{"slug": "opnsense", "name": "OPNsense", "category": "networking", "category_name": "Networking and VPN", "description": "Open-source, FreeBSD-based firewall and router distribution with a web-based management interface.", "recommenders": 13, "commenters": 21, "warners": 2, "score": 10.497, "rising": -0.27, "first": "2025-11-24", "latest": "2026-10-15", "why": "Recommended as a reliable firewall and router to replace consumer routers, with a web UI that some find easy to configure and built-in extras like WireGuard, Suricata and plugins.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 13, "neutral": 6, "compare": 0, "warn": 2}, "spark": [0, 0, 0, 0, 2, 1, 0, 1, 6, 1, 1, 1], "listed": true, "loved": ["Reliability", "Firewall features"], "caveat": "Accessibility", "short_quote": "I switched to OPNsense as a direct replacement for our Asus \"WiFi routers\", and it has been phenomenal, reliable", "icon": true, "domain": "opnsense.org", "github_repo": null, "official_url": "https://opnsense.org/", "pricing": "open source", "aliases": ["OPNsense"], "verdict": [{"text": "Recommended as a reliable firewall and router to replace consumer routers,", "cites": [{"id": 780966304, "item_id": 48810394, "url": "https://news.ycombinator.com/item?id=48810394", "by": "inventor7777", "date": "2026-07-06", "stance": "recommend", "quote": "I switched to OPNsense as a direct replacement for our Asus \"WiFi routers\", and it has been phenomenal, reliable", "excerpt": "But what if you don't want to tinker? I switched to OPNsense as a direct replacement for our Asus \"WiFi routers\", and it has been phenomenal, reliable, and does everything needed - when you just want it to work, it really just does. But when you want more advanced functions, there are tons of plugins and stuff that you can run natively, while still having a true CLI. I suppose it comes down to what you said - \"if you", "context": "", "use_case": "router and firewall", "switched_from": "Asus router firmware", "story": "OpenWrt One \u2013 Open Hardware Router"}, {"id": 801627616, "item_id": 50101726, "url": "https://news.ycombinator.com/item?id=50101726", "by": "alias_neo", "date": "2026-10-15", "stance": "recommend", "quote": "I switched, about 7-8 years ago to a Protectli box running Coreboot and OPNSense and haven't looked back", "excerpt": "Step one is not to buy TP-Link routers. I know people have limited budgets, but having seen the code that sits on these devices and how poor quality and easily exploited it is, time and time again, I'll never buy TP-Link (amongst others) again. For a while I collected a graveyard of routers that had been abandoned by the manufacturers (and contained serious vulnerabilities), with the intention of writing them all up ", "context": "security-aware, has examined router firmware code", "use_case": "home router/firewall", "switched_from": "TP-Link", "story": "Wanted to download an ISO, ended up writing a kernel exploit"}, {"id": 780970016, "item_id": 48810626, "url": "https://news.ycombinator.com/item?id=48810626", "by": "dominick-cc", "date": "2026-07-06", "stance": "recommend", "quote": "It works very well and I enjoy it.", "excerpt": "I use opnsense with an aliexpress n100 router. It works very well and I enjoy it. But upgrades scare the crap out of me. I've only had 1 upgrade where things went bad. I have zfs snapshots and everything, but just because its a headless unit, I get super anxiety upgrading the system waiting for the beeps for it to come back online.", "context": "", "use_case": "home router/firewall", "switched_from": "", "story": "OpenWrt One \u2013 Open Hardware Router"}]}, {"text": " with a web UI that some find easy to configure", "cites": [{"id": 783656114, "item_id": 48978507, "url": "https://news.ycombinator.com/item?id=48978507", "by": "Saris", "date": "2026-07-20", "stance": "recommend", "quote": "I really liked using Opnsense before I switched to Openwrt and I always want to go back, because it was just so much more streamlined and easy to configure", "excerpt": "One thing that frustrates me about MikroTik and OpenWRT too, is a lot of things require multiple steps to set up, like adding a port forward with hairpin isn't just one click, adding a VLAN requires adding stuff in like 5+ different places. I really liked using Opnsense before I switched to Openwrt and I always want to go back, because it was just so much more streamlined and easy to configure from a 'geek but not a ", "context": "geek but not a network engineer", "use_case": "home router", "switched_from": "", "story": "HomeLab #1: MikroTik as a Home Router"}, {"id": 761194000, "item_id": 47574625, "url": "https://news.ycombinator.com/item?id=47574625", "by": "LatticeAnimal", "date": "2026-03-30", "stance": "recommend", "quote": "I\u2019ve been using OpnSense/pfsense [0] for years and would highly recommend it.", "excerpt": "I\u2019ve been using OpnSense/pfsense [0] for years and would highly recommend it. It has a great automatic update experience, config backups, builtin wireguard tunnels and advanced features like packet filtering options via suricata. When I am doing network management on my weekends, I\u2019m so glad I\u2019m not stuck in the Linux terminal learning about networking internals and can instead just go to a webui and configure my rou", "context": "does home network management on weekends", "use_case": "home router/firewall", "switched_from": "", "story": "How to Turn Anything into a Router"}]}, {"text": " and built-in extras like WireGuard, Suricata and plugins.", "cites": [{"id": 761194000, "item_id": 47574625, "url": "https://news.ycombinator.com/item?id=47574625", "by": "LatticeAnimal", "date": "2026-03-30", "stance": "recommend", "quote": "I\u2019ve been using OpnSense/pfsense [0] for years and would highly recommend it.", "excerpt": "I\u2019ve been using OpnSense/pfsense [0] for years and would