Roadmap
This is what OPNexus recently gained, what is being worked on and what is planned next. These are intentions, not promises: there are no dates, and the order can change when something more urgent comes up.
Recently shipped October 2026
- 1.31 Vulture – Remove rules safelyFound candidates can be disabled through the usual preview: without a confirmation OPNexus reverts them automatically. Delete and restore later, with protection of the management access, admins only.
- 1.30 Owl – Tidy up and trace rulesThe rule analysis now lists unused, shadowed and duplicate rules as candidates (with confidence and reasons), and every rule has a change history: who or what changed it and when, through OPNexus or directly on the firewall.
- 1.29 Caracara – Visible rights, single gateways, hardeningMissing API rights for gateway and service status are shown and reported, and gateway alerts can be switched off per gateway. Plus hardening around session cookies, SSO, webhook targets (DNS rebinding) and the firewall interface, parallel notifications and an extended Grafana dashboard.
- 1.28 Sparrowhawk – Same thing only onceWhen adopting, OPNexus recognises that a rule, alias or NAT rule already exists centrally and links it instead of duplicating it. Helps with HA pairs and identical rules at several sites.
- 1.27 Buzzard – Firewall interface through OPNexusOpen a firewall’s web interface with one click, also behind NAT; own browser origin, admins only, off by default.
- 1.26 Kite – Rule analysisWhich rule matches source, destination and port? Per firewall, in pf order, with a confidence of “sure / probable / unknown”.
In progress
- Configuration as codeExport and import central objects as YAML, optionally into a Git repository; imports go through the same preview.
Next
- More hardeningPolish from the security reviews, for example the target-address check for audit export, offsite backup and the version hint as well.
Later and ideas
- Required flowsState that e.g. “A → B:443 must be allowed” and check it with the rule analysis. The basis for rolling out rule changes on a schedule with automatic confirmation later.
- More tested OPNsense versionsA fixed test series across 25.7, 26.1 and 26.7.
- Firewall interface by subdomainA dedicated address per session instead of ports, for installations with DNS names.
- Plugin inventory and IDS policiesOnly on demand.
Deliberately not planned
- Multi-tenancy for service providers (MSP)OPNexus is meant for people and companies that run their own firewalls.
- pfSenseThe APIs differ fundamentally; other tools cover it.
- Running as a cloud service (SaaS)Your data stays on your server.
- Terminal in the browser and an agent on the firewallA root shell from the browser would be an unnecessary risk, and the management tunnel is enough for firewalls behind NAT.
All releases → · Suggestions and bug reports are welcome through the source repository. Source code