COMPARE

NetDefense and DynFi® Manager

Two ways to run a fleet of firewalls from one place. DynFi Manager manages OPNsense, pfSense® and DynFi Firewall, on premise, as SaaS or as a managed service; NetDefense is a hosted console for OPNsense with an agent on each firewall.

We make NetDefense. Everything about DynFi Manager below comes from DynFi's own site and documentation, checked on 28 October 2026. If something has changed, tell us at hello@netdefense.io and we'll correct it.

DynFi and the DynFi logo are registered trademarks owned by DYNFI. pfSense® is a registered mark owned by Electric Sheep Fencing LLC. NetDefense is not affiliated with or endorsed by DynFi or Netgate.

Topic NetDefense DynFi Manager
Firewalls it manages OPNsense 26.1.11 or later (amd64). OPNsense, pfSense and DynFi's own DynFi Firewall. [1]
How you run it Hosted by NetDefense. Use the web console, or NDCLI and an MCP server that run on your machine. The NDAgent plugin runs on each firewall. On premise, as SaaS, or as a managed service. [1]
How it connects The agent connects out to NetDefense over TLS, so the firewall needs no inbound port. The agent checks a signature on every command. The Manager connects to each firewall over SSH and HTTP(S). The optional Connection Agent plugin opens the connection from the firewall instead, to a port the Manager listens on (2222 by default). [2]
Shared configuration Snippets (rules, aliases, users, DNS overrides and more) grouped in templates and attached to groups of firewalls. Variables fill in each firewall's own values. Alias collections synchronized across firewalls; rules and aliases editable per firewall from the Manager. [3] [4]
Updates Upgrades now, later or on a schedule. Firmware tracks move each release through fast, regular and stable groups after it has soaked. Live or delayed updates for one or more firewalls. OS upgrade requests need the ALL device group. Reboots run now or at a time you schedule. [1] [5] [6]
Backups Encrypted on the firewall with a key you set, which NetDefense holds, and sent through NetDefense to your own S3-compatible bucket, on a schedule or right away. Stores every configuration since a firewall first connected (the retention is adjustable), compares any two, and restores one on the same or another firewall. [7]
Remote access A shell in the browser, and the firewall's own WebAdmin, through the agent's outbound tunnel. Direct View: access to each firewall's administration interface from the Manager. [1]
Multi-tenancy One organization per client, each with its own firewalls, settings and members, who are Read-Only, Read-Write or Superuser. Access differentiated by group of firewalls, and dedicated access for your customers to their firewalls. [1]
Monitoring A dashboard of action items, device, sync and task status, and OPNsense and agent versions, plus live telemetry on each device's page. A visual status of every firewall, RRD graphs, link status and statistics, and automatic alerts. [1]
Price A free plan for up to 10 devices in non-production use. Team at $6 and Business at $12 per device a month. Free on premise for up to three firewalls. Beyond that, paid licences priced by quantity and term on DynFi's shop. [8]

DynFi Manager may fit better if

  • your fleet mixes OPNsense and pfSense, and you want one tool for both;
  • you need to run the manager on premise, or want DynFi to run it as a managed service;
  • you want to manage up to three production firewalls at no cost, on premise (our free plan is for non-production use only);
  • you want to compare and restore a firewall's configuration from the manager;
  • you want to brand the interface and give your customers their own access.

NetDefense may fit better if

  • your fleet is all OPNsense, and you want a console built for OPNsense alone;
  • you want variables to fill in each firewall's own values in shared rules, staged firmware updates, and backups in your own bucket;
  • you script your fleet, or drive it from an AI assistant;
  • you'd like to start free on non-production firewalls, then pay per device.

Sources

  1. DynFi Manager, product page, DynFi, checked on 28 October 2026.
  2. DFM Connection Agent, DynFi Manager documentation, DynFi, checked on 28 October 2026.
  3. Managing aliases with DFM (chapter 16), DynFi Manager documentation, DynFi, checked on 28 October 2026.
  4. Firewall rules (chapter 15), DynFi Manager documentation, DynFi, checked on 28 October 2026.
  5. Device groups: Default group (chapter 22.1), DynFi Manager documentation, DynFi, checked on 28 October 2026.
  6. Rebooting devices (chapter 18), DynFi Manager documentation, DynFi, checked on 28 October 2026.
  7. Firewall configuration (chapter 17), DynFi Manager documentation, DynFi, checked on 28 October 2026.
  8. Managing DFM Licenses (chapter 11), DynFi Manager documentation, DynFi, checked on 28 October 2026.

For NetDefense, see Features, Security and Pricing.

Ready to take control?

Start on the Free plan with your lab firewalls, or talk to us about your production fleet.

Start free Talk to us

Prefer the terminal? Install the CLI Star us on GitHub

NetDefense is an independent project and is not affiliated with, endorsed by, or connected to OPNsense or Deciso B.V. OPNsense is a registered trademark of Deciso B.V.