highly recommend it. It has a great automatic update experience, config backups, builtin wireguard tunnels and advanced features like packet filtering options via suricata. When I am doing network management on my weekends, I\u2019m so glad I\u2019m not stuck in the Linux terminal learning about networking internals and can instead just go to a webui and configure my rou", "context": "does home network management on weekends", "use_case": "home router/firewall", "switched_from": "", "story": "How to Turn Anything into a Router"}, {"id": 780966304, "item_id": 48810394, "url": "https://news.ycombinator.com/item?id=48810394", "by": "inventor7777", "date": "2026-07-06", "stance": "recommend", "quote": "I switched to OPNsense as a direct replacement for our Asus \"WiFi routers\", and it has been phenomenal, reliable", "excerpt": "But what if you don't want to tinker? I switched to OPNsense as a direct replacement for our Asus \"WiFi routers\", and it has been phenomenal, reliable, and does everything needed - when you just want it to work, it really just does. But when you want more advanced functions, there are tons of plugins and stuff that you can run natively, while still having a true CLI. I suppose it comes down to what you said - \"if you", "context": "", "use_case": "router and firewall", "switched_from": "Asus router firmware", "story": "OpenWrt One \u2013 Open Hardware Router"}]}, {"text": " The most common complaints are about the web interface, from poor screen-reader accessibility to a preference for plain config files,", "cites": [{"id": 780974848, "item_id": 48810928, "url": "https://news.ycombinator.com/item?id=48810928", "by": "tapper", "date": "2026-07-06", "stance": "warn", "quote": "they made a big song and dance about fixing 11y on there web interface. In the end they did fuck all.", "excerpt": "Hi I tried with OPNSense, but I use a screen reader they made a big song and dance about fixing 11y on there web interface. In the end they did fuck all. OpenWRT has bin good with a screen reader since the start and the few times I have pointed out things to be fixed they have bin fixed with in days. So yeah go OpenWRT.", "context": "screen reader user", "use_case": "router firewall", "switched_from": "", "story": "OpenWrt One \u2013 Open Hardware Router"}, {"id": 777550417, "item_id": 48596901, "url": "https://news.ycombinator.com/item?id=48596901", "by": "pacija", "date": "2026-06-19", "stance": "warn", "quote": "I find editing a few config files much more convenient than clicking around in web interfaces.", "excerpt": "Long time ago I used these BSD-based appliances such as opnsense, beleiving I'll have it easier with their web interfaces than with editing config files in vi. In the long run, after investing some time into learning actual BSDs I find editing a few config files much more convenient than clicking around in web interfaces. OpenBSD is great for a router. https://www.openbsd.org/faq/pf/example1.html", "context": "", "use_case": "router", "switched_from": "", "story": "Ubiquiti: Enterprise NAS, Built on ZFS"}, {"id": 780949776, "item_id": 48809361, "url": "https://news.ycombinator.com/item?id=48809361", "by": "tracker1", "date": "2026-07-06", "stance": "recommend", "quote": "it's just been the best option for me", "excerpt": "I miss the Tomato UI/UX... I don't care for LUCU or OpnSense's UI by comparison... Been using OpnSense for about 8 years now though... it's just been the best option for me, I use separate commercial AP.", "context": "has used it about 8 years with a separate commercial AP", "use_case": "home and router firewall", "switched_from": "", "story": "OpenWrt One \u2013 Open Hardware Router"}]}, {"text": " and one user finds upgrades on a headless box nerve-wracking.", "cites": [{"id": 780970016, "item_id": 48810626, "url": "https://news.ycombinator.com/item?id=48810626", "by": "dominick-cc", "date": "2026-07-06", "stance": "recommend", "quote": "It works very well and I enjoy it.", "excerpt": "I use opnsense with an aliexpress n100 router. It works very well and I enjoy it. But upgrades scare the crap out of me. I've only had 1 upgrade where things went bad. I have zfs snapshots and everything, but just because its a headless unit, I get super anxiety upgrading the system waiting for the beeps for it to come back online.", "context": "", "use_case": "home router/firewall", "switched_from": "", "story": "OpenWrt One \u2013 Open Hardware Router"}]}], "praise": [{"label": "Reliability", "summary": "Long-time users describe it as reliable and working well for years.", "quotes": [{"id": 780966304, "item_id": 48810394, "url": "https://news.ycombinator.com/item?id=48810394", "by": "inventor7777", "date": "2026-07-06", "stance": "recommend", "quote": "I switched to OPNsense as a direct replacement for our Asus \"WiFi routers\", and it has been phenomenal, reliable", "excerpt": "But what if you don't want to tinker? I switched to OPNsense as a direct replacement for our Asus \"WiFi routers\", and it has been phenomenal, reliable, and does everything needed - when you just want it to work, it really just does. But when you want more advanced functions, there are tons of plugins and stuff that you can run natively, while still having a true CLI. I suppose it comes down to what you said - \"if you", "context": "", "use_case": "router and firewall", "switched_from": "Asus router firmware", "story": "OpenWrt One \u2013 Open Hardware Router"}, {"id": 801627616, "item_id": 50101726, "url": "https://news.ycombinator.com/item?id=50101726", "by": "alias_neo", "date": "2026-10-15", "stance": "recommend", "quote": "I switched, about 7-8 years ago to a Protectli box running Coreboot and OPNSense and haven't looked back", "excerpt": "Step one is not to buy TP-Link routers. I know people have limited budgets, but having seen the code that sits on these devices and how poor quality