Self-hostable-by-design secure remote access platform built on WireGuard, with identity-based policies, device trust and audit logs.
opnsense/core
Open-source firewall and router platform based on FreeBSD, providing the GUI, API and system backend for OPNsense.
Open-source alternative to:pfSense
Fortinet FortiGate
- Stars
- 4,759
- Forks
- 1,015
- Open issues
- 309
- Last commit
- yesterday
What is it?
This repository holds the core of OPNsense, an open-source firewall and routing distribution built on FreeBSD. It contains the web GUI, the REST-style API layer and the system management backend that configure and run the firewall.
The codebase is written mainly in PHP and follows an MVC structure, with the project gradually moving toward a new architecture rather than a full rewrite. Plugins extend the base system, and the repository includes Makefile targets for packaging, updating, linting, style checks and sanitizer runs.
Developers who want to contribute or build their own variant can use the build tools in the separate tools repository. Topics associated with the project include firewall, VPN, captive portal, routing, traffic shaping, proxy and intrusion prevention.
Key features
- 01Web GUI for configuring firewall rules, routing and system settings
- 02API layer for managing the system programmatically
- 03Built on FreeBSD with PHP-based MVC application code
- 04Supports VPN, captive portal, traffic shaping and proxy features
- 05Makefile targets for packaging, linting and style checks
Use cases
- Running a self-hosted firewall and router for a home or small office network
- Developing or extending OPNsense plugins and the web interface
- Building a custom OPNsense package from source
- Setting up VPN gateways or guest captive portals on a network edge
Quick start
- 1
Clone the repository from GitHub
- 2
Build the package with make (requires OPNsense build tools from the tools repository)
make package - 3
Install the built package on an OPNsense system with make upgrade
make upgrade
Things to know
- Built for FreeBSD and OPNsense systems, so it is not a general-purpose application you can run on any platform.
- Building requires the separate OPNsense tools repository and several system packages.
Topics
FAQ
- What is core?
- Open-source firewall and router platform based on FreeBSD, providing the GUI, API and system backend for OPNsense. This repository holds the core of OPNsense, an open-source firewall and routing distribution built on FreeBSD. It contains the web GUI, the REST-style API layer and the system management backend that configure and run the firewall.
- Is core free to use? What license does it have?
- core is open source under the BSD-2-Clause license. Check the license terms before using it in commercial products.
- Is core still maintained?
- Actively maintained. The last commit to core was on Oct 23, 2026.
- What can I use core for?
- Running a self-hosted firewall and router for a home or small office network Developing or extending OPNsense plugins and the web interface Building a custom OPNsense package from source Setting up VPN gateways or guest captive portals on a network edge
- How do I install core?
- Clone the repository from GitHub Build the package with make (requires OPNsense build tools from the tools repository): make package Install the built package on an OPNsense system with make upgrade: make upgrade
- Where can I get core?
- The source code and installation instructions are on GitHub: https://github.com/opnsense/core
Summary generated by AI from the project's README. GitHub stats refresh daily.
Related projects
Android app combining a DNS-over-HTTPS/TLS/DNSCrypt client, a per-app firewall and network monitor, and a split-tunnel WireGuard/SOCKS5 proxifier, without requiring root.
An interactive application firewall for GNU/Linux that asks you to allow or block each outbound connection, inspired by Little Snitch.
Free, open-source application firewall for Windows and Linux that monitors and controls each app's network traffic, with built-in secure DNS and tracker blocking.
Tailscale builds private WireGuard-based networks between your devices; this repo holds its tailscaled daemon and tailscale CLI.
An open source VPN daemon that creates secure tunnels between hosts using TLS-based authentication and encryption.