Features#

Ten areas. Each page states a claim, describes the mechanism, and names the code. Where something is narrower than its name suggests, the page says so on the same screen as the claim rather than a page away.

• The configuration model is the feature — one staged diff, one Commit Bar, the router's own commit-confirm, and a revision for every commit.
• Every click shows its commands — editors render set and delete lines with a copy button; so does every node of the running configuration.
• Interfaces, routing and uplinks — VLANs, bridges, bonds, PPPoE, tunnels, static routes joined with the live forwarding table, BGP and OSPF through FRR, and multi-WAN through all five VyOS mechanisms.
• Firewall and NAT — rules with live counters, groups as a first-class editor, port forwards that also stage the accept rule and can stage the hairpin pair.
• VPN and intrusion detection — WireGuard as native configuration, IPsec beside strongSwan's live associations, OpenVPN status, Suricata as a detector and as an inline engine in the packet path.
• Add-ons that are configuration — a 38-entry catalogue where installing an app is a diff, a commit, and something you can roll back.
• You can see what the box is doing — live counters over a WebSocket, conntrack top talkers, the journal, per-rule counters, Prometheus metrics, and drift flagged wherever intent and reality disagree.
• API-first, and configuration as code — the interface consumes the API you get; a desired-state file plans and applies through one engine behind the UI, the API, the CLI and an optional loop.
• Accounts your security team will accept — Argon2id and TOTP, three server-enforced roles, scoped API tokens, OIDC single sign-on, and an audit entry naming who changed what from where.
• Getting onto it — a dialog installer, an unattended seed, and an importer that turns an OPNsense config.xml into commands plus a report of what could not come across.

What is not here#

Ten feature pages describe what is built. The eleventh list — what is not — is on its own page, in the same detail, because a product that only publishes the first list is asking you to find the second one yourself.