and easily exploited it is, time and time again, I'll never buy TP-Link (amongst others) again. For a while I collected a graveyard of routers that had been abandoned by the manufacturers (and contained serious vulnerabilities), with the intention of writing them all up ", "context": "security-aware, has examined router firmware code", "use_case": "home router/firewall", "switched_from": "TP-Link", "story": "Wanted to download an ISO, ended up writing a kernel exploit"}, {"id": 780949776, "item_id": 48809361, "url": "https://news.ycombinator.com/item?id=48809361", "by": "tracker1", "date": "2026-07-06", "stance": "recommend", "quote": "it's just been the best option for me", "excerpt": "I miss the Tomato UI/UX... I don't care for LUCU or OpnSense's UI by comparison... Been using OpnSense for about 8 years now though... it's just been the best option for me, I use separate commercial AP.", "context": "has used it about 8 years with a separate commercial AP", "use_case": "home and router firewall", "switched_from": "", "story": "OpenWrt One \u2013 Open Hardware Router"}]}, {"label": "Firewall features", "summary": "Firewall rules, blocklists, WireGuard, Suricata and plugins come built in or run natively.", "quotes": [{"id": 761194000, "item_id": 47574625, "url": "https://news.ycombinator.com/item?id=47574625", "by": "LatticeAnimal", "date": "2026-03-30", "stance": "recommend", "quote": "I\u2019ve been using OpnSense/pfsense [0] for years and would highly recommend it.", "excerpt": "I\u2019ve been using OpnSense/pfsense [0] for years and would highly recommend it. It has a great automatic update experience, config backups, builtin wireguard tunnels and advanced features like packet filtering options via suricata. When I am doing network management on my weekends, I\u2019m so glad I\u2019m not stuck in the Linux terminal learning about networking internals and can instead just go to a webui and configure my rou", "context": "does home network management on weekends", "use_case": "home router/firewall", "switched_from": "", "story": "How to Turn Anything into a Router"}, {"id": 778222465, "item_id": 48638904, "url": "https://news.ycombinator.com/item?id=48638904", "by": "h4kunamata", "date": "2026-06-22", "stance": "recommend", "quote": "I use OPNSense Firewall rules to enforce any DNS request to Pihole.", "excerpt": "I have a 2018 Samsung QLED SmartTV, I use Pihole to block data collection and since it has Google DNS hardcoded in it, I use OPNSense Firewall rules to enforce any DNS request to Pihole. My TV has only one AD that no longer shows for years now, LG is ADs all over the place. My home setup allows me to have a smartTV without compromises it. Since it runs TizenOS, I can use my Linux PC to install remove apps from it lik", "context": "", "use_case": "firewall DNS enforcement", "switched_from": "", "story": "Nearly Half of LG Smart TV Apps Contain Residential Proxy SDKs"}, {"id": 780966304, "item_id": 48810394, "url": "https://news.ycombinator.com/item?id=48810394", "by": "inventor7777", "date": "2026-07-06", "stance": "recommend", "quote": "I switched to OPNsense as a direct replacement for our Asus \"WiFi routers\", and it has been phenomenal, reliable", "excerpt": "But what if you don't want to tinker? I switched to OPNsense as a direct replacement for our Asus \"WiFi routers\", and it has been phenomenal, reliable, and does everything needed - when you just want it to work, it really just does. But when you want more advanced functions, there are tons of plugins and stuff that you can run natively, while still having a true CLI. I suppose it comes down to what you said - \"if you", "context": "", "use_case": "router and firewall", "switched_from": "Asus router firmware", "story": "OpenWrt One \u2013 Open Hardware Router"}]}, {"label": "Router replacement", "summary": "Users moved to it from TP-Link and Asus routers and are trying it as a Cisco ASA replacement.", "quotes": [{"id": 801627616, "item_id": 50101726, "url": "https://news.ycombinator.com/item?id=50101726", "by": "alias_neo", "date": "2026-10-15", "stance": "recommend", "quote": "I switched, about 7-8 years ago to a Protectli box running Coreboot and OPNSense and haven't looked back", "excerpt": "Step one is not to buy TP-Link routers. I know people have limited budgets, but having seen the code that sits on these devices and how poor quality and easily exploited it is, time and time again, I'll never buy TP-Link (amongst others) again. For a while I collected a graveyard of routers that had been abandoned by the manufacturers (and contained serious vulnerabilities), with the intention of writing them all up ", "context": "security-aware, has examined router firmware code", "use_case": "home router/firewall", "switched_from": "TP-Link", "story": "Wanted to download an ISO, ended up writing a kernel exploit"}, {"id": 780966304, "item_id": 48810394, "url": "https://news.ycombinator.com/item?id=48810394", "by": "inventor7777", "date": "2026-07-06", "stance": "recommend", "quote": "I switched to OPNsense as a direct replacement for our Asus \"WiFi routers\", and it has been phenomenal, reliable", "excerpt": "But what if you don't want to tinker? I switched to OPNsense as a direct replacement for our Asus \"WiFi routers\", and it has been phenomenal, reliable, and does everything needed - when you just want it to work, it really just does. But when you want more advanced functions, there are tons of plugins and stuff that you can run natively, while still having a true CLI. I suppose it comes down to what you said - \"if you", "context": "", "use_case": "router and firewall", "switched_from": "Asus router firmware", "story": "OpenWrt One \u2013 Open Hardware Router"}, {"id": 780973312, "item_id": 48810832, "url": "https://news.ycombinator.com/item?id=48810832", "by": "philamonster", "date": "2026-07-06", "stance": "recommend", "quote": "the