Wheelhouse

Compared with OPNsense#

OPNsense is the product Wheelhouse is aimed at, so this page owes you the concessions first.

Where OPNsense is ahead#

  • Maturity. Years of releases, a large user base, and behaviour that has been beaten on by many more people than have ever run Wheelhouse.
  • Hardware reports. People have installed it on hundreds of boxes and written down what happened. Wheelhouse has no compatibility list, and no complete install to disk on physical hardware is on record at all.
  • A public issue tracker and a community. You can search for your problem and often find it. Wheelhouse's forge is private, there is no public tracker, no forum and no chat channel.
  • A large plugin ecosystem, with plugins for things Wheelhouse's 38-entry catalogue does not cover.
  • A real company with real terms. Wheelhouse has neither yet: no licence agreement, no terms of service, no prices.

If those matter more to you than what follows, the honest recommendation is to stay where you are.

The configuration model#

This is the difference that is not a feature comparison, because it goes all the way down.

OPNsenseWheelhouse
Applying a changePer page, on SaveStaged into one working set; only the Commit Bar commits
Seeing what you are about to doThe form you filled inThe exact set and delete commands, before staging and again in the diff
A change that locks you outRecovery is whatever access you still haveCommit-confirm: the router reboots into the previous configuration if nobody confirms
Undoing yesterdayThe configuration history, or a backupRoll back to an archived revision, after reading its diff
Six edits across four pagesSix applicationsOne transaction

Commit-confirm is worth dwelling on, because it is the row nobody else can match. It is not a timer in a web page. It is the operating system's own mechanism, so it survives the management agent crashing, the browser being closed and the link going down — none of those are what is holding it.

Linux, not FreeBSD#

The base decides what is on the table. VyOS is Debian with a configuration layer, so:

  • nftables rather than pf.
  • tc and CAKE for shaping.
  • In-kernel WireGuard, not a port.
  • Podman containers as configuration objects, which is how the add-on store can make an install into a reviewable diff.
  • FRR for BGP, OSPF, IS-IS and BFD, rather than a thin plugin.
  • Network namespaces and VRFs, at least at the console.

A FreeBSD appliance is structurally locked out of all of it. That is not a criticism of OPNsense's engineering; it is a consequence of the kernel underneath it.

Accounts#

OPNsense and pfSense have local users and, in OPNsense's case, LDAP or RADIUS. What Wheelhouse puts in front of a network team is this combination:

  • OIDC single sign-on with group-to-role mapping (agent/oidc.go);
  • three roles enforced server-side on every route, with a denied request logged as such (agent/auth.go);
  • API tokens that carry a role and an expiry, stored only as a SHA-256 and shown once (agent/admin.go);
  • an audit entry naming the actor, their role, their address and the exact commands (agent/store.go).

The API#

Wheelhouse's interface consumes the documented API. Anything a page can do, curl can do, with a token instead of a cookie. There is no private endpoint set and no second protocol.

The honest limit: there is no OpenAPI document. The endpoint table in the operator reference is the contract, and generating a schema is a gap that table is standing in for.

Migrating#

tools/opnsense-import.py reads a config.xml and writes VyOS commands plus a report of what came across, what came across differently, and what could not. --check-against then compares a running router with the configuration it should have, which is what makes the migration checkable rather than hopeful.

It is not one click. It writes commands and a report a person reads.

The summary#

Wheelhouse is younger, thinner in ecosystem, and untested on metal. It has a configuration model OPNsense cannot retrofit, a kernel that can do more, and the access-control story a team gets asked for. Decide on those terms.

Read on#

Updated 2026-09-02