Compared with pfSense#

Read that page for the substance. This one covers the part that is different, which is licensing.

Where pfSense is ahead#

• It has been shipping for far longer, on far more boxes, with far more people who have hit your problem before you.
• There is a company you can buy support from today, with terms that exist. Wheelhouse has no licence agreement, no terms of service and no published price.
• Appliances you can buy with it pre-installed. Wheelhouse has no hardware compatibility list: the image installs and reboots on one physical machine and has never run on any other.

What a subscription gates here, in one sentence#

A licence unlocks configuration changes. Reading never needs one.

One check in the agent, wrapped around a specific list of routes, and every route on that list is a write: stage, commit, commit-confirm, discard, configure, rollback, save, load, reconcile, capture, and the app-store actions. Everything else — sign-in, the audit log, /metrics, wheelhouse-agent plan and every read — is outside the gate, with two exceptions: GET /api/fleet/{id}/config and GET /api/fleet/{id}/version sit behind the plan's fleet feature check, so an unlicensed router answers 402 on those two reads. Both are named on the pricing page.

A router whose key has lapsed signs you in, shows every page, every counter, every log line and the whole audit trail, and answers 402 with a plain sentence on any attempt to change something. A card that expires costs you the ability to change the router, not the ability to see it.

How to test that claim#

Stop the agent's licence from verifying and use the box: every page still loads, the Commit Bar says your changes cannot be committed, and the reason is one line with a link to the Licence page.

The gate is commercial rather than a security boundary. The check runs in a binary on a router you hold: the aim is that paying is easier than patching, not that patching is impossible.

What the licence check actually does on the network#

One request every 24 hours, to one host, carrying four fields: the licence key, a fingerprint of the installation, the router's host name, and the agent version.

There is a second daily request, and it is not the licence check. The router reads the release channel on the download host, so the System page can say when a newer version is published. It is on by default, it is a plain GET of a static file, and it sends nothing — no key, no fingerprint, no host name, not even a version in the User-Agent. When the channel does name something newer, it fetches that release's checksum file and its notes from the same host to check them against each other before showing a word of them. It installs nothing. The toggle on the System page turns it off, and then it is never made at all.

Those two are the whole of what the router sends unprompted: no telemetry, no analytics, no crash reporting, no usage metrics. Everything else it talks to — a syslog collector for the audit log, a flow collector, an NTP server — is something you configured.

A key is verified offline against a public key compiled into the binary, so a router that has never reached the licence server and never will still knows what it holds. The refresh exists so a renewal extends your token without you touching the router, and so a revoked licence stops working within a day. Turning it off is one flag, with the trade spelled out: privacy.

Read on#

• Pricing — the plans, and the two figures that are not set.
• Privacy — the whole of what the router sends.
• Compared with OPNsense — the technical argument in full.
• The parity matrix — including the rows where Wheelhouse loses.