messing around I've done so far has been positive. It's aged nicely.", "excerpt": "I used OPNSense briefly when I got 1gig synchronous fiber ~2015 at home on an old i5 desktop, which I think was shortly after the pfSense fork, and then found Mikrotik and RouterOS. Used RouterOS at home since and have been replacing aged out Cisco switches in the datacenter (100gig) and closets (20-40gig) cheaply. I'm looking to dump a handful of ASA's for OPNSense and the messing around I've done so far has been po", "context": "manages datacenter and home networks", "use_case": "firewall replacing ASAs", "switched_from": "Cisco ASA", "story": "OpenWrt One \u2013 Open Hardware Router"}]}, {"label": "Easy configuration", "summary": "Some find its web UI more streamlined than OpenWRT, MikroTik or the Linux terminal.", "quotes": [{"id": 783656114, "item_id": 48978507, "url": "https://news.ycombinator.com/item?id=48978507", "by": "Saris", "date": "2026-07-20", "stance": "recommend", "quote": "I really liked using Opnsense before I switched to Openwrt and I always want to go back, because it was just so much more streamlined and easy to configure", "excerpt": "One thing that frustrates me about MikroTik and OpenWRT too, is a lot of things require multiple steps to set up, like adding a port forward with hairpin isn't just one click, adding a VLAN requires adding stuff in like 5+ different places. I really liked using Opnsense before I switched to Openwrt and I always want to go back, because it was just so much more streamlined and easy to configure from a 'geek but not a ", "context": "geek but not a network engineer", "use_case": "home router", "switched_from": "", "story": "HomeLab #1: MikroTik as a Home Router"}, {"id": 761194000, "item_id": 47574625, "url": "https://news.ycombinator.com/item?id=47574625", "by": "LatticeAnimal", "date": "2026-03-30", "stance": "recommend", "quote": "I\u2019ve been using OpnSense/pfsense [0] for years and would highly recommend it.", "excerpt": "I\u2019ve been using OpnSense/pfsense [0] for years and would highly recommend it. It has a great automatic update experience, config backups, builtin wireguard tunnels and advanced features like packet filtering options via suricata. When I am doing network management on my weekends, I\u2019m so glad I\u2019m not stuck in the Linux terminal learning about networking internals and can instead just go to a webui and configure my rou", "context": "does home network management on weekends", "use_case": "home router/firewall", "switched_from": "", "story": "How to Turn Anything into a Router"}]}, {"label": "Free", "summary": "Listed among free software that users call excellent.", "quotes": [{"id": 787493191, "item_id": 49218324, "url": "https://news.ycombinator.com/item?id=49218324", "by": "ragequittah", "date": "2026-08-07", "stance": "recommend", "quote": "Most of the stuff I use is free and excellent.", "excerpt": "Most of the stuff I use is free and excellent. Linux, Firefox, libreoffice, xcp-ng, bottles, steam, playnite, opnsense, docker, dockhand, immich, freshrss, obsidian, tailscale, calibre, caddy, docker, pi-hole, signal, audiobookshelf I could probably keep going for a long while. I'm very glad most good software creators I've come across do not have your mindset.", "context": "", "use_case": "", "switched_from": "", "story": "Improving GPT-5.6 Sol in ChatGPT\u2014and expanding access for free users"}]}], "caveats": [{"label": "Accessibility", "summary": "A screen reader user says promised web interface accessibility fixes never arrived.", "quotes": [{"id": 780974848, "item_id": 48810928, "url": "https://news.ycombinator.com/item?id=48810928", "by": "tapper", "date": "2026-07-06", "stance": "warn", "quote": "they made a big song and dance about fixing 11y on there web interface. In the end they did fuck all.", "excerpt": "Hi I tried with OPNSense, but I use a screen reader they made a big song and dance about fixing 11y on there web interface. In the end they did fuck all. OpenWRT has bin good with a screen reader since the start and the few times I have pointed out things to be fixed they have bin fixed with in days. So yeah go OpenWRT.", "context": "screen reader user", "use_case": "router firewall", "switched_from": "", "story": "OpenWrt One \u2013 Open Hardware Router"}]}, {"label": "Web UI", "summary": "Some dislike the UI or prefer editing config files on plain BSD.", "quotes": [{"id": 777550417, "item_id": 48596901, "url": "https://news.ycombinator.com/item?id=48596901", "by": "pacija", "date": "2026-06-19", "stance": "warn", "quote": "I find editing a few config files much more convenient than clicking around in web interfaces.", "excerpt": "Long time ago I used these BSD-based appliances such as opnsense, beleiving I'll have it easier with their web interfaces than with editing config files in vi. In the long run, after investing some time into learning actual BSDs I find editing a few config files much more convenient than clicking around in web interfaces. OpenBSD is great for a router. https://www.openbsd.org/faq/pf/example1.html", "context": "", "use_case": "router", "switched_from": "", "story": "Ubiquiti: Enterprise NAS, Built on ZFS"}, {"id": 780949776, "item_id": 48809361, "url": "https://news.ycombinator.com/item?id=48809361", "by": "tracker1", "date": "2026-07-06", "stance": "recommend", "quote": "it's just been the best option for me", "excerpt": "I miss the Tomato UI/UX... I don't care for LUCU or OpnSense's UI by comparison... Been using OpnSense for about 8 years now though... it's just been the best option for me, I use separate commercial AP.", "context": "has used it about 8 years with a separate commercial AP", "use_case": "home and router firewall", "switched_from": "", "story": "OpenWrt One \u2013 Open Hardware Router"}]}, {"label": "Upgrade anxiety", "summary": "One user had