Manage all your OPNsense firewalls from one place

Edit the configuration once, review exactly what will change, deploy it as one unit and go back automatically if something fails. Spot changes made behind your back, keep backups and carry a baseline over to many firewalls.

Registration is closed at the moment.

How it works

Add your firewalls. Install the small management plugin on each OPNsense firewall and enter the token the service shows you. The firewall connects out to the service: no open port, no address that must be reachable, no API key given away. Existing aliases, rules and services can be taken over with one click and nothing is changed on the firewall.
Edit the desired state. Aliases, rules, VLANs, DNS, DHCP, WireGuard and IPsec are edited here, in forms that look like the OPNsense interface.
Review and deploy. You see what will be created, changed and removed. It is applied as a unit, checked, and rolled back if anything fails.

What you get

Review before deploy

A plan of every change. If the firewall changed since you looked, the deployment is refused and you review again.

Automatic rollback

Changes that fail are undone in reverse order, and a restore point of the configuration is stored before each deployment.

Drift detection

Changes made on the firewall itself are found and shown, so you decide whether to keep or overwrite them.

Backups you can compare

Stored configurations are encrypted, can be compared with each other or with the firewall, and restored.

Groups and templates

Apply a baseline to many firewalls once, with variables for what differs per firewall or group.

Audit log

Who changed what and when, for every change and deployment. Keys and passwords are never written to it.

Your secrets stay protected

Firewall credentials and stored configurations are encrypted. WireGuard private keys never leave the firewall.

Nothing to install

It is a web service. You need a browser and a user on the firewall.

See it

The dashboard with the status of all firewalls — **Everything at a glance.** The dashboard shows which firewalls are online, which have undeployed changes and which were changed outside the service.

The review page listing the planned changes of a deployment — **Review before anything changes.** Every deployment starts with a review of exactly what will be created, changed and removed, and is applied as one unit.

The rule list of a firewall — **Rules, aliases and VLANs in one place.** Edit the desired state in forms that follow the OPNsense interface, then deploy when you are ready.

A firewall marked as changed outside the service, with the differences — **Spot changes made behind your back.** The service compares each firewall with its desired state and tells you what differs and where it came from.

The list of stored configurations of a firewall — **Backups and restore points.** A copy of the configuration is stored before every deployment and can be compared and restored.

A template being applied to several firewalls — **Groups and templates for many firewalls.** Apply a baseline to many firewalls and keep a value per firewall or group with variables.

Plans

Free

Firewalls	up to 3
Users	1
Stored configurations	7 per firewall, kept 7 days
Storage for them	100 MB

Everything else is included: review, rollback, drift detection, groups, templates and the audit log.

Need more firewalls, more people on the account or longer history? Write to [email protected].

Questions

Does this replace the OPNsense web interface?

No. The firewall keeps working on its own. The service sends changes to it through the firewall's own API and compares the result, so you can still use the OPNsense interface; whatever you change there shows up as a difference.

What does the service store about my firewalls?

The configuration you edit here, the history of your deployments, and encrypted copies of the firewall's configuration files. With the plugin, no API key or password of the firewall is stored at all: the key it uses stays on the firewall. WireGuard private keys are not stored. IPsec pre-shared keys are stored only if you choose to.

Do I have to open a port or give the service an address?

No. The plugin on the firewall opens the connection to the service itself, over HTTPS, so it also works behind NAT and on changing addresses. If a change would cut that connection, the plugin puts the previous configuration back by itself after about a minute and a half.

What happens to a change that fails?

The steps already taken are undone, the firewall is checked again, and the outcome is written to the history. Before every deployment a copy of the configuration is stored, so you can also go back by hand.

Can I leave and take my data with me?

Yes. You can download everything you configured as a file and delete your account at any time.

Is this made by the OPNsense project?

No. It is an independent service that works with OPNsense firewalls.