A complete firewall, ready for the cloud
gate42 is OPNsense, the open-source firewall, packaged as a cloud image with sensible defaults, its own identity on every boot, and Padmini's tests behind every release.
What gate42 is
gate42 is Padmini Systems' build of OPNsense®, a mature open-source firewall and routing platform based on FreeBSD. We change the packaging, the defaults and the branding, not the firewall itself. So you get the features, the stability and the security updates of OPNsense, in an image that boots ready to use in your cloud.
The firewall
- Stateful firewall with aliases, groups, schedules and rule categories, for IPv4 and IPv6.
- NAT: automatic outbound NAT, port forwards, one-to-one NAT.
- Multi-WAN: gateway groups for load balancing and failover between internet links.
- Traffic shaping: limits and priorities per network, host or application port.
- Intrusion detection and prevention: Suricata with open rule sets, in IDS or inline IPS mode.
- Captive portal for guest networks, with vouchers.
VPN
- WireGuard for fast site-to-site and remote-access tunnels.
- IPsec for site-to-site tunnels with other firewalls and cloud gateways.
- OpenVPN for remote-access users, with a client export.
Network services
- DNS: Unbound resolver with overrides, DNS over TLS and blocklists.
- DHCP for IPv4 and IPv6, with static mappings.
- NTP server and client.
Management
- A clean web interface, with a dashboard, reporting and live logs.
- Two-factor login (TOTP), local users and groups, LDAP and RADIUS.
- A REST API for automation, and configuration history with one-click rollback.
- ZFS with boot environments: a failed update can be rolled back at boot.
- Dozens of plugins from the OPNsense repository: HAProxy, ACME certificates, dynamic DNS, SNMP, Zabbix and Prometheus agents, and more.
What gate42 adds
| One image for every KVM cloud | A qcow2 disk that boots with BIOS or UEFI, on virtio-blk or virtio-scsi disks, with virtio NICs. It grows to the VM's disk on first boot. |
| Its own identity on first boot | Each new firewall makes its own root password, shown on the console, its own web certificate and its own SSH host keys. The image ships no secrets. |
| Ready on the network | NIC 1 is the WAN (DHCP), NIC 2 the LAN (192.168.1.1, with DHCP for clients). The web GUI answers on port 8443 on the WAN and the LAN, so port 443 stays free for your own services. |
| Cloud defaults | DNS forwarding to your network's resolver, private addresses allowed on the WAN (clouds use them behind floating IPs), the QEMU guest agent, serial and screen consoles, a small ZFS cache that leaves memory for IPS. |
| Every upstream release, tested | Our pipeline rebuilds gate42 for each OPNsense release, tests it under BIOS and UEFI and on a real OpenStack cloud, then signs and publishes it. |
| Support from India | Installation, migration, AMC and training from Padmini Systems. |
Updates and security
gate42 installs updates from the official OPNsense package mirror, signed by Deciso, the company behind OPNsense, so security fixes are available to gate42 as soon as upstream publishes them. New gate42 images follow each OPNsense release for new installations. See Updates.
Coming next
- An installer ISO for VMware, Hyper-V, VirtualBox and bare metal.
- Zero-touch setup from the cloud's launch data: password, SSH keys and network settings.
- Next-generation features, such as application control and category-based web filtering.