a bad upgrade and worries during upgrades on a headless unit.", "quotes": [{"id": 780970016, "item_id": 48810626, "url": "https://news.ycombinator.com/item?id=48810626", "by": "dominick-cc", "date": "2026-07-06", "stance": "recommend", "quote": "It works very well and I enjoy it.", "excerpt": "I use opnsense with an aliexpress n100 router. It works very well and I enjoy it. But upgrades scare the crap out of me. I've only had 1 upgrade where things went bad. I have zfs snapshots and everything, but just because its a headless unit, I get super anxiety upgrading the system waiting for the beeps for it to come back online.", "context": "", "use_case": "home router/firewall", "switched_from": "", "story": "OpenWrt One \u2013 Open Hardware Router"}]}, {"label": "FreeBSD quirks", "summary": "One user is annoyed by FreeBSD's ppp and the Python framework.", "quotes": [{"id": 761640368, "item_id": 47602523, "url": "https://news.ycombinator.com/item?id=47602523", "by": "planetf1a", "date": "2026-04-01", "stance": "recommend", "quote": "I use opnsense, which of course has it's origins in pfsense. it's a great project", "excerpt": "Looking forward to it. Another child of the 80s home computer revolution (as was I, in the UK). UK here - BBC micro then the infamous Amiga - as you mentioned in the blog this was a real OS - device drivers & shared libraries being another important aspect Glad to say I've stuck with *nix most of my professional life, and more latterly open source. I use opnsense, which of course has it's origins in pfsense. it's a g", "context": "seasoned software engineer, *nix user", "use_case": "firewall/router", "switched_from": "", "story": "The Road to NfSensei"}]}, {"label": "DHCP migration", "summary": "ISC DHCP is being deprecated for Kea, though one user found the migration painless.", "quotes": [{"id": 738275905, "item_id": 46142244, "url": "https://news.ycombinator.com/item?id=46142244", "by": "BLKNSLVR", "date": "2025-12-03", "stance": "neutral", "quote": "OPNSense deprecated (is deprecating?) the included ISC DHCP server and now has the Kea DHCP server as standard.", "excerpt": "OPNSense deprecated (is deprecating?) the included ISC DHCP server and now has the Kea DHCP server as standard. I migrated to from ISC to Kea in OPNSense and it was relatively painless, and it's been working well since. No complaints here, but my setup is pretty vanilla. I can't comment on the DNS integration, but I might look a bit deeper because it sounds useful.", "context": "", "use_case": "firewall/router", "switched_from": "", "story": "Kea DHCP: Modern, open source DHCPv4 and DHCPv6 server"}]}], "who": [{"by": "alias_neo", "context": "security-aware, has examined router firmware code", "url": "https://news.ycombinator.com/item?id=50101726", "date": "2026-10-15"}, {"by": "Saris", "context": "geek but not a network engineer", "url": "https://news.ycombinator.com/item?id=48978507", "date": "2026-07-20"}, {"by": "philamonster", "context": "manages datacenter and home networks", "url": "https://news.ycombinator.com/item?id=48810832", "date": "2026-07-06"}, {"by": "tracker1", "context": "has used it about 8 years with a separate commercial AP", "url": "https://news.ycombinator.com/item?id=48809361", "date": "2026-07-06"}, {"by": "planetf1a", "context": "seasoned software engineer, *nix user", "url": "https://news.ycombinator.com/item?id=47602523", "date": "2026-04-01"}, {"by": "LatticeAnimal", "context": "does home network management on weekends", "url": "https://news.ycombinator.com/item?id=47574625", "date": "2026-03-30"}], "tags": ["for home networks", "for DIY router hardware", "for homelabs", "replaces consumer routers"], "use_cases": ["home router/firewall", "home router", "firewall", "router", "firewall/router", "possible future router"], "compared": [{"slug": "openwrt", "name": "OpenWrt", "co": 4, "switched_from": 0, "switched_to": 2}, {"slug": "pfsense", "name": "pfSense", "co": 5, "switched_from": 0, "switched_to": 0}, {"slug": "openbsd", "name": "OpenBSD", "co": 2, "switched_from": 0, "switched_to": 1}, {"slug": "routeros", "name": "RouterOS", "co": 1, "switched_from": 0, "switched_to": 1}, {"slug": "pi-hole", "name": "Pi-hole", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "docker", "name": "Docker", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "nixos", "name": "NixOS", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=48808482", "title": "OpenWrt One \u2013 Open Hardware Router", "mentions": 6}, {"url": "https://news.ycombinator.com/item?id=48970772", "title": "HomeLab #1: MikroTik as a Home Router", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50070625", "title": "Wanted to download an ISO, ended up writing a kernel exploit", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=50039291", "title": "Ask HN: Do you want a router that has DD-WRT pre-installed?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49776729", "title": "ChatGPT now knows what you do on other websites via ad collector", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49199357", "title": "Improving GPT-5.6 Sol in ChatGPT\u2014and expanding access for free users", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 1}, "2025-12": {"neutral": 1}, "2026-01": {}, "2026-02": {}, "2026-03": {"recommend": 2}, "2026-04": {"recommend": 1, "neutral": 1}, "2026-05": {"neutral": 1}, "2026-06": {"warn": 1, "recommend": 1}, "2026-07": {"recommend": 6, "warn": 1}, "2026-08": {"neutral": 1, "recommend": 1}, "2026-09": {"recommend": 1}, "2026-10": {"neutral": 1, "recommend": 1}}, "quotes": [{"id": 801627616, "item_id": 50101726, "url": "https://news.ycombinator.com/item?id=50101726", "by": "alias_neo", "date": "2026-10-15", "stance": "recommend", "quote": "I switched, about 7-8 years ago to a Protectli box running Coreboot and OPNSense and haven't looked back", "excerpt": "Step one is not to buy TP-Link