Why Wheelhouse#
You already run a firewall and it works. This page is about the thing that annoys you about it, and whether that annoyance is fixable or structural.
The three deals on offer#
A GUI appliance with a weak configuration model. OPNsense, pfSense. Everything has a form, and the forms are good. But a change is applied when you press Save, one page at a time. There is no staged diff of what you are about to do, no single transaction covering six edits across four pages, and no mechanism that puts the box back if the change was the one that cut you off. The backup is an XML file; comparing two of them is your problem.
A strong configuration model with no GUI. The VyOS CLI, and the same family of ideas in
JunOS. set, compare, commit, commit-confirm, rollback — a real transaction with a
real diff. It is the right model and it has no dashboard, no live counter beside the rule,
no view of twelve routers at once, and no way to hand a junior a read-only login.
An enterprise box. It has both, and it also has per-seat pricing, a support contract to open a case against, and a stack you are not allowed to look inside. When it does something surprising you file a ticket rather than read a file.
What is structural, and what is a decision#
The GUI appliance's missing diff is structural. Its configuration is a document that gets translated into daemon configuration when you save; there is nowhere for a transaction to live. Commit-confirm cannot be added to it as a feature, because there is nothing to roll back to that the box itself understands.
The CLI's missing dashboard is a decision. The model underneath is already transactional, already versioned, already scriptable over an HTTP API. Nothing about it forbids a web interface.
The asymmetry is the product
Wheelhouse takes the platform that already has the hard part and builds the missing half on top, without taking away the half that was already there.
What "without taking it away" means#
Four rules, and every page in the interface follows all four:
- Nothing applies itself. Every setting is edited in a form that checks each value
under its field, and saving adds to one list of pending changes; only the Commit Bar
applies it. Each pending change is said in a sentence before anything is applied, and
Advanced mode shows the exact
setanddeletecommands behind it. - State and intent are distinct on screen. Configured values are plain fields; live values carry a pulse dot or a counter column. Where the two disagree the page shows a drift badge naming the disagreement — an interface the kernel reports but the configuration does not declare, a qdisc that is not the policy's, a static route declared but absent from the forwarding table.
- Empty states lead somewhere. A blank page says what is missing and offers the button that adds it, instead of saying "no data".
- Side panels, not modals. Editing an object keeps its table readable behind the panel.
Rule 2 is what stops a page reporting your configuration back to you as though it were the state of the machine.
Who this is for#
| You are | Today | What changes |
|---|---|---|
| A homelab or prosumer engineer | OPNsense or pfSense | Linux features that FreeBSD cannot offer — nftables, tc and CAKE, in-kernel WireGuard, containers — plus a configuration you can diff and an API that was not an afterthought |
| A VyOS CLI operator | Terminal, the JSON API, git | The same set / commit / confirm model you already think in, with dashboards, live counters, a fleet view and an audit trail on top |
| A MikroTik power user | Winbox | Comparable density of control, a modern interface, and a Linux underneath you can inspect |
| A small MSP or network team | UniFi (too shallow) or an enterprise box (too expensive) | Multi-site status, configuration as data, real routing protocols, single sign-on with roles and an attributed audit trail, without per-seat pricing |
Who this is not for#
- Consumer households. There is no app, no parental-controls wizard and no intent to build them.
- CGNAT-scale ISP gear. Wrong shape entirely.
- Anyone wanting UniFi's wireless controller. Wheelhouse manages the router. Access points go behind it and are managed by whatever manages them today.
- Anyone who needs a compatibility list today. There is no tested-hardware list — Hardware.
The state of it#
This is a young product. The argument above is about a design that is built and running, not about a mature one. What is finished, and what is not is the list of gaps, including the ones that will put you off.
See it for yourself
A licence key opens the release host, and every page of the manual is public.