Everyone's rushing to cloud firewalls like they're the answer to everything. They're not. The pfSense/OPNsense model is fine.
Cloud firewalls fail on basic premises for real infrastructure.
* You can't inspect or control the actual packet path. Your "firewall" is a config API.
* Egress filtering? Good luck without complex, expensive egress proxies. On-prem, it's one rule.
* Real internal segmentation? They push you toward zero-trust overlays, which is just more complexity and cost.
When your cloud provider has an outage, your firewall is gone. With an on-prem box, your WAN circuit might die but your internal rules keep working. I've seen teams locked out of their own cloud security console during an incident. How do you change rules then?
Cloud is just someone else's computer. For a core network function, that's a risk.
Don't panic, have a rollback plan.