routers. I know people have limited budgets, but having seen the code that sits on these devices and how poor quality and easily exploited it is, time and time again, I'll never buy TP-Link (amongst others) again. For a while I collected a graveyard of routers that had been abandoned by the manufacturers (and contained serious vulnerabilities), with the intention of writing them all up ", "context": "security-aware, has examined router firmware code", "use_case": "home router/firewall", "switched_from": "TP-Link", "story": "Wanted to download an ISO, ended up writing a kernel exploit"}, {"id": 800797250, "item_id": 50049828, "url": "https://news.ycombinator.com/item?id=50049828", "by": "ssl-3", "date": "2026-10-12", "stance": "neutral", "quote": "an old PC running OPNsense -- or even stick with OpenWRT", "excerpt": "I used to use DD-WRT, and Tomato, and Shibby's mod of Tomato, and Advanced Tomato, and other stuff. Somewhere, I'm sure I still have a WRT54GS that I hacked ~20 years ago to accept SD cards. It was a fun time in using inexpensive hardware in unintended ways. At one point, and I don't remember exactly when, I just started using OpenWRT instead. It wasn't always the case, but it presents a very usable GUI straight away", "context": "", "use_case": "possible future router", "switched_from": "", "story": "Ask HN: Do you want a router that has DD-WRT pre-installed?"}, {"id": 796471170, "item_id": 49779448, "url": "https://news.ycombinator.com/item?id=49779448", "by": "anygivnthursday", "date": "2026-09-20", "stance": "recommend", "quote": "bundled with opnsense for example if you also want a firewall", "excerpt": "For a home network network pihole or unbound also supports blocklists (bundled with opnsense for example if you also want a firewall). For Android, I use Rethink with Hagezi blocklists, so they block also when I am on mobile data (it is vpn based).", "context": "", "use_case": "firewall", "switched_from": "", "story": "ChatGPT now knows what you do on other websites via ad collector"}, {"id": 787493191, "item_id": 49218324, "url": "https://news.ycombinator.com/item?id=49218324", "by": "ragequittah", "date": "2026-08-07", "stance": "recommend", "quote": "Most of the stuff I use is free and excellent.", "excerpt": "Most of the stuff I use is free and excellent. Linux, Firefox, libreoffice, xcp-ng, bottles, steam, playnite, opnsense, docker, dockhand, immich, freshrss, obsidian, tailscale, calibre, caddy, docker, pi-hole, signal, audiobookshelf I could probably keep going for a long while. I'm very glad most good software creators I've come across do not have your mindset.", "context": "", "use_case": "", "switched_from": "", "story": "Improving GPT-5.6 Sol in ChatGPT\u2014and expanding access for free users"}, {"id": 787382946, "item_id": 49211434, "url": "https://news.ycombinator.com/item?id=49211434", "by": "SlavikCA", "date": "2026-08-07", "stance": "neutral", "quote": "OpnSense router -> Traefik -> Docker container.", "excerpt": "I have 5Gbps fiber at home. LAN is mostly 10Gbps. I'm hosting few hobbyist public websites. One is the library of hymns, songs, ... - mostly PDF, MP3, MIDI. OpnSense router -> Traefik -> Docker container. That Docker container runs on NAS, which is connected via 1Gbps port. Suddenly, last week I started to get over 1000 RPS. Was it scanner, parser, crawler, DDOS? I can't tell, as user agent was default Mac OS. It was", "context": "", "use_case": "router", "switched_from": "", "story": "The web server deployment model breaks at hobby scale"}, {"id": 783656114, "item_id": 48978507, "url": "https://news.ycombinator.com/item?id=48978507", "by": "Saris", "date": "2026-07-20", "stance": "recommend", "quote": "I really liked using Opnsense before I switched to Openwrt and I always want to go back, because it was just so much more streamlined and easy to configure", "excerpt": "One thing that frustrates me about MikroTik and OpenWRT too, is a lot of things require multiple steps to set up, like adding a port forward with hairpin isn't just one click, adding a VLAN requires adding stuff in like 5+ different places. I really liked using Opnsense before I switched to Openwrt and I always want to go back, because it was just so much more streamlined and easy to configure from a 'geek but not a ", "context": "geek but not a network engineer", "use_case": "home router", "switched_from": "", "story": "HomeLab #1: MikroTik as a Home Router"}, {"id": 783596544, "item_id": 48974784, "url": "https://news.ycombinator.com/item?id=48974784", "by": "self_awareness", "date": "2026-07-19", "stance": "recommend", "quote": "I highly recommend after installing a firewall appliance (for example OPNsense", "excerpt": "In Poland, Play sets up IPv6 by default. One call to ISP to disable the hidden firewall on their router gives us full IPv6 network transparency, no NATs are needed anymore. I highly recommend after installing a firewall appliance (for example OPNsense, but probably Mikrotik should have it as well). IPv6 \"feels\" like how networks should work since the beginning. IPv4 feels like a legacy technology. They of course also", "context": "", "use_case": "home firewall appliance", "switched_from": "", "story": "HomeLab #1: MikroTik as a Home Router"}, {"id": 781577904, "item_id": 48848619, "url": "https://news.ycombinator.com/item?id=48848619", "by": "tracker1", "date": "2026-07-09", "stance": "neutral", "quote": "I'm not doing much with OpnSense", "excerpt": "May just take a look at it... I'm not doing much with OpnSense, I'm running RPi on a separate system, that I'd like to integrate into DNS on the router itself, but that's about it. The only other feature I want to use but haven't configured is auto failover to a cellular modem. It's cheap, and enough for work, but not great for heavy use.", "context": "", "use_case": "home router", "switched_from": "", "story": "OpenWrt