History of OPNsense

#

Origins and motivation

#

The roots of OPNsense trace back to the m0n0wall project - a lightweight FreeBSD-based distribution designed for embedded systems and network gateways. It emerged back in the early 2000s and for years became the standard for anyone who needed a firewall running on decommissioned hardware without licensing headaches. Later, pfSense emerged from m0n0wall, which took over most of the audience and became, for a long time, the most popular platform for FreeBSD-based firewalls and routers. It was pfSense that many homelab enthusiasts encountered as “the only option” for a router OS as far back as ten years ago.

By the mid-2010s, part of the community and the developers behind pfSense began to diverge in their views on what the project’s future should look like. It wasn’t about one particular complaint, but a whole set of issues at once:

• a more open development model, rather than decisions made behind closed doors by a single company;
• a transparent licensing scheme without the risk that some functionality would suddenly move behind a paywall;
• modern, secure code - at the time, pfSense’s codebase seemed outdated to many;
• a clear and predictable release structure.

In 2014, the Dutch company Deciso B.V. announced the creation of a new project - OPNsense, a fork of pfSense on FreeBSD, licensed under the BSD 2-Clause License, which allows free use, modification, and sale of the code, including commercial use, as long as attribution is retained (which is what OnlyOffice should have chosen from the start).

Project launch

#

• Founding date: January 2, 2015
• First release: OPNsense 15.1 Ascending Albatross (January 5, 2015)
• Main project goals:
  • Security and code quality
  • Regular updates
  • An active community
  • A modern and clear web interface

Stages of development

#

The project grew quickly, establishing a clear release cycle:

• two major releases per year - in January and July;
• security updates every two weeks.

Key development milestones include moving to new FreeBSD versions, adopting HardenedBSD, an interface and API overhaul, and security improvements.

OPNsense release timeline

#

Legal and organizational aspects

#

• In 2017, Netgate (the creators of pfSense) lost a dispute over the opnsense.com domain.
  • WIPO (case D2017-1828) ruled that the domain should be transferred to Deciso.
  • This cemented the legal independence of the OPNsense brand.

The fact is, the legal dispute mentioned above was preceded by a rather unflattering episode. Netgate had managed to register the opnsense.com domain even before the project officially launched, and used it not as a neutral placeholder, but to publish critical material about the new fork - which many in the community saw not so much as an attempt to protect their own reputation, but as an attempt to slow down a competitor right out of the gate. The community did not look kindly on this behavior, and WIPO ultimately sided with OPNsense.

Project characteristics

#

Over more than ten years, OPNsense has developed a set of traits that set it apart not only from pfSense, but from most open-source router distributions in general.

Security is baked into the process here: security updates come out every two weeks rather than “whenever we absolutely have to,” and the system’s kernel has for years run on HardenedBSD - a fork of FreeBSD with additional memory protection mechanisms and address-space randomization. Modularity is implemented through a plugin system and an open API - you can bolt on functionality (WireGuard, IDS/IPS, proxy, 2FA) without having to patch the system by hand. Openness shows not only in the license, but in the fact that the project’s roadmap is public, and community proposals actually make it into releases rather than sitting in some backlog. And finally, the BSD-2-Clause license - Deciso does have a paid Business Edition, but it’s not a “crippled free version” with locked-away features, as is often the case with competitors: the difference is only a more conservative update pace and access to some commercial plugins (for example, Zenarmor, though it’s also available in the free version) and support. The entire core firewall functionality is equally available in the community version.

Current state (2026)

#

• Based on FreeBSD 15.1
• Actively maintained by Deciso B.V.
• A community of thousands of participants worldwide
• Has a large number of ready-made plugins and integrations (WireGuard, Zenarmor, CrowdSec, and others)

Significance for the community

#

Over more than ten years, OPNsense has stopped being just “a pfSense fork for people annoyed at Netgate” and has become an independent project with its own audience, its own release cadence, and its own development philosophy. What started as an alternative is, for many, today a conscious first choice rather than a fallback option. What’s more, a bit over two years ago, a mass exodus from PfSense began after they changed their software distribution terms.

Personally, what I find most interesting in this story isn’t the domain dispute itself (the behavior of Netgate’s head has long been a byword), but the fact that over the years the project has genuinely kept its pace: a release every six months, security patches every two weeks, and no drift toward “let’s simplify things and put the complex stuff behind a paywall.” That’s exactly why, in my own Proxmox homelab, I ultimately settled on OPNsense as my main gateway - not because pfSense is bad in some way, but because I can see where each of these projects is heading, and I like the direction OPNsense is going.

Useful links

#

• Official website
• Documentation
• Plugin list
• Deciso B.V.
• Historical article on PRWeb - 10 years of OPNsense