Compared with pfSense#

Most of this page is the OPNsense comparison: pfSense is also a FreeBSD appliance whose configuration is applied per page rather than committed as a transaction, and the argument about the configuration model and the Linux base is the same one.

Read that page for the substance. This one covers the part that is different, which is licensing.

Where pfSense is ahead#

• It has been shipping for far longer, on far more boxes, with far more people who have hit your problem before you.
• There is a company you can buy support from today, with terms that exist. Wheelhouse has no licence agreement, no terms of service and no published price.
• Appliances you can buy with it pre-installed. Wheelhouse has no hardware compatibility list and no complete bare-metal install on record.

What a subscription gates here, in one sentence#

A licence unlocks configuration changes. Reading never needs one.

That is not marketing shorthand for a feature matrix. It is one middleware function in the agent, wrapped around a specific list of routes, and you can read the list:

grep -n 'licensed(' agent/main.go

Every route in that list is a write: stage, commit, commit-confirm, discard, configure, rollback, save, load, reconcile, capture, and the app-store actions. Everything else — sign-in, every GET, the audit log, /metrics — is outside the gate. So is wheelhouse-agent plan.

An unlicensed or lapsed router signs you in, shows every page, every counter, every log line and the whole audit trail, and answers 402 with a plain sentence on any attempt to change something. Losing sight of your network because a card expired would be a worse product than losing the ability to change it.

How to test that claim#

You do not have to believe it. Stop the agent's licence from verifying and use the box: every page still loads, the Commit Bar says your changes cannot be committed, and the reason is one line with a link to the Licence page.

The gate is a commercial one, not a security boundary. It is a self-hosted binary and the product's own security documentation says so in those words: the aim is that paying is easier than patching, not that patching is impossible.

What the licence check actually does on the network#

One request every 24 hours, to one host, carrying four fields: the licence key, a fingerprint of the installation, the router's host name, and the agent version. Nothing else ever leaves the router — no telemetry, no analytics, no usage metrics, no update check.

A key is verified offline against a public key compiled into the binary, so a router that has never reached the licence server and never will still knows what it holds. The refresh exists so a renewal extends your token without you touching the router, and so a revoked licence stops working within a day. Turning it off is one flag, with the trade spelled out: privacy.

The summary#

If you want a mature appliance with a company behind it, pfSense is the safer purchase today. If the thing that annoys you about it is that a change is a save rather than a transaction, that is the thing Wheelhouse is built to fix, and its commercial terms are a single readable line rather than a matrix.

Read on#

• Pricing — the plans, and the two figures that are not set.
• Privacy — the whole of what the router sends.
• Compared with OPNsense — the technical argument in full.
• The parity matrix — including the rows where Wheelhouse loses.