Hey everyone! Been running both pfSense and OPNsense in my lab for different clients, and I keep circling back to the HAProxy package for front-ending some web services. It's such a powerhouse for load balancing and SSL termination, but wow, the configuration experience between the two forks is... different.
On pfSense, the HAProxy package feels very "manual" and granular, which I appreciate for complex backends. But sometimes, just to set up a simple public HTTPS service, it feels like I'm clicking through a dozen tabs and creating separate entries for every little piece. The logic is there, but the workflow can get a bit sprawling.
OPNsense's HAProxy plugin (os-haproxy) recently got a major UI overhaul, and it's much more guided. It tries to bundle things into a more linear "frontend -> backend" flow, which is fantastic for clarity on simpler setups. However, when I need to do something more advanced, like tweak ACLs or specific health check parameters, I sometimes feel like I'm fighting the UI to find where they hid the setting.
My gut feeling is that OPNsense has the more "sane" default configuration path for probably 80% of use cases—it gets you a secure, working setup faster. But pfSense's interface, while dated, gives you that raw, unfiltered control right where you expect it. Has anyone else migrated their HAProxy configs between the two? Which one has burned you less when things get complicated? I'm especially curious about how you handle SSL certificate management and multi-WAN failover rules within HAProxy on each platform.
Happy building
I run the IT stack for a small MSP, and we deploy HAProxy behind pfSense or OPNsense for about a dozen client environments, mostly handling SSL termination and load balancing for their internal and customer-facing web apps.
* Configuration workflow: pfSense requires you to manually stitch together listeners, frontends, backends, and rules as separate objects. For a basic public HTTPS service, I typically create 6-8 separate configuration entries. OPNsense's redesigned plugin combines these into a more linear wizard; I can get the same service live with 3-4 guided steps.
* Advanced tuning visibility: In pfSense, every setting, like a custom health check parameter or ACL condition, is directly accessible in a dedicated field or dropdown, even if it's buried. In OPNsense, advanced options are often hidden behind "show advanced" toggles; I've spent extra minutes hunting for where to set a specific HTTP header timeout.
* SSL certificate management: Both handle Let's Encrypt well, but OPNsense bundles the ACME client directly into the HAProxy configuration page. In pfSense, you configure ACME separately and then manually assign the cert to the HAProxy frontend, which adds one more cross-reference step.
* Documentation and community help: For complex scenarios, I find the pfSense package documentation and forum threads more exhaustive, likely because the manual approach forces detailed discussion. OPNsense guides are cleaner for starters but sometimes lack the depth for edge cases, like configuring a custom error file location.
I'd lean toward OPNsense for any new deployment where the goal is a straightforward, secure reverse proxy setup for a handful of services. If you're already deep into complex ACLs or need very granular control over every directive, stick with pfSense. To be sure, tell us roughly how many backend services you're balancing and if you need layer 7 routing rules beyond host/path.
Automate all the things
That workflow difference is real. I set up a simple backend for an internal billing report portal on pfSense last week and the number of separate entries did feel excessive.
Do you find the wizard approach in OPNsense ever gets in the way for those client environments, or is the trade off for speed usually worth it?
Totally get that "fighting the UI" feeling when you need to tweak something specific in OPNsense. It's like the wizard gives you a great paved road, but puts guardrails over the drainage ditches you sometimes need to check.
Your 80% default sanity point feels right, especially for new setups. But have you hit any edge cases where the "sprawling" pfSense workflow actually became an advantage? Like when duplicating a complex config for a second client environment, maybe?