Glossary

Named lists of IPs, networks, ports, or hostnames you can reference in firewall rules. OPNsense aliases also support URL-table and GeoIP types, and refresh on a schedule. Backbone of clean rule sets.

OPNsense Community is the free public release on the standard 24.x/25.x cadence. Business Edition (commercial) gets earlier feature access and direct Deciso support; the underlying code is the same project.

Common Address Redundancy Protocol. The HA primitive for active/standby OPNsense pairs. Sync configuration via XML-RPC sync; sync state via pfsync.

OPNsense keeps a versioned XML history of every config save. You can diff or roll back from System → Configuration → History. Use this aggressively when learning.

Rules that apply to multiple or all interfaces. Useful for policy-routing or global blocks that would be repetitive per-interface. Run before interface-specific rules unless "quick" is unchecked.

Time-based ranges attached to firewall rules. Useful for parental controls ("block social media 22:00–06:00") or scheduled maintenance windows.

The IDS/IPS engine OPNsense ships. Rule-based, multi-threaded. Comes with ET Open rules free; ET Pro and Talos available commercially.

OPNsense's default recursive DNS resolver. Supports DNS-over-TLS upstream, blocklists (DNSBL), and per-host overrides. The right place to add ad-blocking without a separate Pi-hole.

Layer-7 app control and content filtering plugin. Free Home edition covers most homelab use. Paid SOHO adds cloud reporting and TLS inspection.

OPNsense installer supports ZFS as the boot pool, enabling boot-environment snapshots before risky upgrades. Highly recommended over UFS for any production install.