I’ve run pfSense on the homelab router for about three years, and it’s mostly been fine. “Mostly” is doing some work in that sentence — the plugin ecosystem has felt increasingly stale, and a couple of packages I rely on hadn’t been updated in a long time. OPNsense forked from the same codebase a decade ago and has kept moving, so I finally set aside a weekend to switch.
Backing up first
Before touching anything, I exported the full pfSense config as XML and saved it somewhere that wasn’t the router itself. OPNsense can’t import a pfSense config directly — the two have diverged too much — so this was purely a reference document for rebuilding rules by hand, not a restore point.
What actually needed rebuilding
- Firewall rules: mostly a direct port, aliases translated cleanly
- VLAN interfaces: identical concept, just a different menu location
- DHCP static mappings: had to re-enter these manually, there were maybe twenty
- The plugin I actually cared about (dynamic DNS) has a first-party OPNsense equivalent that turned out to be less fiddly than what I had before
The one surprise
DNS resolution broke for about ten minutes because OPNsense’s Unbound configuration defaults to a different behavior around DNSSEC validation than what I had explicitly set in pfSense. Not a bug, just a default I’d forgotten I’d overridden years ago. Worth checking if you’re doing the same migration and DNS suddenly stops resolving for internal hosts.
Overall: a few hours of careful, unglamorous config work, and a router that feels more current than it did last week.