Here I'm republishing an old blog post of mine originally from June 2017. The article has been slightly improved.
Part 1 of this article series was about why you want to build your own router, and how to assemble the APU2 that I chose as the hardware to build it from. Part 2 gave some Unix history and explained what a serial console is. Part 3 demonstrated serial access to the APU and showed how to update its firmware. Part 4 detailed installing pfSense, while the previous one did the same with OPNsense.
Building a BSD home router (pt. 1): Hardware (PC Engines APU2)
Building a BSD home router (pt. 2): The serial console (excursion)
Building a BSD home router (pt. 3): Serial access and flashing the firmware
Building a BSD home router (pt. 4): Installing pfSense
Building a BSD home router (pt. 5): Installing OPNsense
A little overview: In this post I will give you some background information, compare the appearance / usability of both products and then take a look at some special features before giving a conclusion.
This article is about comparing both products and helping you to make a decision. It is not terribly in-depth, because that task would require its own series of articles (and a lot more free time for me to dig much deeper into the topic). But still there's a lot you may want to know to get a first impression on which one you should probably choose. If you do some more research and write about it, please let me know and I will happily link to your work!
I want to point out one thing right at the beginning: Both products are good firewall solutions with a heck of a lot of extras. If you have the same goal as I have (building a home router), either will do absolutely fine. That does of course not mean that your choice doesn't matter at all. You can definitely benefit from thinking about it before making a decision. But even making the "wrong" decision doesn't mean that it will be horribly wrong. There are a couple of differences and maybe they are important to you. But chances are that both products would completely satisfy your needs.
Sometimes it's helpful to ask the old question: "Where do we come from?" While this question is usually a philosophical one, in our case it helps to shed some light on our topic. If you do a little reading on the net, you will soon find that pfSense and OPNsense do not like each other much. In fact it's probably save to state that they are more or less hostile towards each other. OPNsense is a fork of pfSense. Obviously not a friendly fork.
Some pfSense enthusiasts have been spreading information about OPNsense which suggests that new team has no idea what they are doing. They are said to frequently break important things and that the whole project is actually quite laughable. Or to put it short: You really should not waste your time with it and stick to the original. Having liked pfSense for years, I would have believed that, even though you should listen to the other side, too, before doing so. But listening to both sides takes time and effort - both of which were rather limited when I briefly looked into the whole clamor in mid 2015.
Eventually it was the plain hatred of one person who appeared to really have no life, that made me look at what the other project would say. This strange guy popped up in every single pfSense vs. OPNsense discussion and threw so much dirt at OPNsense that I could not help but pity that person. The fact that pfSense (despite obviously being completely dependent on Pf, a technology that came from OpenBSD) has a rather bad name with a lot of OpenBSD people for behaving poorly in the past, didn't help to regain my faith in it, either.
According to OPNsense, they were not happy with the code-quality of pfSense. They didn't like the fact that the whole Web GUI ran as root (ouch!) and wanted to do privilege separation (which is actively work in progress as I was told). Also there were licensing issues when Netgate acquired pfSense and a bunch of other things. Deciso, a company based in the Netherlands, had been a sponsor of pfSense for years but felt that the whole project was going in the wrong direction after Netgate took a couple of actions. So they decided to fund a fork instead.
Who is right? There's probably some truth to both versions. OPNsense has followed a rapid development style, bringing in lots of new features and even making some rather drastic changes. It's true that especially in the beginning there were some problems due to that. But it's also true that they were quick to react to those. One thing that is not true (or at least not the whole truth, if you will) is that pfSense is the original and OPNsense is a cheap rip-off! What's the whole truth then?
Once upon a time... in 2003 there was a new firewall OS called _m0n0wall_. Manuel Kasper had built it on a stripped down version of FreeBSD. There had been small firewalls before, but Kasper's innovation was to put a Web GUI on top of it so that the firewall's settings could be controlled from the browser! It did not take long and m0n0wall took the world by storm. However Kasper's project focused on embedded hardware. So only a while later a fork was created which geared towards more powerful hardware. The fork's name? You've guessed it: pfSense. In 2015 Manuel Kasper officially ended the m0n0wall project (because recent versions of FreeBSD had been grown too big to be easily usable for what he did with it in the past). And guess what he did: He gave his official blessing and recommends to migrate to and support OPNsense!
