Tools
A curated directory of 8 tools we use, evaluate, and recommend across the AI security landscape — with our take on each.
Our Tools
OPNsense Rule & Alias Recipe Generator
Pick a goal (isolate IoT VLAN, guest internet-only, force DNS to Pi-hole, WireGuard road-warrior, GeoIP block, safe port-forward), fill a few names and subnets, and get an ordered copy-pasteable rule plan in OPNsense UI terms with the reason for every line and an inline lint.
Our take
We built this because the recipes are well-known but the rule ORDER and the NAT-needs-a-pass-rule gotcha are what people actually get wrong. It generates a plan to apply by hand and lints the classic any/any and ordering mistakes — it never touches your box.
Core OPNsense
OPNsense
FreeBSD-based firewall and routing platform. Six-month release cadence (semantic-versioned, e.g. 24.7, 25.1). Active plugin ecosystem.
Our take
Our default firewall OS. The release cadence, modern UI, and plugin diversity put it ahead of pfSense CE for most new builds. Stable on Protectli FW4C/FW6 and on any AES-NI x86 box.
Plugins & Add-ons
Suricata (IDS/IPS)
High-performance multi-threaded IDS/IPS engine. OPNsense ships first-party Suricata integration with rule management (ET Open free, ET Pro commercial).
Our take
Default IDS choice on OPNsense. Run in IDS-only mode for the first month while you tune false positives; promote to IPS only after you trust the ruleset.
ZenArmor
Layer-7 application control, content filtering, and traffic analytics. Free Home edition covers most homelab use; paid tiers add cloud reporting and TLS inspection.
Our take
The biggest functional differentiator between OPNsense and pfSense in 2026. Free tier is generous; SOHO is worth the price for parental-controls scenarios.
HAProxy
Reverse proxy and load balancer. The OPNsense plugin wraps the upstream HAProxy with a web UI for backends, ACLs, and ACME-issued certs.
Our take
Best fit when your firewall doubles as your reverse proxy and you don't have a separate Docker host running Traefik. The ACME integration is genuinely easy.
WireGuard
Modern VPN protocol now a first-class citizen in OPNsense (no plugin install needed since 23.x).
Our take
Default site-to-site and remote-access VPN choice. Faster handshakes, less code, simpler config than OpenVPN. Use OpenVPN only when you need legacy client compatibility.
CrowdSec
Behavioral analysis + community-curated blocklists. Plugin reads logs, identifies attack patterns, blocks at the firewall layer.
Our take
Modern complement to Suricata. Suricata catches packet-level signatures; CrowdSec catches behavior across longer windows. Run both.
Hardware
Protectli FW4C
Fanless mini-PC, Intel i225 NICs, AES-NI, coreboot option. Pre-validated for OPNsense.
Our take
Our default home/SMB OPNsense hardware. Gigabit symmetric with Suricata IDS comfortably; step up if you need 2.5G/10G.