Back in 2003, m0n0wall started as a GUI to manage a firewall. Manuel Kasper, its developer, once said that no option out there "met all [his] requirements", and he created m0n0wall as a result. Later, pfSense forked from m0n0wall, and OPNsense forked from pfSense in 2014. m0n0wall then shut down in 2015, with Kasper telling users to switch to OPNsense instead. What happened? How did OPNsense become the recommended GUI firewall even though it was late to the party? And which should you use?

OPNsense focuses on being a fully open-source software that values the community

A direct answer to pfSense's acquisition

There have always been concerns around pfSense and its commitment to open-source software. Between disagreement over transparency and a general movement towards a more closed development process and an increasing amount of proprietary code being licensed for use in pfSense, it set the stage for OPNsense come in as a true alternative.

OPNsense was forked in late 2014 and early 2015 by Deciso, a Dutch company, and outlined reasons for the fork. There were a lot of reasons, starting with the increasingly lack of transparency when it came to pfSense — especially after its majority share purchase by NetGate. In contrast, OPNsense is fully open, and the community is integrated in the development process. Plus, there's no proprietary code licensed for use in OPNsense, meaning that it's fully open source in every sense of the word.

However, that wasn't the only reason. Deciso also cited the technical reasons behind the fork, specifically calling out the "code quality" of pfSense and the development method that was used. Instead, they opted for a roadmap with regular releases and a gradual transition to a new architecture that moves away from the pfSense framework.

Finally, pfSense has recently enough made an effort to focus on pfSense Plus, a paid-for alternative to pfSense. Netgate, the company that owns pfSense, has said that Plus will receive more frequent updates, and there will be a divergence in features. OPNsense is completely free, and the paid-for edition is simply for business support and a few other additional features that benefit a business rather than a home user.

What makes OPNsense better?

A lot of things, really

First and foremost, both OPNsense and pfSense are very similar products under the hood, and they offer more or less the same experience. pfSense has a lot of documentation out there (though much of it applies to OPNsense) which can make it easier to set up with. However, if you want to stick to truly open-source projects and ideologies, then pfSense simply isn't an option anymore.

As for why there's a rather large mark against pfSense in the open-source community, the company once registered a fake domain claiming to be OPNsense and used imagery intended to damage the OPNsense name, only to be forced to hand over the domain in court. That incident, couple with pfSense launching pfSense Plus which will see more frequent updates and a continued divergence from the base community edition version of pfSense, has seen home labbers and general enthusiasts make the jump to OPNsense.

As for tangible differences, OPNsense is generally regarded to have a better user interface, a significantly better backup system, and even a nano edition that's designed to run on small devices from a flash card. There's also a search function in OPNsense and a focus on security, which is why the command line from web browser feature was removed.

Both pfSense and OPNsense are excellent firewalls that you can install on your NAS or home lab, but looking to the future, OPNsense looks like a more and more appealing option. While not all of the documentation of pfSense will transfer over, there are enough similarities that you can even follow what pfSense says to do and think of how those instructions can apply in OPNsense. Plus, with more and more people making the switch, it's easier than ever to get it set up in your home lab and have a custom firewall more powerful than anything your router can provide.