Two computers in one box
Install OPNsense on a Sophos XGS and it boots to a working firewall with no network interfaces at all. The appliance looks like one computer and is two: an x86 host, and a coprocessor behind a PCIe endpoint that owns every front port.
The vendor ships drivers for its own operating system and for Linux only, so when support lapses the usual verdict on the hardware is e-waste. This project gives the ports back to FreeBSD, and then puts the coprocessor to work for the firewall.
What it does
Every front port
All fourteen on the XGS 136 and all twelve on the XGS 3300, with its expansion module's, each an ordinary FreeBSD interface named as the chassis names it.
pf decides, the coprocessor forwards
A connection the firewall has passed goes into the coprocessor's flow table, IPv4 with its translation and IPv6 as it is, and comes back out the moment pf lets go of it.
IPsec in the engine
An association strongSwan installs through OPNsense lands on the coprocessor's crypto engine with nothing typed: AES-GCM, AES-CBC with an HMAC, NAT traversal.
The firewall's lists still cut
A block list gaining an address, or the Intrusion Detection logging a listed TLS fingerprint (JA4), cuts a connection that is already in hardware.
Part of OPNsense
One section of the menu, every page in Arabic and English, the front ports assigned at the first boot, and updates from its own page in seconds.
Kept honest
Every figure is on a page with how it was taken and a photograph of the run. A claim that turned out wrong stays on its page, struck through, beside what replaced it.
Measured, not promised
Each number links to the page that holds it, with how it was taken and the module build it was taken on.
Two families answer now
On silicon that shares nothing. Two more, OCTEON TX2 and its 98XX, are described from the vendor's binaries and wait for hardware; TOPAZ and GR have no coprocessor to drive.
It looks like OPNsense, because it is
The XGS section of the menu shows the front panel with each port's link, the coprocessor, the flows in hardware, the IPsec engine, the transceivers, updates and problem reports. Every page is photographed on an appliance, in English and in Arabic.
The plugins around it
Each in its own repository, each installable on its own.
xgs-image-builder
An OPNsense image for a Sophos XGS with everything inside, built on GitHub from a form.
os-fanctl
Fan control from the temperatures the kernel publishes, the fans handed back to the hardware on any fault.
os-frontpanel
The firewall's own information on the LCD in the front of the appliance, and its keys given something to do.
os-linkhealth
Watches every physical port and says which cable or transceiver is going bad, by the chassis' names.
os-netreport
A readable summary of the network by mail on a schedule, in Arabic or English.
os-theme-xgs
XGS Silicon, a light, dark and automatic theme for the web GUI.
opnsense-arabic
A complete Arabic translation of the OPNsense web interface.
opnsense-rtl
The page laid out right to left when the GUI is in Arabic or Persian.
The story
How a firewall with no ports became one with every port: eight months of looking, the open sources read for what they say, two coprocessors that share nothing, and the last hop - told in eleven chapters, with the photographs.
Read it from the startWrite to the project
A question, an appliance that is not listed, a measurement of your own, or work you want to do on it - the contact page reaches the person who wrote this. Problems with an appliance go best through its own Problem Reports page, which sends what is needed and nothing private.
Contact Open an issueAn independent project, not affiliated with Sophos or Deciso.