Compared with OPNsense#
OPNsense is the product Wheelhouse is aimed at, so this page owes you the concessions first.
Where OPNsense is ahead#
- Maturity. Years of releases, a large user base, and behaviour that has been beaten on by many more people than have ever run Wheelhouse.
- Hardware reports. People have installed it on hundreds of boxes and written down what happened. Wheelhouse has no compatibility list, and no complete install to disk on physical hardware is on record at all.
- A public issue tracker and a community. You can search for your problem and often find it. Wheelhouse's forge is private, there is no public tracker, no forum and no chat channel.
- A large plugin ecosystem, with plugins for things Wheelhouse's 38-entry catalogue does not cover.
- A real company with real terms. Wheelhouse has neither yet: no licence agreement, no terms of service, no prices.
If those matter more to you than what follows, the honest recommendation is to stay where you are.
The configuration model#
This is the difference that is not a feature comparison, because it goes all the way down.
| OPNsense | Wheelhouse | |
|---|---|---|
| Applying a change | Per page, on Save | Staged into one working set; only the Commit Bar commits |
| Seeing what you are about to do | The form you filled in | The exact set and delete commands, before staging and again in the diff |
| A change that locks you out | Recovery is whatever access you still have | Commit-confirm: the router reboots into the previous configuration if nobody confirms |
| Undoing yesterday | The configuration history, or a backup | Roll back to an archived revision, after reading its diff |
| Six edits across four pages | Six applications | One transaction |
Commit-confirm is worth dwelling on, because it is the row nobody else can match. It is not a timer in a web page. It is the operating system's own mechanism, so it survives the management agent crashing, the browser being closed and the link going down — none of those are what is holding it.
Linux, not FreeBSD#
The base decides what is on the table. VyOS is Debian with a configuration layer, so:
- nftables rather than pf.
tcand CAKE for shaping.- In-kernel WireGuard, not a port.
- Podman containers as configuration objects, which is how the add-on store can make an install into a reviewable diff.
- FRR for BGP, OSPF, IS-IS and BFD, rather than a thin plugin.
- Network namespaces and VRFs, at least at the console.
A FreeBSD appliance is structurally locked out of all of it. That is not a criticism of OPNsense's engineering; it is a consequence of the kernel underneath it.
Accounts#
OPNsense and pfSense have local users and, in OPNsense's case, LDAP or RADIUS. What Wheelhouse puts in front of a network team is this combination:
- OIDC single sign-on with group-to-role mapping
(
agent/oidc.go); - three roles enforced server-side on every route, with a denied request logged as
such (
agent/auth.go); - API tokens that carry a role and an expiry, stored only as a SHA-256 and shown once
(
agent/admin.go); - an audit entry naming the actor, their role, their address and the exact commands
(
agent/store.go).
The API#
Wheelhouse's interface consumes the documented API. Anything a page can do, curl can
do, with a token instead of a cookie. There is no private endpoint set and no second
protocol.
The honest limit: there is no OpenAPI document. The endpoint table in the operator reference is the contract, and generating a schema is a gap that table is standing in for.
Migrating#
tools/opnsense-import.py reads a config.xml and writes VyOS commands plus a report of
what came across, what came across differently, and what could not. --check-against
then compares a running router with the configuration it should have, which is what makes
the migration checkable rather than hopeful.
It is not one click. It writes commands and a report a person reads.
The summary#
Wheelhouse is younger, thinner in ecosystem, and untested on metal. It has a configuration model OPNsense cannot retrofit, a kernel that can do more, and the access-control story a team gets asked for. Decide on those terms.
Read on#
- The configuration model.
- Getting onto it — the importer, in more detail.
- What is finished, and what is not.
- The parity matrix — the same argument as a table, losses included.