One \u2013 Open Hardware Router"}, {"id": 780974848, "item_id": 48810928, "url": "https://news.ycombinator.com/item?id=48810928", "by": "tapper", "date": "2026-07-06", "stance": "warn", "quote": "they made a big song and dance about fixing 11y on there web interface. In the end they did fuck all.", "excerpt": "Hi I tried with OPNSense, but I use a screen reader they made a big song and dance about fixing 11y on there web interface. In the end they did fuck all. OpenWRT has bin good with a screen reader since the start and the few times I have pointed out things to be fixed they have bin fixed with in days. So yeah go OpenWRT.", "context": "screen reader user", "use_case": "router firewall", "switched_from": "", "story": "OpenWrt One \u2013 Open Hardware Router"}, {"id": 780973312, "item_id": 48810832, "url": "https://news.ycombinator.com/item?id=48810832", "by": "philamonster", "date": "2026-07-06", "stance": "recommend", "quote": "the messing around I've done so far has been positive. It's aged nicely.", "excerpt": "I used OPNSense briefly when I got 1gig synchronous fiber ~2015 at home on an old i5 desktop, which I think was shortly after the pfSense fork, and then found Mikrotik and RouterOS. Used RouterOS at home since and have been replacing aged out Cisco switches in the datacenter (100gig) and closets (20-40gig) cheaply. I'm looking to dump a handful of ASA's for OPNSense and the messing around I've done so far has been po", "context": "manages datacenter and home networks", "use_case": "firewall replacing ASAs", "switched_from": "Cisco ASA", "story": "OpenWrt One \u2013 Open Hardware Router"}, {"id": 780970016, "item_id": 48810626, "url": "https://news.ycombinator.com/item?id=48810626", "by": "dominick-cc", "date": "2026-07-06", "stance": "recommend", "quote": "It works very well and I enjoy it.", "excerpt": "I use opnsense with an aliexpress n100 router. It works very well and I enjoy it. But upgrades scare the crap out of me. I've only had 1 upgrade where things went bad. I have zfs snapshots and everything, but just because its a headless unit, I get super anxiety upgrading the system waiting for the beeps for it to come back online.", "context": "", "use_case": "home router/firewall", "switched_from": "", "story": "OpenWrt One \u2013 Open Hardware Router"}, {"id": 780966304, "item_id": 48810394, "url": "https://news.ycombinator.com/item?id=48810394", "by": "inventor7777", "date": "2026-07-06", "stance": "recommend", "quote": "I switched to OPNsense as a direct replacement for our Asus \"WiFi routers\", and it has been phenomenal, reliable", "excerpt": "But what if you don't want to tinker? I switched to OPNsense as a direct replacement for our Asus \"WiFi routers\", and it has been phenomenal, reliable, and does everything needed - when you just want it to work, it really just does. But when you want more advanced functions, there are tons of plugins and stuff that you can run natively, while still having a true CLI. I suppose it comes down to what you said - \"if you", "context": "", "use_case": "router and firewall", "switched_from": "Asus router firmware", "story": "OpenWrt One \u2013 Open Hardware Router"}, {"id": 780949776, "item_id": 48809361, "url": "https://news.ycombinator.com/item?id=48809361", "by": "tracker1", "date": "2026-07-06", "stance": "recommend", "quote": "it's just been the best option for me", "excerpt": "I miss the Tomato UI/UX... I don't care for LUCU or OpnSense's UI by comparison... Been using OpnSense for about 8 years now though... it's just been the best option for me, I use separate commercial AP.", "context": "has used it about 8 years with a separate commercial AP", "use_case": "home and router firewall", "switched_from": "", "story": "OpenWrt One \u2013 Open Hardware Router"}, {"id": 778905557, "item_id": 48681597, "url": "https://news.ycombinator.com/item?id=48681597", "by": "h4kunamata", "date": "2026-06-25", "stance": "neutral", "quote": "NGINX firewall aliases feeding OPNSense firewall rules", "excerpt": ">By moving to NixOS, my entire infrastructure is defined in text files. This means my AI agents can read, understand, and even safely modify my infrastructure You lost me there!! Firstly, NixOS is hype, like everything being moved to Rust and failing miserably. Secondly, \"AI ... can .... safely modify my infrastructure\", OP is either being a troll or haven't seem how the whole IT world is upside down because of those", "context": "", "use_case": "firewall", "switched_from": "", "story": "Migrating from Proxmox to NixOS and Incus"}, {"id": 778222465, "item_id": 48638904, "url": "https://news.ycombinator.com/item?id=48638904", "by": "h4kunamata", "date": "2026-06-22", "stance": "recommend", "quote": "I use OPNSense Firewall rules to enforce any DNS request to Pihole.", "excerpt": "I have a 2018 Samsung QLED SmartTV, I use Pihole to block data collection and since it has Google DNS hardcoded in it, I use OPNSense Firewall rules to enforce any DNS request to Pihole. My TV has only one AD that no longer shows for years now, LG is ADs all over the place. My home setup allows me to have a smartTV without compromises it. Since it runs TizenOS, I can use my Linux PC to install remove apps from it lik", "context": "", "use_case": "firewall DNS enforcement", "switched_from": "", "story": "Nearly Half of LG Smart TV Apps Contain Residential Proxy SDKs"}, {"id": 777550417, "item_id": 48596901, "url": "https://news.ycombinator.com/item?id=48596901", "by": "pacija", "date": "2026-06-19", "stance": "warn", "quote": "I find editing a few config files much more convenient than clicking around in web interfaces.", "excerpt": "Long time ago I used these BSD-based appliances such as opnsense, beleiving I'll have it easier with their web interfaces than with editing config files in vi. In the long run, after investing some time into learning