Lots of changes to the website

content/posts/openbsd-to-opnsense.md

@@ -0,0 +1,86 @@
+---
+title: "Why I Moved fw01 from OpenBSD to OPNsense"
+date: 2026-03-17
+tags: [openbsd, opnsense, networking, homelab]
+slug: openbsd-to-opnsense
+description: "I love OpenBSD. I still moved my firewall to OPNsense. Here's the honest account of why."
+draft: false
+---
+
+I wrote a post not long ago about why I chose FreeBSD for this homelab. I could write a
+nearly identical one about OpenBSD on the firewall. The man pages, the security posture, pf —
+OpenBSD is one of the most coherent operating systems I've ever used, and fw01 ran it well.
+
+So why did I replace it with OPNsense?
+
+I wrestled with this for longer than I probably should have. Changing your firewall feels like
+a statement. I've written about pf. I've defended the "just learn the config file" approach.
+Switching to a web UI felt like a betrayal of something.
+
+But pragmatism won.
+
+## The Actual Problem
+
+My ISP bumped me to a 2 Gb/s connection. Theoretically great. In practice, I needed my
+firewall to actually push that throughput across the NICs I had available.
+
+OPNsense gave me more flexibility in how those interfaces were handled — driver support,
+offloading options, tuning knobs exposed through the UI. Getting the same result on OpenBSD
+would have meant more digging, more testing, more time spent on the firewall instead of
+everything the firewall is supposed to protect.
+
+I didn't want to spend a weekend tuning network drivers. I wanted 2 Gb/s to work.
+
+## Why Not pfSense
+
+Before this homelab, I ran a Netgate 4200 with pfSense. It worked fine, but the UI felt
+like it hadn't been touched since 2012. Cluttered, inconsistent, hard to navigate. Every
+time I needed to do something non-obvious I was digging through three menus wondering if I
+was in the right place.
+
+OPNsense is a different experience. The interface is clean, the layout makes sense, and it
+moves at a pace that feels like a maintained project. It's also based on FreeBSD — so under
+the hood, it's still pf, still the networking stack I trust.
+
+Choosing OPNsense wasn't a hard call once pfSense was off the table.
+
+## The Migration
+
+I expected this to be painful. It wasn't. My pf rules translated cleanly. VLAN configuration
+that I'd built up over time moved over without drama. The concepts are identical because
+the underlying system is the same — OPNsense just wraps it.
+
+If you're coming from OpenBSD's pf, OPNsense's firewall rules section will feel familiar.
+The mental model is the same. You're still thinking in terms of interfaces, states, and
+explicit allows. The GUI is just a different way of expressing those rules.
+
+## The Part I Didn't Expect to Care About
+
+Here's the thing I didn't anticipate valuing: if something goes wrong with the firewall
+while I'm not home, someone in my family can actually do something about it.
+
+With a text config and an SSH session, the answer to "the internet is down" is "call me and
+I'll walk you through it." With OPNsense, it's "open a browser, log in, click here, click
+there." That's a meaningful difference in a home environment.
+
+I'm not designing a data center. I'm running a homelab that also happens to be the internet
+connection for my household. Resilience includes other humans being able to use it.
+
+## What I Gave Up
+
+I won't pretend there's no loss here. OpenBSD's simplicity is real. The config file is
+auditable in a way no web UI ever fully is. There's a directness to `pfctl -sr` that no
+amount of GUI polish replicates.
+
+But I still have pf. I still have the BSD networking stack. The firewall is still doing
+exactly what I'd configure it to do manually — I'm just configuring it differently.
+
+## The Honest Takeaway
+
+Sometimes the right tool isn't the purist choice.
+
+I still believe in OpenBSD. I still think pf is the best firewall I've used. None of that
+changed. What changed was an honest accounting of what I actually needed from this specific
+machine — throughput, flexibility, and something my household can survive without me.
+
+OPNsense delivered that. The ideology didn't need to.