OPNsense MSP management — one platform, every client's fleet
Every client runs their own OPNsense boxes, their own rules, their own risk tolerance — but you shouldn't need a different login, a different VPN, or a different toolchain for each one. NetDefense for OPNsense gives your team one platform to run every client's fleet, with hard isolation between them.
Built around how MSPs actually structure client work
NetDefense isn't one shared workspace with a client picker bolted on — it's organization-based from the ground up. Each client gets their own organization, with its own devices, policies, users, and plan. A single NetDefense account can belong to any number of organizations, and switching between clients is a matter of switching context — the organization switcher in NDWeb, or --org on the command line — not a separate install or a separate login per client.
That isolation is deliberate, not a limitation: every resource is bound to its organization at the database level, so there is no accidental cross-client visibility to worry about. And because seat limits apply per organization rather than per account, a support team of twenty technicians can be spread across dozens of client organizations without any one client's user cap being affected by the size of your team overall.
Roles are consistent across every client organization you touch: Superuser for full control, Read-Write for day-to-day changes, and Read-Only for anyone who should only ever look. See the full model on Accounts & Organizations.
Give a junior tech a look, without giving them the keys
A lot of MSP support work is someone junior looking at a routing table, checking interface status during an outage, or confirming a rule is in place — not making changes. Read-only remote WebAdmin access (Business and Enterprise plans) gives full visibility into a client's device — the same view a full administrator would have, across the whole UI — with write paths blocked by the agent and an OS-level ACL once the session is opened read-only. The device enforces that boundary itself, so there's no write capability sitting behind the UI for an instrumented client to find.
It pairs naturally with the organization-level Read-Only role for a support tier that can see everything and change nothing, without a second product or a shared "viewer" account to manage.
Automate without living inside every client's dashboard
NDCLI and the MCP server cover the same fleet operations as NDWeb — sync, backup, run, VPN networks, snippets — for teams that would rather script a routine than click through it for every client. Personal Access Tokens can optionally be pinned to a single client organization when you create them, so a credential dropped into one client's CI pipeline simply has no reach into any other client's devices — even if it were to leak. Superuser-only actions, like managing member roles, are blocked for token-authenticated calls entirely, regardless of scope.
You never need a foothold inside a client's network
No client should have to open a port or stand up a VPN so you can support them. NDAgent connects outbound only, so every remote session — a config sync, a terminal, a read-only WebAdmin view — tunnels through a connection the device itself initiated. Nothing to request from the client's network team, nothing left listening afterward.
Every command sent to a device is cryptographically signed by the platform and independently verified by the agent, so a compromised credential on your side can't forge a command in a client's name — it can only issue genuine ones within whatever access that credential actually has. A write-scoped credential can still open a remote session on a client's device, so scope automation tokens to read-only wherever a script doesn't need to write, and treat anything capable of write access with the same care as a login. Read the full model on the security page, including the signing chain in depth.
Which plan fits an MSP practice
The Free plan covers non-production use — homelab, lab, proof of concept, evaluation — so it's not an option once a client's devices are live in production under your contract. Team ($6/device/month) covers a straightforward per-client fleet with phone & chat support. Business ($12/device/month) adds read-only technician access and a full year of task history, which covers what most support contracts actually need. Enterprise adds SSO/SAML, custom reporting, and a dedicated account manager for practices running many larger clients.
Every plan is billed per organization, so you choose the right tier per client rather than paying for your largest client's plan across your whole book of business. See the full breakdown on the pricing page.
Getting a client onto NetDefense
Create an organization for the client, invite your team and theirs with the right role, install NDAgent on their OPNsense device(s), and sync a starting template. The Getting Started guide walks through the whole flow, from accounts through your first sync.