Has anyone heard of / tried OPNexus for central OPNsense management?

[dev]

Hi everyone,I've come across a project called OPNexus (https://opnexus.dev and https://github.com/OPNexus-dev/OPNexus).
It presents itself as a self-hosted central management console for multiple OPNsense firewalls. But for free.

It is source-available (PolyForm Shield license), runs via Docker Compose, and claims to work purely through the OPNsense API.
I couldn't find any discussion about it in the OPNsense forum or elsewhere, so I wanted to ask:Has anyone here heard of OPNexus before?
Has anyone already tested or is currently using it?
Any experiences, impressions, or concerns (positive or negative)?

Thanks in advance for any feedback!

[Patrick M. Hausen]

The project is less than a month old and has a single maintainer/committer. So I doubt many have taken notice, already.

[sopex]

The biggest issue with these projects is that the person will get bored and abandon it... At that point, it will start breaking and you will have to either get your own AI to maintain or uninstall it.

If this sounds like something you want to do, why not?

Sure, first try to establish it's not malicious, and if it is not well isolated from the internet, I am sure it's riddled with security issues some AI will find and exploit.

[julian_bldt]

Hi, and thanks to dev for mentioning it. I'm the maintainer of OPNexus, so take this with the usual grain of salt.

Both concerns are fair. It's a one-person project and it's young, I won't argue with that. What I can say is that it only talks to the firewalls through the regular OPNsense API, so if I disappear tomorrow your firewalls keep running exactly as they are. The config lives on the firewalls, not in OPNexus.

The source is public, so checking whether it's malicious is easy and I'd encourage that. It's not meant to face the internet, it comes with HTTPS and 2FA, and the images are signed. Trying it on a test box first is the sensible way anyway.

Small correction: the licence is PolyForm Shield, so source-available, not open source.

Happy to answer questions or take bug reports.

[dev]

Hi, thanks a lot for chiming in directly and for building this project! It's always great to hear straight from the maintainer, and your transparent explanation definitely puts things into perspective. Especially knowing that the configuration stays entirely on the firewalls themselves.

Since you're here, I'd love to learn a bit more about the background of OPNexus:

• Motivation: What sparked the idea to build this? Were you scratching your own itch managing multiple boxes, or was something missing in the existing tools?
• Production use: Are you already running OPNexus in a production environment yourself (or managing multiple firewalls with it)?
• Roadmap: What are your future plans for the project? Are there specific features you're focusing on next?
• Licensing: Out of curiosity, what led you to choose the PolyForm Shield license over a traditional open-source license?

[julian_bldt]

Thanks for the follow-up, happy to answer.

1. It started as my own itch. I run several OPNsense boxes, including a CARP pair, and I got tired of clicking the same change through each GUI and hoping I hadn't locked myself out. The existing options didn't really fit what I wanted: preview a change, apply it, and have it roll back on its own if the firewall stops answering.

2. Yes, I run it against my own firewalls, and I test new releases on a separate lab setup with a few spare boxes before they go anywhere near those.

3. Nothing fancy planned. Mostly polishing what's there, bug reports from people who try it, and more HA and update handling. I'd rather fix real problems than add features nobody asked for. Who tries it first usually decides what comes next.

4. Mainly because I don't want someone to take it, rebrand it and sell it as a hosted product. PolyForm Shield lets anyone read it, change it and use it for their own firewalls, including inside a company, but not build a competing product from it. I know that makes it not open source in the strict sense, which is why I said so earlier. If that's a dealbreaker for someone I understand.

[Nullman]

The biggest issue with these projects is that the person will get bored and abandon it... At that point, it will start breaking and you will have to either get your own AI to maintain or uninstall it.

Exactly this !!

Also, some people think just because its open source, if the author abandons it, someone else will just take over and continue development. But thats not how it works in real world. Once its abandoned, its abandoned forever. You are on your own.