on OPNsense as the necessary firewall rules are all generated for you, whereas in OPNsense you may need to add separate firewall and NAT rules depending on your setup. The learning curve for OPNsense is much steeper, however it allows more flexibility in its web UI than OpenWRT (you can pretty much get the same features through SSH on either platform, though) - If you intend to run this stuff for a business, OPNsense has business support available whereas OpenWRT runs most off of community support. You can pay external parties to help you with OpenWRT of course, but there is no direct support contract available as far as I'm aware. If you want to add more features to your already-owned router, I would recommend OpenWRT. If you want to drill down and experiment with networking, I would recommend OPNsense. You can see the difference for yourself if you set up a couple of VMs. For example, set up two small Linux/Windows VMs and a router VM, attach the router VM to both your own network as well as a virtual network, and then attach the two Linux VMs to that virtual network as well. You've then basically virtualised your network and can experiment with settings, firewall rules, port forwards, whatever you need. Both OpenWRT and OPNsense can be run as virtual machines (https://www.sunnyvalley.io/docs/network-security-tutorials/how-to-install-opnsense-on-vbox https://www.sunnyvalley.io/docs/network-security-tutorials/h..., https://openwrt.org/docs/guide-user/virtualization/virtualbox-vm https://openwrt.org/docs/guide-user/virtualization/virtualbo...). You won't be able to test support for directly hooking up to your ISP through a VM, so that part is still a bit more difficult, but if you want to see how easy/hard it is to manage your network through these, I recommend setting As a side note, OPNsense is a fork of Pfsense, another popular network appliance distribution. This has led to some beef between the Pf/OPNsense communities, as both Pfsense and OPNsense make money selling dedicated hardware and their user base was divided after the split. Personally, I see it more as a choice of preferred GUI as most features can be found in both. Pfsense has a longer history and therefore more old support threads if you need to troubleshoot something, though I find their interface a bit clunky in comparison. Not all modules/packages are available for both platforms so take that into account if you're looking for specific features.

I believe OpenWRT is intended as alternative firmware for your average off-the-shelf router, whereas pfSense/OPNSense are more intended as enterprise firewalls/network appliances. Take a look at the official OPNsense store (https://shop.opnsense.com/ https://shop.opnsense.com/) to get an idea about the types of devices and customers this tool is oriented at. Most OPNSense hardware is likely to be more powerful than your average OpenWRT router. OpenWRT can use a variety of interfaces and has many packages you can install, but the UI is less well-integrated with tools like intrusion detection and network traffic analysis. OpenWRT is supposed to be flashed to devices with 16MB (or less) of storage whereas OPNsense can take advantage of much larger install disks. On a technical level: OpenWRT is Linux-based, OPNSense is FreeBSD-based. This has an impact on hardware and software support, though I've rarely seen people running into software limitations with OPNSense. In terms of pros and cons: - Personally, I much prefer the OPNsense GUI over the OpenWRT one. - OPNsense comes with way more software out of the box; whether you need all that is an entirely different question, though. - OpenWRT often runs on routers you may already own - OpenWRT is generally easier to set up and use. It's comparable to an advanced stock router UI. - Because OpenWRT is built around WiFi-routers rather than security appliances, OpenWRT is much better for managing things like WiFi - OpenWRT is Linux-based so it potentially has much better WireGuard support. OPNsense can also host a WireGuard server, but the WireGuard protocol was originally developed around the Linux kernel implementation. OpenVPN and IPsec+L2TP are supported in both. - OPNsense has some very useful traffic shaping tools in the GUI for things like limiting the throughput of a guest network, though that will take some know-how to set up. - OPNsense provides enterprise features in the web GUI like failovers and multi-WAN that require editing config files over SSH and installing packages on OpenWRT. - OpenWRT does some quality-of-life tricks for you. For example, port forwarding is a lot easier on OpenWRT than it is on OPNsense as the necessary firewall rules are all generated for you, whereas in OPNsense you may need to add separate firewall and NAT rules depending on your setup. The learning curve for OPNsense is much steeper, however it allows more flexibility in its web UI than OpenWRT (you can pretty much get the same features through SSH on either platform, though) - If you intend to run this stuff for a business, OPNsense has business support available whereas OpenWRT runs most off of community support. You can pay external parties to help you with OpenWRT of course, but there is no direct support contract available as far as I'm aware. If you want to add more features to your already-owned router, I would recommend OpenWRT. If you want to drill down and experiment with networking, I would recommend OPNsense. You can see the difference for yourself if you set up a couple of VMs. For example, set up two small Linux/Windows VMs and a router VM, attach the router VM to both your own network as well as a virtual network, and then attach the two Linux VMs to that virtual network as well. You've then basically virtualised your network and can experiment with settings, firewall rules, port forwards, whatever you need. Both OpenWRT and OPNsense can be run as virtual machines (https://www.sunnyvalley.io/docs/network-security-tutorials/how-to-install-opnsense-on-vbox https://www.sunnyvalley.io/docs/network-security-tutorials/h..., https://openwrt.org/docs/guide-user/virtualization/virtualbox-vm https://openwrt.org/docs/guide-user/virtualization/virtualbo...). You won't be able to test support for directly hooking up to your ISP through a VM, so that part is still a bit more difficult, but if you want to see how easy/hard it is to manage your network through these, I recommend setting As a side note, OPNsense is a fork of Pfsense, another popular network appliance distribution. This has led to some beef between the Pf/OPNsense communities, as both Pfsense and OPNsense make money selling dedicated hardware and their user base was divided after the split. Personally, I see it more as a choice of preferred GUI as most features can be found in both. Pfsense has a longer history and therefore more old support threads if you need to troubleshoot something, though I find their interface a bit clunky in comparison. Not all modules/packages are available for both platforms so take that into account if you're looking for specific features.