News & Blog
Feature announcements, product updates, and engineering notes from the NetDefense team.
RULE and ALIAS Snippets Now Set Every OPNsense Field, and Place Rules Where You Said
A RULE or ALIAS snippet can now set any field of OPNsense's rule or alias, and PREPEND rules come first in their section. Here is what changes at save, at sync and on your firewalls, and a checklist for snippet files kept in git.
Certificate Sync for OPNsense: Renew Once, Every Firewall Follows
NetDefense now syncs CAs and certificates, private keys included, into the trust store of every OPNsense firewall, and renews them in place: services stay bound, and the ones using a renewed certificate reload on their own.
Superuser Clearance for Snippets That Grant Firewall Admin Rights
A Read-Write member, or anyone holding a leaked token, could once give a firewall account administrator rights through a snippet. Now only a Superuser signed in interactively can save that content, the control plane won't build it otherwise, and NDAgent 1.20.1 checks the accounts and groups only the device can see.
Introducing Centralized LDAP and Active Directory Authentication for Your OPNsense Fleet
Define an LDAP or Active Directory login once and roll it out to every OPNsense firewall through templates. Local Database always stays first, so a directory outage never locks out your local admins.
remote_access_policy: A Remote-Access Ceiling the Cloud Can't Raise
NDAgent v1.15.0 adds remote_access_policy, a device-local ceiling on remote sessions — full, readonly, or disabled — that no operator account, platform compromise, or AI agent can raise remotely, because the value lives only in the device's own configuration.
Secure by Default: Config Pushes That Grant Privileges Are Now Rejected Out of the Box
NDAgent v1.14.0 flips reject_dangerous_snippets on by default for new installations — a device now refuses privilege-granting configuration pushes unless its operator explicitly opts out, locally.
How to Manage Multiple OPNsense Firewalls: Your Options in 2026
A practical, vendor-neutral look at the real options for managing a fleet of OPNsense firewalls in 2026 — from manual per-box administration to OPNcentral, DynFi Manager, infrastructure-as-code, and hosted platforms.
Read-Only Remote Access to Your Firewall's WebAdmin
Grant auditors, NOC staff, or MSSP customers complete read-only visibility into your managed firewall — see everything, change nothing.
Upgrade OPNsense Firmware Without a Maintenance Window
NetDefense can now upgrade OPNsense firmware across your fleet — minor point releases with zero downtime via split-apply, and major series jumps on a planned window. Schedulable, previewable, and available from NDCLI, the web console, and the MCP server.
Set It and Forget It: NetDefense Now Has a Recurring-Task Scheduler
Schedules are reusable named cadences you attach to the commands you already use — run, sync, and backup — so nightly backups, weekly reboots, and periodic config delivery happen on their own.
How NetDefense Secures the Control Channel to Your Firewalls
A detailed look at how NetDefense makes forging a command to a managed firewall infeasible: asymmetric device identity, a bidirectionally signed task channel, and an operator-gated rebind ceremony — built so that everything but the two private signing keys can only verify, never forge.
Introducing Personal Access Tokens for CI/CD Automation
NDCLI now supports static API tokens for headless authentication in CI/CD pipelines, GitHub Actions, and automated scripts.