# NetDefense

> NetDefense for OPNsense is a CLI-first management platform for fleets of decentralized OPNsense firewalls. A lightweight agent (NDAgent) runs on each firewall and connects outbound only; a command-line tool and MCP server (NDCLI) and a browser dashboard (NDWeb) let a team or MSP manage, template, sync, back up, and remotely access hundreds of devices from one place.

NetDefense's edge components — the on-firewall agent and the CLI/MCP client — are open source (Apache-2.0) and independently auditable. The platform is built for security teams and MSPs who need centralized control over a fleet of firewalls without giving up verifiability: every command sent to a device is cryptographically signed, devices only ever dial out, and the fixed set of operations an agent will accept is small and publicly documented.

## Docs

- [Documentation home](https://netdefense.io/docs/): Overview of all documentation sections.
- [Getting Started](https://netdefense.io/docs/getting-started/): Core concepts — accounts and organizations, devices, organizational units, snippets, templates, policy chain, sync and delivery, run command, backups, VPN networks, variables, remote access, automation/CI-CD, schedules.
- [Device Identity](https://netdefense.io/docs/getting-started/device-identity/): How each device gets a unique cryptographic identity, how commands are signed and verified, and the operator-gated re-bind (re-key) ceremony.
- [Remote Access](https://netdefense.io/docs/getting-started/remote-access/): How outbound-only relay tunnels give browser-based access to a device's web admin or terminal without opening inbound ports.
- [MCP Server](https://netdefense.io/docs/mcp/): Drive a NetDefense-managed fleet from Claude Code, Claude Desktop, or any MCP-compatible AI agent, with full parity to the CLI.
- [NDCLI Getting Started](https://netdefense.io/docs/ndcli/getting-started/): Installing and authenticating the command-line interface.
- [NDAgent Installation](https://netdefense.io/docs/ndagent/installation/): Installing the OPNsense plugin that turns a firewall into a managed device.
- [NDWeb Overview](https://netdefense.io/docs/ndweb/): Using the browser dashboard.

## Product

- [Features](https://netdefense.io/features/): Policy and config templating, zero-inbound remote access, one-click WireGuard overlay mesh, workflow automation, S3-compatible backups, MCP integration for AI agents.
- [Pricing](https://netdefense.io/pricing/): Free (personal use), Team, Business, and Enterprise plans — per-device billing, full feature set at every tier, limits scale by tier.
- [Security](https://netdefense.io/security/): The security model in depth — fixed operation set, cryptographically signed commands, outbound-only agent, replay protection, device-enforced guardrails, tenant isolation, and what happens if the platform itself is compromised.

## Blog

- [Upgrade OPNsense Firmware Without a Maintenance Window](https://netdefense.io/blog/opnsense-firmware-upgrades/): Fleet-wide OPNsense firmware upgrades with a reboot-free mode for point releases.
- [Introducing Personal Access Tokens for CI/CD Automation](https://netdefense.io/blog/personal-access-tokens/): Static API tokens for headless authentication in CI/CD pipelines and scripts.
- [Read-Only Remote Access to Your Firewall's WebAdmin](https://netdefense.io/blog/read-only-remote-webadmin/): Grant auditors or support staff full visibility into a device's web admin with no write access.
- [Set It and Forget It: NetDefense Now Has a Recurring-Task Scheduler](https://netdefense.io/blog/recurring-task-scheduler/): Named, reusable schedules for run, sync, and backup commands.
- [How NetDefense Secures the Control Channel to Your Firewalls](https://netdefense.io/blog/securing-the-control-channel-to-your-firewalls/): A deep technical look at device identity, command signing, and the re-bind ceremony.

## Source Code

- [NDAgent (GitHub)](https://github.com/netdefense-io/NDAgent): The Apache-2.0 daemon that runs on each managed OPNsense firewall.
- [NDCLI (GitHub)](https://github.com/netdefense-io/NDCLI): The Apache-2.0 command-line interface and MCP server.

## Optional

- [About](https://netdefense.io/about/): Company background and team.
- [Privacy Policy](https://netdefense.io/privacy-policy/)
- [Terms of Service](https://netdefense.io/terms-of-service/)