SOLUTIONS

OPNsense central management for multi-site firewall fleets

Once you're past a handful of OPNsense firewalls, logging into each one's WebUI to make the same change stops scaling. NetDefense for OPNsense gives you one command line, one dashboard, and one policy chain to manage every device — whether that's five branch offices or five hundred.

Install Plugin Install CLI App View Pricing

The one-tab-per-firewall problem

OPNsense's own WebUI is excellent at what it's built for: administering one firewall. The trouble starts at firewall number two. A rule change that gets applied to three branch offices but forgotten on the fourth. No single place to see which devices are online, which are behind on firmware, or which are running a configuration that's quietly drifted from the rest of the fleet. A firmware upgrade that has to be run manually, one device at a time, on a maintenance window nobody enjoys scheduling.

And when something needs troubleshooting at a site you're not physically at, the options are usually a site visit, a VPN client someone has to remember to set up, or — worse — a temporary port-forward punched into a customer's perimeter and (hopefully) closed again afterward.

None of this is a flaw in OPNsense. It's what happens when a tool built for managing one device gets asked to run a fleet. NetDefense doesn't replace OPNsense — it adds the management layer that a fleet of OPNsense firewalls actually needs.

One policy chain, applied everywhere

NetDefense centers on a policy chain: reusable snippets (a rule, an alias, a DNS entry) bundle into templates, and templates attach to organizational units — the device groups you define by site, region, or role. Change a snippet once, and every template and device that references it picks it up at the next sync — no more hoping you remembered every box.

Firmware upgrades work the same way across the fleet: minor point releases apply with zero downtime via a reboot-free split-apply mode, and major version jumps can be scheduled for a planned window instead of a scramble. Pair that with named recurring schedules and your nightly backups, weekly syncs, and periodic upgrades happen on their own, across every device, without anyone needing to remember to kick them off.

See the full breakdown of templating, variables, and inheritance on the features page.

Reach every device without opening a port

NDAgent connects outbound only — no listening ports, nothing for a device to expose to the networks it sits behind. That means a firewall at a site with no public IP, or sitting behind CGNAT, is exactly as reachable as one on a static address. A remote-access session tunnels through that same outbound connection, giving you a terminal or the device's own web admin from your browser — no VPN client to install, no temporary port-forward to remember to close.

Need connectivity between sites rather than just to them? A one-click WireGuard overlay mesh handles key generation, peer configuration, and route distribution automatically — connecting branch offices, cloud VPCs, and edge devices into a single overlay network without manual tunnel setup.

Automate it, or drive it from an AI agent

Everything above is available from NDCLI for scripting, and from the MCP server for AI assistants like Claude Code or Claude Desktop — with the same authentication, the same organization, and the same permissions as your terminal. For CI/CD pipelines and headless jobs, Personal Access Tokens authenticate without an interactive login, so a nightly sync job in GitHub Actions works the same way a human running the command would.

Every command is signed, sequenced, and independently verified

Every command sent to a device is cryptographically signed by the platform and independently verified by the agent before it acts — TLS alone is not the trust boundary. The set of operations an agent will accept is fixed and small — ten named operations, nothing freeform — which stops forgery, tampering, and replay. It doesn't mean a compromised platform or a leaked write-scoped credential is harmless: remote session is one of those ten operations, and a remote session is a shell. Both NDAgent and NDCLI are open source, so none of this has to be taken on faith. See the full model — including an honest account of what a compromised platform can and can't do — on the security page, or read the deep technical walkthrough of the signing chain.

Start free

The Free plan covers up to 10 devices for non-production use — homelab, lab, proof of concept, evaluation — with the full feature set included, no separate trial tier to graduate out of. Once your devices go live in production, or you need more than 10, the Team and Business plans are billed per device; see the pricing page for the current breakdown. Either way, the Getting Started guide walks through accounts, your first device, and your first sync.

Frequently Asked Questions

No. CARP and OPNsense's built-in config backup are network-level and single-device features that keep working exactly as they do today. NetDefense sits a layer above: it centrally manages the configuration you push to devices — including devices in a CARP pair — and can additionally schedule encrypted backups to your own S3-compatible storage. The two are complementary, not competing.
No. NDAgent installs as a standard OPNsense plugin package through the normal package system. It doesn't fork OPNsense, change its network stack, or require a different firmware. You still administer the box locally exactly as before — NetDefense adds a management layer on top, it doesn't replace anything underneath.
Yes. NDAgent only ever makes outbound connections — it dials out to the platform over TLS and never listens for inbound traffic. That means devices behind NAT, CGNAT, or a client network you don't control are just as reachable as ones with a public IP, and no port forwarding or firewall rule changes are needed on the device side.
Nothing, until you tell it to. NDAgent only ever touches the objects it created itself — tagged with an ownership marker documented in the public agent source — so installing the plugin doesn't rewrite or delete your existing rules, aliases, or services. Your current configuration stays exactly as it is until you actively sync a template to that device.
The Free plan covers up to 10 devices for non-production use — homelab, lab, proof of concept, evaluation — with the full feature set included. Once an organization's devices go live in production under a commercial arrangement, the Team and Business plans take over, billed per device with no feature gating on the core management workflow — see the pricing page for the current breakdown.
Yes. NDAgent is Apache-2.0 licensed and its source is public — you can read exactly what runs on your device before installing it, verify there's no listening socket, and rebuild it yourself rather than trusting a binary download.

Ready to take control?

Install the NetDefense Agent on your OPNsense devices and start managing your firewall fleet in minutes.

Install Plugin Install CLI App Access Web App
Star on GitHub

NetDefense is an independent project and is not affiliated with, endorsed by, or connected to OPNsense or Deciso B.V. OPNsense is a registered trademark of Deciso B.V.