Hey everyone, I'm still pretty new to managing our cloud VPCs and on-prem stuff. I just finished migrating our edge firewall from Sophos XG Home to OPNsense, and I'm honestly shocked by the difference.
Sophos felt like it was designed to hide complexity, which sometimes meant I couldn't do what I needed. With OPNsense, everything is right there. For example, creating a floating rule to block a specific IP across all interfaces took me ages to figure out in Sophos. In OPNsense, it was just a straightforward rule under the floating tab. The aliases and rule logic also feel much more transparent 😅.
Has anyone else made this switch? I'm now trying to replicate our AWS Security Group logic in OPNsense rules for consistency. Like, creating a rule that only allows certain ports from a specific source alias. It feels more like writing Terraform, where you see the exact flow.
I'm the team lead for infrastructure at a mid-sized SaaS company, running a mix of bare-metal and cloud workloads. We have OPNsense on our colo edge and I've used Sophos XG in a previous role for a smaller office setup.
Here's a breakdown based on running both in production:
1. **Fit and Target Audience:** Sophos XG is an SMB-to-midmarket appliance play where simplicity is the product. OPNsense is for the prosumer, SMB, or any team with networking knowledge who wants a sysadmin tool, not a guided UI. For a cloud-centric team trying to replicate Security Group logic, OPNsense's model maps directly.
2. **Real Pricing and Hidden Costs:** Sophos's real cost is in subscription licenses for feature updates and support, which at my last shop added about 20-25% on top of the base appliance cost annually. OPNsense is free, but production-grade hardware (like a Protectli box) will run you $400-$800. The hidden cost is your own time for support and tuning.
3. **Deployment and Integration Effort:** Sophos wins for a standard out-of-the-box deployment; you can be live in an afternoon. OPNsense requires more initial decisions (state tracking, scheduler settings, which plugins). However, for integrating with automation (Ansible, Terraform), OPNsense has a clean REST API and native config file format, while Sophos often requires their proprietary CLI or Manager.
4. **Where Each System Clearly Breaks:** Sophos starts to fight you when you need to deviate from their predefined policy logic or workflow, like the floating rule example you gave. OPNsense breaks if you need turnkey vendor support or a unified management pane for multiple distributed sites without building it yourself.
I'd pick OPNsense for your use case, especially since you're comparing it to AWS logic and value granular control. The rule logic and aliases work like a firewall admin expects. If you need hands-off, supported appliance with central management for multiple small sites, Sophos makes more sense. Tell us your team size and if you need to manage more than one firewall centrally.
System calls per second matter.