COMPARE
NetDefense and OPNcentral
Two ways to run a fleet of OPNsense firewalls from one place. OPNcentral is Deciso's own plugin for OPNsense Business Edition; NetDefense is a hosted console with an agent on each firewall.
We make NetDefense. Everything about OPNcentral below comes from Deciso's documentation, checked on 28 October 2026. If something has changed, tell us at hello@netdefense.io and we'll correct it.
| Topic | NetDefense | OPNcentral |
|---|---|---|
| What it is | A fleet console, hosted by NetDefense. Use the web console, or NDCLI and an MCP server that run on your machine. The NDAgent plugin runs on each firewall. | A plugin for OPNsense Business Edition. One OPNsense firewall acts as the central host for the others. [1] |
| What you need | OPNsense 26.1.11 or later (amd64) on each firewall, and a NetDefense account. | An OPNsense Business Edition licence and the commercial software repository, to install os-OPNcentral. [1] |
| How it connects | The agent connects out to NetDefense over TLS, so the firewall needs no inbound port. The agent checks a signature on every command. | The central host connects to each managed firewall's API, with a key and secret created on that firewall. [1] |
| Shared configuration | Snippets (rules, aliases, users, DNS overrides and more) grouped in templates and attached to groups of firewalls. Variables fill in each firewall's own values. | Provisioning classes, the same options as High Availability sync, for example users and groups, aliases, firewall rules, NAT, categories and the web GUI. The central host acts as the template. [1] |
| Firmware | Upgrades now, later or on a schedule. Firmware tracks move each release through fast, regular and stable groups after it has soaked. | A firmware status page lists available updates and upgrades the connected firewalls, rebooting only if you enable it. [1] |
| Backups | Encrypted on the firewall with a key you set, which NetDefense holds, and sent through NetDefense to your own S3-compatible bucket, on a schedule or right away. | With Enable backups checked, a nightly backup of every host to the central host, with retention settings. You can run one from the GUI, or more often with a cron job. [1] |
| Remote access | A shell in the browser, and the firewall's own WebAdmin, through the agent's outbound tunnel. | Links that open a managed firewall's web GUI. A link works only when that firewall also runs Business Edition, and logs in automatically when the central host is allowed to reach OPNcentral's components on it. [1] |
| Multi-tenancy | One organization per client, each with its own firewalls, settings and members, who are Read-Only, Read-Write or Superuser. | Host groups that limit which users can reach which hosts. [1] |
| Monitoring | A dashboard of action items, device, sync and task status, and OPNsense and agent versions, plus live telemetry on each device's page. | Service status with restarts, and resource status: CPU, memory, swap, interfaces, HA status, gateways, state table and traffic. [1] |
| Scheduled jobs | Named schedules, each a cron expression and a timezone, that run syncs, backups, commands from the Run page and the windows of firmware tracks. | Cron jobs on the central host, for example to provision every firewall daily or back up more often. [1] |
| Price | A free plan for up to 10 devices in non-production use. Team at $6 and Business at $12 per device a month. | Part of OPNsense Business Edition. [1] |
OPNcentral may fit better if
- your firewalls already run OPNsense Business Edition, or you plan to move them to it;
- you want the central host on your own network, as an OPNsense firewall you run;
- you want to share settings the way OPNsense's High Availability sync does, from one firewall to the others.
NetDefense may fit better if
- your firewalls sit behind NAT or CGNAT, or at sites where you can't open a path to them, as long as each firewall can make an outbound HTTPS connection;
- you want variables to fill in each firewall's own values in shared rules, staged firmware updates, and backups in your own bucket;
- you script your fleet, or drive it from an AI assistant;
- you'd like to start free on non-production firewalls, then pay per device.
Sources
- Central Management (OPNcentral), OPNsense documentation, Deciso, checked on 28 October 2026.