All releases

gate42 2.0: NGFW, protection and web filtering

The second gate42 release. Every network is protected from the first boot, and each network can block categories of websites and apps, with safe search, all built from open-source parts and set up the gate42 way. Released 2026-11-10, based on OPNsense® 26.7.8_2 on FreeBSD 15.1-RELEASE-p6.

Release

gate42 2.0, build 77 (the newest)

Upstream

OPNsense 26.7.8_2 (series 26.7): upstream release notes

System version

The firewall reports OPNsense's version, 26.7.8_2, so updates and plugins work as upstream's; the console banner shows gate42 2.0 and its build.

Files

https://downloads.gate42.in/releases/2.0/

What is new

Protection from the first boot

Every gate42 2.0 protects its networks with no setup at all:

• Malicious sites are blocked for every network: gate42's DNS answers 0.0.0.0 for about 190,000 names of malware, phishing, scam and command-and-control sites (Hagezi's threat intelligence list), updated every day.
• Intrusion detection watches the LAN: Suricata with about 40,000 rules (Proofpoint's Emerging Threats Open and abuse.ch) raises an alert for attacks, exploits and infected devices, naming the device on your network.
• The firewall downloads the rules and lists itself after its first boot, retries every hour until it has them, and then updates them daily, each firewall at its own time of day.

Guide: protection

Web filtering for each network

A new page, Services › Web filtering. For each network (LAN, guest, office …) choose a policy:

• Stop DNS bypass: devices must use gate42 for DNS; a device with its own DNS server gets gate42's answer anyway, and DNS over TLS and public DNS-over-HTTPS servers are refused.
• Force safe search: Google, Bing and DuckDuckGo show only safe results, and YouTube runs in its moderate Restricted Mode.
• Always allow: domains a network may always reach, such as a social network your marketing team uses.

Guide: web filtering

Intrusion prevention and application control, step by step

Turn detection into blocking, and block applications such as WhatsApp, Telegram or TikTok: two new guides walk through upstream's intrusion prevention and application detection on gate42, tested on this release.

Guide: block attacks (IPS) · Guide: block applications · Guide: see what gate42 blocked

Also new

• Installer ISO for VMware, Hyper-V, VirtualBox and physical machines, with the same system as the cloud image (guide).
• MTU from DHCP: the WAN takes the MTU its network offers, such as 1442 on OpenStack, so large packets are no longer lost there.
• gate42's own release numbers: this is gate42 2.0, the second release. The console and SSH banner shows the release and its build; the system version stays OPNsense's, so updates and plugins work as upstream's.
• The browser tab says gate42 on every page.

System requirements

• Protection on uses about 650 MB of memory; Office's lists about 600,000 more names. On a firewall with less than 3.5 GB, web filtering uses Hagezi's smaller gambling list.
• The cloud image boots with BIOS or UEFI (without Secure Boot) on virtio-blk or virtio-scsi disks and virtio network cards: host42, OpenStack, Proxmox VE, KVM. The ISO installs on VMware, Hyper-V, VirtualBox and physical machines.
• Internet access from the WAN, for updates and for the daily rules and lists.

Moving from 1.8.2

Like every gate42 release, 2.0 is an image for new firewalls. A 1.8.2 firewall keeps installing OPNsense's updates from the official mirror, but gate42's own features come with the image. To move: back up the configuration (System › Configuration › Backups), start a 2.0 firewall, and restore it there. A restored 1.8.2 configuration has no protection settings: switch them on as the protection guide shows, or ask Padmini Systems to do it.

Known limits

• Web filtering works on names (DNS), as most firewalls do without decrypting traffic: it does not see page content, and a blocked site shows as "can't be reached", with no block page.
• A site opened by its IP address, or through a VPN the lists do not know, is not filtered by DNS; the intrusion detection still watches it.
• Intrusion detection alerts but does not block until you switch on prevention (guide).
• Forced safe search works for IPv4.

Open-source credits

gate42 is Padmini Systems' build of OPNsense® (BSD 2-Clause, © Deciso B.V.), which runs on FreeBSD. gate42 2.0 adds no closed parts. Its NGFW features come from these open-source projects and open data:

The firewall downloads the rules and lists from their publishers; none of them ships in the image. Every package in the image, with its licence, is listed below; the open-source notices say where the source is.

Packages and licences

The same list is in the release's manifest. Where the source comes from: open-source notices.