Building firewall platforms since 2004
NetDefense is an independent, self-funded company. We build NetDefense for OPNsense, the fleet console for MSPs and multi-site IT teams running fleets of OPNsense firewalls.
- Building since 2004
- Independent and self-funded
- Open-source agent and CLI
- Every command signed
- 2004 NetDefense v1 ships
- 2011 v1 retired
- 2023 Work starts on OPNsense
- 2026 NetDefense for OPNsense
Why we built it
In the early 2000s, small businesses needed real network security, and nothing on the market was both capable and affordable. Firewalls were too expensive, too complex, or built for networks that looked nothing like theirs.
So in 2004 we built one. NetDefense v1 was an x86 security appliance running FreeBSD on open-source software: web control, antivirus inspection, email filtering, VPN, WAN failover, bandwidth control, monitoring and reporting, all behind one web interface. Through 2010 it supported dozens of customer networks in production.
By 2011 commercial security products had become easier to resell and support, and a custom platform stopped making sense. We retired v1, but the work never stopped: we kept building and operating infrastructure and handling real security incidents. In the mid-2010s we found OPNsense. Its philosophy matched what we believed a firewall should be, and we deployed it across the networks we managed.
In 2023, with affordable hardware and open-source tools at enterprise grade, we started building again, this time as an OPNsense plugin. NetDefense for OPNsense shipped in 2026. It isn’t a reboot. It continues the same idea on stronger foundations, designed from day one for MSP operations.
What we hold ourselves to
Limits we set on ourselves, each one something you can check.
You can read the code on your firewall
NDAgent, which runs on your firewall, and NDCLI, the CLI and MCP server on your workstation, are open source and mirrored to GitHub on every release tag. The control plane behind them is closed source, and we say so.
Your firewall checks every command we send
Each command is signed, and the device rejects anything unsigned, altered, replayed or late. The agent accepts a fixed set of named operations. Our security page also spells out what signing does not protect against.
Leaving us leaves your firewall intact
NDAgent only touches the firewall objects it created, with one exception: it may renumber your own rules so the rules it places run ahead of them, and changes nothing else about them. Uninstall it and your own configuration stays in place, your rules in the same order. If our platform is unreachable, your firewall keeps enforcing its policy as configured.
Free is the product, not a trial
Configuration sync, policy templating, backups, remote admin, scheduled tasks, automation tokens and MCP all ship on the Free plan, capped by device count and limited to non-production use.
The people
No managers. No advisory boards. Just engineers who build.
Marcos Machado
Infrastructure & Network Security
Years of hands-on work with networks, security architecture and infrastructure platforms. Builds systems to stay resilient and predictable under real-world constraints.
Leonardo Kamache
Operations & Delivery
The operational side: delivery and implementation, so security infrastructure can be deployed and maintained consistently.
Alfredo Saldanha
Systems Telemetry & Automation
Telemetry, monitoring and automation: the observability and operational insight that let secure infrastructure scale.
Independent and self-funded
No investors to answer to.
Only customers.
Report a vulnerability
Write to security@netdefense.io, encrypted with our PGP key if you prefer, or open a private advisory on the NDAgent or NDCLI repository.
Check our claims
Our security page covers what signing protects, what it doesn’t, and what a compromised platform could still do to your firewall.
Talk to us in public
Questions, bug reports and release announcements live in our Community discussions on GitHub.
Shipping in public
New features get a write-up here, and releases are announced in our Community announcements.
-
How to Push One Rule to Every OPNsense Firewall, With Each Site's Own Addresses
Write a firewall rule once, let a variable fill in each site's address, preview which firewalls a sync will reach, and read exactly what changed on each one.
-
When OPNsense Fixes a Release in Place: Hotfix Revisions in Firmware Tracks
OPNsense sometimes rewrites a release without changing its version number. Firmware tracks now record each rewrite as a revision, roll it out through fast, regular and stable, and make the device check it before installing.
-
Firmware Tracks: Stage OPNsense Updates from Fast to Stable
Hold each OPNsense firewall at an exact release and let a release prove itself in fast, regular and stable tracks before it reaches the rest. Promote or halt it by hand, and read the limits before you switch on series upgrades.
-
RULE and ALIAS Snippets Now Set Every OPNsense Field, and Place Rules Where You Said
A RULE or ALIAS snippet can now set any field of OPNsense's rule or alias, and PREPEND rules come first in their section. Here is what changes at save, at sync and on your firewalls, and a checklist for snippet files kept in git.
-
Certificate Sync for OPNsense: Renew Once, Every Firewall Follows
NetDefense now syncs CAs and certificates, private keys included, into the trust store of every OPNsense firewall, and renews them in place: services stay bound, and the ones using a renewed certificate reload on their own.
-
Superuser Clearance for Snippets That Grant Firewall Admin Rights
A Read-Write member, or anyone holding a leaked token, could once give a firewall account administrator rights through a snippet. Now only a Superuser signed in interactively can save that content, the control plane won't build it otherwise, and NDAgent 1.20.1 checks the accounts and groups only the device can see.
-
Introducing Centralized LDAP and Active Directory Authentication for Your OPNsense Fleet
Define an LDAP or Active Directory login once and roll it out to every OPNsense firewall through templates. Local Database always stays first, so a directory outage never locks out your local admins.
-
remote_access_policy: A Remote-Access Ceiling the Cloud Can't Raise
NDAgent v1.15.0 adds remote_access_policy, a device-local ceiling on remote sessions — full, readonly, or disabled — that no operator account, platform compromise, or AI agent can raise remotely, because the value lives only in the device's own configuration.
When we’re not a fit
-
Your firewalls aren’t OPNsense. NDAgent is an OPNsense plugin, and it needs OPNsense 26.1.11 or later on amd64.
-
You need every component open source. The agent and the CLI are. The control plane is not.
-
You want Free for production. Free covers homelabs, labs, proofs of concept and evaluation. Production fleets under a commercial arrangement need a paid plan.
Talk to the team
Write to the people who build NetDefense, or start on the Free plan today.
hello@netdefense.io
NetDefense is an independent project and is not affiliated with, endorsed by, or connected to OPNsense or Deciso B.V. OPNsense is a registered trademark of Deciso B.V.