actual BSDs I find editing a few config files much more convenient than clicking around in web interfaces. OpenBSD is great for a router. https://www.openbsd.org/faq/pf/example1.html", "context": "", "use_case": "router", "switched_from": "", "story": "Ubiquiti: Enterprise NAS, Built on ZFS"}, {"id": 769606051, "item_id": 48100378, "url": "https://news.ycombinator.com/item?id=48100378", "by": "hexmiles", "date": "2026-05-11", "stance": "neutral", "quote": "I need to manage multiple FreeNAS, OPNsense, and Proxmox installations", "excerpt": "I'm working on two projects: - TTZ: A sort of next-gen protocol for terminals. The basic idea is to create a dedicated terminal protocol that allows for more features and less legacy cruft (text and commands are cleanly separated). Right now, I\u2019ve defined the protocol and have a couple of implementations ready. It already supports pictures, vector graphics, and file and audio streaming. I love terminals and TUIs, but", "context": "", "use_case": "routing at work", "switched_from": "", "story": "Ask HN: What Are You Working On? (May 2026)"}, {"id": 766470880, "item_id": 47904430, "url": "https://news.ycombinator.com/item?id=47904430", "by": "osamagirl69", "date": "2026-04-25", "stance": "neutral", "quote": "running opnsense", "excerpt": "If you are riding the Geerling train you would probably be interested in the upcoming mono router: https://www.jeffgeerling.com/blog/2026/testing-mono-gateway-custom-built-10-gbps-router/ Personally I use an x86 PC (supermicro E300 with X11SDV motherboard with integrated Intel X540 10Gbe NICs) running opnsense.", "context": "", "use_case": "home router/firewall", "switched_from": "", "story": "New 10 GbE USB adapters are cooler, smaller, cheaper"}, {"id": 761640368, "item_id": 47602523, "url": "https://news.ycombinator.com/item?id=47602523", "by": "planetf1a", "date": "2026-04-01", "stance": "recommend", "quote": "I use opnsense, which of course has it's origins in pfsense. it's a great project", "excerpt": "Looking forward to it. Another child of the 80s home computer revolution (as was I, in the UK). UK here - BBC micro then the infamous Amiga - as you mentioned in the blog this was a real OS - device drivers & shared libraries being another important aspect Glad to say I've stuck with *nix most of my professional life, and more latterly open source. I use opnsense, which of course has it's origins in pfsense. it's a g", "context": "seasoned software engineer, *nix user", "use_case": "firewall/router", "switched_from": "", "story": "The Road to NfSensei"}, {"id": 761194000, "item_id": 47574625, "url": "https://news.ycombinator.com/item?id=47574625", "by": "LatticeAnimal", "date": "2026-03-30", "stance": "recommend", "quote": "I\u2019ve been using OpnSense/pfsense [0] for years and would highly recommend it.", "excerpt": "I\u2019ve been using OpnSense/pfsense [0] for years and would highly recommend it. It has a great automatic update experience, config backups, builtin wireguard tunnels and advanced features like packet filtering options via suricata. When I am doing network management on my weekends, I\u2019m so glad I\u2019m not stuck in the Linux terminal learning about networking internals and can instead just go to a webui and configure my rou", "context": "does home network management on weekends", "use_case": "home router/firewall", "switched_from": "", "story": "How to Turn Anything into a Router"}, {"id": 760108402, "item_id": 47506775, "url": "https://news.ycombinator.com/item?id=47506775", "by": "tombert", "date": "2026-03-24", "stance": "recommend", "quote": "before that I ran ClearOS for a couple years, and before that I ran OpnSense for a couple years.  They all work fine", "excerpt": "Seems like now is as good a time as any for people who know how to do this to build their own routers with Pfsense, Opnsense, ClearOS, or one of the many other firewall/router distros out there. You can get an old desktop or laptop that's more than good enough to be a router for basically nothing (or sometimes literally nothing) on Craigslist or Ebay. I suspect pretty much anyone who frequents this forum could probab", "context": "", "use_case": "home router", "switched_from": "", "story": "FCC Updates Covered List to Include Foreign-Made Consumer Routers"}, {"id": 738275905, "item_id": 46142244, "url": "https://news.ycombinator.com/item?id=46142244", "by": "BLKNSLVR", "date": "2025-12-03", "stance": "neutral", "quote": "OPNSense deprecated (is deprecating?) the included ISC DHCP server and now has the Kea DHCP server as standard.", "excerpt": "OPNSense deprecated (is deprecating?) the included ISC DHCP server and now has the Kea DHCP server as standard. I migrated to from ISC to Kea in OPNSense and it was relatively painless, and it's been working well since. No complaints here, but my setup is pretty vanilla. I can't comment on the DNS integration, but I might look a bit deeper because it sounds useful.", "context": "", "use_case": "firewall/router", "switched_from": "", "story": "Kea DHCP: Modern, open source DHCPv4 and DHCPv6 server"}, {"id": 736635618, "item_id": 46039726, "url": "https://news.ycombinator.com/item?id=46039726", "by": "Fnoord", "date": "2025-11-24", "stance": "neutral", "quote": "For Tor, I use [1] (formats in json, txt, md) on OPNsense", "excerpt": "I don't have a filter list for compromised proxy servers and VPNs. Do you have a link? I'd be interested in logging such. For Tor, I use [1] (formats in json, txt, md) on OPNsense, but I've also been able to indeed simply parse ASNs (which I currently use for \"Twitter, Inc.\"). > Preemptively banning all bad-reputation cloud IP ranges except whitelisted hosts has zero impact on clients. =3 This. There's outbound and i", "context": "", "use_case": "firewall for Tor blocklist", "switched_from": "", "story": "The Cloudflare outage might be a good thing"}]}