OPNsense 21.1, codenamed “Marvelous Meerkat”, has been released and brings extensive innovations to the open-source firewall platform.
Key New Features
HardenedBSD 12.1
OPNsense 21.1 is based on HardenedBSD 12.1, a security-hardened FreeBSD variant:
- Updated kernel with security improvements
- ASLR (Address Space Layout Randomization)
- Improved exploit mitigation
- Updated drivers and hardware support
Firmware Health Check
A new firmware health check system has been introduced:
- Automatic firmware integrity verification
- Detection of damaged packages
- Proactive warnings for issues
- Simplified troubleshooting
WireGuard Improvements
The WireGuard integration has been significantly improved:
- Kernel-based WireGuard for better performance
- Simplified configuration
- Improved status display
- Multi-peer support
- Extended routing options
Firewall Updates
- Redesigned alias management
- Improved GeoIP filtering with automatic updates
- Extended logging functionality
- Optimized rule processing
- Improved NAT configuration
DNS Improvements
- Updated Unbound DNS with DNSSEC improvements
- Improved DNS-over-TLS support
- Optimized DNS resolution
- Extended blocklist management
Intrusion Detection and Prevention
- Updated Suricata engine
- Improved rulesets
- Optimized performance
- Extended alert categorization
Web Interface
The web interface received extensive updates:
- Modernized design
- Improved dashboard widgets
- Faster navigation
- Extended search functionality
- Improved mobile view
Plugins
Numerous plugins have been updated:
- HAProxy with new features
- Nginx plugin improvements
- Updated Zabbix agent plugin
- New Crowdsec plugin
Migration from 20.7
The upgrade from OPNsense 20.7 to 21.1 can be performed via the web interface. As always, a backup of the configuration before the upgrade is recommended.
Important: Some plugin APIs have changed. Please review the release notes for possible breaking changes before upgrading.
Conclusion
OPNsense 21.1 is a solid major release with a focus on security and performance. The migration to HardenedBSD and the improved WireGuard integration make the platform even more attractive for security-conscious enterprises. We are happy to support you with the migration and operation of your OPNsense firewall.
More on these topics:
More articles
Linux Server Hardening: 15-Minute Checklist
Ten concrete hardening steps for a freshly installed Debian, Ubuntu or Rocky Linux server — SSH, updates, firewall, auditing, sudo, limits, services, NTP, logging, kernel sysctl. With commands, doable in a quarter of an hour.
Backup Encryption: Key Management Done Right
Encrypted backups are useless if key management is sloppy. Symmetric vs. asymmetric, vault options, rotation, recovery scenarios and the tool-level practice for PBS, Restic and TrueNAS.
OPNsense 26.7 Release: What's Coming
OPNsense 26.7 is due: what to expect from the traditional July major release — HardenedBSD/FreeBSD update, plugin refresh, GUI improvements. An honest look at the public roadmap.