Info on Kasper's recommendation of OPNsense
Knowing some background is nice, but what do both products feel like? The first major difference between the two is what they look like. This is pfSense's main dashboard:
Compare it to OPNsense's version of the dashboard:
As you can see, OPNsense did a lot to provide the user a much more modern GUI. Both dashboards are customizable but it's hard to argue that OPNsense's is not superior. But to be fair: pfSense is working on a GUI overhaul as well.
Let's compare a couple of the menus. This is pfSense's "System" menu:
And here's the one from OPNsense:
While pfSense uses pull-down menus at the top, OPNsense has a navigation bar to the left. As you can see, both do not have that much in common. This is because OPNsense did not only redesign the GUI but also re-arranged which options go where. I find the new arrangement more logical (e.g. with pfSense _logout_ is in "System" but _halt_ is in "Diagnostics"). But that's definitely a matter of taste.
Here's what the "Services" menu from pfSense looks like:
pfSense: "Services" menu (PNG)
And here's the corresponding one from OPNsense:
OPNsense: "Services" menu (PNG)
This time there seems to be quite a bit more consensus about what counts as a service. But still OPNsense looks more like a cleaned up version.
Another example is the "Diagnostics" menu in pfSense:
pfSense: "Diagnostics" menu (PNG)
There's no direct equivalent with OPNsense. In the "Service" menu above you can see that there is a "Diagnostics" entry. The same goes for "System", "Interfaces", "Firewall", etc.
And now for the heart of the whole thing - here's pfSense's (default!) WAN firewall rule settings:
pfSense: WAN firewall rules (PNG)
Compare that to the same thing from OPNsense:
OPNsense: WAN firewall rules (PNG)
This is where it shows that both products do have a lot in common: What we can see here is basically the same thing. Again OPNsense simply has the more modern interface.
To end the visual comparison let's look at the LAN firewall rules from pfSense, too:
pfSense: LAN firewall rules (PNG)
And here's the LAN rules from OPNsense:
pfSense: OPNsense: LAN firewall rules (PNG)
No surprise here: It's all very similar just with interface improvements on OPNsense's side.
So far it's mostly a matter of taste. But now on to the technical points. This is where OPNsense shines (which is no wonder since it's developing a lot faster). For example OPNsense is already based on _FreeBSD 11.0_ whereas pfSense is _10.3_-based. However there's already beta versions for the upcoming pfSense 2.4 which are also based on 11.0 and feature many more improvements.
One major difference between the two is that pfSense heavily customized FreeBSD while OPNsense believes in the opposite and tries to be as close to mainline FreeBSD, just adding packages on the top of it. I like that latter approach better but again that's probably a matter of taste as well.
The most important thing for me is that OPNsense entered into a partnership with the _HardenedBSD project_. This resulted in OPNsense being able to change the crypto framework used! For me this is the one killer feature. Give me the option to rip out _OpenSSL_ and use _LibreSSL_ instead and I'm sold! However that's not even all, yet.
OPNsense: Selecting alternative firmware (PNG)
OPNsense got HardenedBSD's ASLR (Address Space Layout Randomization) implementation and the most recent addition is the introduction of packages compiled with SafeStack. This is what the most current update notice looks like (it didn't fit completely on the screen):
OPNsense: Example of an update notice (PNG)
If you ask me, hardening your router (especially if it should happen to be promoted to be your border router eventually) makes _a lot_ of sense (no pun intended).
There would be much more to write here, but if you're interested in that, you will probably have to read some of the recent change notes yourself.
OPNsense and pfSense are quite similar in their core functionality. When should you choose which one? Have a look at the pros and cons of each one and decide for yourself!
__pfSense:__
__OPNsense:__
The next article of this series will give an example of an advanced install of OPNsense that lets you use the APU for more than just a router!
Building a BSD home router (pt. 7): Advanced OPNsense installation
