Just finished a company-wide OPNsense rollout, replacing a pair of aging Cisco ASAs. The project was sold on TCO and flexibility, but the road from lab to production for 150 users had some unexpected potholes. The datasheet numbers are one thing, real-world throughput with IDS/IPS and geo-blocking enabled is another.
Here's what bit us:
* **State table sizing is critical, but not where we first looked.** We scaled the max states per rule early, but the real killer was the **default state timeout settings**. Had to tune TCP establish, keepalive, and closing states for our specific SaaS-heavy traffic. Defaults caused premature drops for persistent connections.
* **Hardware selection matters more than raw CPU GHz.** We went with Intel NICs (obviously) but underestimated the benefit of a CPU with QuickAssist for our site-to-site VPN needs. Without it, IPsec performance was mediocre and CPU load spiked.
* **The GUI doesn't scale for rule management.** Beyond 50 or so rules, the firewall rule list becomes a nightmare to audit. We ended up adopting a naming convention and making heavy use of aliases, but it's still not as clean as I'd like. Bulk changes are a pain.
* **High Availability with CARP works, but failover testing revealed sync gaps.** The config sync is mostly reliable, but any manually created files or certain plugin settings don't sync. You have to document and replicate those manually, which is a failure point.
Biggest lesson? Test your *actual* traffic profile, not just iperf runs. Our "gigabit capable" appliance hits 650 Mbps max with Suricata in IPS mode on our specific mix of traffic. Also, the built-in reporting is fine for basics, but we had to push logs to a separate Graylog instance for real visibility.
For teams considering a similar move: budget more time for tuning than you think, and don't assume the community packages are all production-ready. Some are, some absolutely are not.
-- CRM Surfer
Your CRM is lying to you.
The state timeout issue is a classic one that gets a lot of teams. I've seen similar problems with cloud backup services - those long-lived control connections just vanish if you don't adjust the 'keepalive' and 'closing' values.
Your point about the GUI scaling is the real operational burden many overlook. When you get past that 50-rule threshold, the cognitive load of managing that flat list becomes a genuine risk. Aliases help, but they're a workaround, not a solution. Have you looked into any of the external config management or backup diff tools to help with bulk changes and audits?
Keep it constructive.
Yeah, that rule list sprawl is something I'm worried about for our own deployment. We're not at 150 yet, but even with just a few dozen rules, finding the one that needs a tweak feels like hunting.
> Have you looked into any of the external config management or backup diff tools
That's my next step! I'd love a specific recommendation if you have one. I see mentions of tools that can handle config versioning and diffs for OPNsense, but I'm not sure which one is the most beginner-friendly for a small team. Is there one you've used that doesn't require a huge time investment to set up?