Firewall fleet management
Run every OPNsense and pfSense firewall from one console.
OpenFleet connects to OPNsense through its API, and to pfSense through the REST API package or SSH. Change rules, NAT and aliases on one firewall or a hundred, roll out updates in your maintenance window, keep encrypted backups, and see the health of the whole fleet on one screen.
- Platforms
- OPNsense and pfSense, with every feature on both. No agents.
- Bulk changes
- A result for every firewall, every time.
- Audit
- Who changed what, where and when.
- Sign-in
- Two-factor authentication on every account.
How it works
Add your firewalls
Create an API key on each OPNsense firewall, or a REST API key or SSH account on pfSense, and add it to OpenFleet. OpenFleet works out which platform each firewall runs. Credentials are encrypted at rest.
Group them
Organise firewalls by site, customer or role. Every action can target one firewall, a group or the whole fleet.
Make the change
Edit a rule, block an address, start an update. OpenFleet runs it as a job and shows the outcome on each firewall as it happens.
Keep watch
Health, alerts, versions and HA state update on their own. Every change is in the audit log.
Features
Fleet
Hosts and groups
Add each firewall once, then group them for bulk work.
OPNsense and pfSense
Every feature on this page works on both platforms, in the same groups and the same jobs. OpenFleet detects the platform of each firewall when you add it.
Fleet dashboard
Status, versions, CPU, memory and disk for every firewall, updated live.
High availability
Finds CARP pairs by itself and shows which firewall is master. Alerts on split brain and failover.
Single firewall view
Interfaces, gateways, services, rule counts and recent jobs for one firewall on one page.
Search at any size
Search, filters and paging that stay fast with hundreds of firewalls, plus a keyboard command palette.
Firewall configuration
Firewall rules
View and edit filter rules on one firewall or many. Every change is backed up first, undone if a step fails, and checked on each firewall once applied.
NAT
Port forwards, outbound NAT, 1:1 and NPTv6, per firewall or across the fleet.
Aliases
Host, network, port and URL aliases. Block an address on every firewall in one step.
Drift and compliance
Compare rules, NAT and aliases across a group, see what differs and get a plan to bring them back in line.
Updates and backups
Firmware status
Pending updates, required reboots and release notes for each firewall, and which versions run where.
Updates and upgrades
Minor updates and major upgrades with live output while they run and a clear result once the firewall is back.
Rollout modes
One at a time, all at once, or canary: update a firewall you pick first and continue only if it succeeds.
Maintenance windows
Schedule checks and updates, for example every third Monday of the month at 02:00.
Configuration backups
Pull each firewall's configuration into OpenFleet, encrypted at rest, with retention per firewall.
Scheduled tasks
Run backups, checks and other routine work on a timetable.
Operations
Services
Start, stop and restart services on many firewalls, with guards that keep your management access up.
Interfaces and routing
Interfaces, gateways and routes, and static route management.
DNS and DHCP
Unbound overrides and DHCP reservations across the fleet.
VPN status
WireGuard, OpenVPN and IPsec tunnels, peers and sessions.
Diagnostics
ARP and state tables, logs, ping and traceroute from the console.
Jobs
Every bulk action is a job with a result per firewall, updated while it runs.
Monitoring and reporting
Alerts
Offline firewalls, pending updates, high disk or memory, failed jobs and HA problems.
Notifications
Alerts and job results by email or webhook.
Health history
Availability, job success and alert trends over time.
Audit log
Every change with the user, the firewall, the details and the time.
Export
Hosts, jobs and audit data as CSV or JSON.
Security and access
Two-factor sign-in
TOTP is required for every account, with no way to switch it off.
Roles
Read-only and admin users, enforced on the server.
Encrypted secrets
Firewall API keys, SSH keys and 2FA seeds are encrypted at rest.
Console access list
Allow the console only from the IP addresses, networks or ASNs you choose.
Shell recovery
Unlock an account, reset 2FA or sign a user out everywhere from the server, with every step audited.
Your firewalls stay yours
OpenFleet only uses the API key or SSH account you give it. Remove it and access ends.
Contact
OpenFleet is in early access. To try it on your firewalls or ask a question, email us.