pfSense co-creator building new open-soure firewall platform: “will correct the mistakes of the past”

Twenty years ago, pfSense, the major open source firewall and router platform, was released. One of its original co-founders, Scott Ullrich, is building a new Linux-based “modern networking operating system” – nfSensei – from scratch. It will feature an AI brain, a Rust heart, modern VPNs, and many other bells and whistles.

Many organizations and networking enthusiasts rely on open-source pfSense or its fork, OPNsense, as their gateway to the wider internet.

On the 6th of March, Ullrich remembered that 20 years had passed since the v1 release of pfSense and announced something intriguing.

“I have assembled a new team and, as the original core contributor, will be spinning up a new project,” the post on X teased.

Later, Ullrich, using the alias geekgodOG, announced “the future of networking” on Reddit: nfSense will correct the mistakes of the past.

Now, the project is taking shape.

For the past year, Ullrich has been building nfSensei, a next-generation firewall and networking operating system. It has huge shoes to fill. Ullrich expects it to become pfSense's successor and address common frustrations.

“Development you can’t influence, a CE edition that feels like an afterthought, FreeBSD driver roulette on modern hardware, and a config workflow where one bad apply on a remote box means a drive,” Ullrich announced in July.

“Built from scratch in Rust, on Linux, and designed around the things pfSense users actually complain about.”

Choosing Linux over FreeBSD solves hardware support issues, ensures drivers that “just work,” and lets software be self-hosted on a wide range of hardware with no accounts or subscriptions. Migration is supposedly easy with the config.xml import.

Not a single line of code is yet public, but the new firewall is promised to feature native automation with over 1000 documented API calls, support for current VPNs, including WireGuard, IPsec, Tailscale, and self-hosted mesh, and even a separate wing for “experimental stuff.”

“Thirty-plus Labs features behind toggles: WAN bonding that fuses multiple cheap uplinks through a $5 VPS into one resilient pipe, per-flow SLA telemetry with tamper-evident audit chains, GeoDNS that steers traffic by live RTT and load, application-aware QoS, config push to a whole fleet of remote nodes, and an AI assistant on the box that reads your actual interfaces and logs using local models,” Ullrich said.

Previously, Ullrich said in a blog post that nfSensei software comes in just 5 self-contained binaries that include the entire OS and the webUI.

And admins are being tempted with promises that they won’t be able to brick their router from the couch – any configuration changes are stored as a candidate, differences can be reviewed and validated through “the real engines” before applying. If anything goes wrong, automated rollback will kick in if changes are not confirmed in time.

If a config ever fails at boot, the box falls back to the last good one on its own.

Scott Ullrich

nfSensei is currently in beta and has over 150 testers.

Why does the world need another firewall?

Ullrich argues that pfSense carries significant architectural debt – a disconnected web UI and backend interfaces, drifting out of sync.

“If the CLI and the web UI don't speak the same language, they will eventually disagree,” the blog post reads.

nfSensei solves that by unifying frontend and backend to a single API.

And developers can simply add any new features as extensions using a Lua package – no need to fork the whole project.

“nfSensei is the system I always wanted to build.”

The main challenge – OpenBSD’s pf (Packet Filter), a component responsible for network firewalling and traffic management – has been rebuilt as PFL, running directly on Linux’s XDP (eXpress Data Path, a high-performance networking feature in the Linux kernel).

This essentially moves packet processing several layers deeper than other common Linux stateful firewalling implementations, improving performance.

Most PFL features have parity with pf and are faster in early testing, but it’s still experimental, according to the engineering report.

“PFL is not pfSense, and it is not a drop-in replacement for it. It is a narrower experiment with a specific question: can pf's language and stateful semantics be expressed efficiently on Linux's programmable datapath – XDP –rather than on netfilter,” Ullrich said.

There is no mention of when the open beta will be available to the public. In the latest blog post, Ullrich walks through potential design and branding paths.

Cybernews has reached out to the developer for access to test the new firewall and will share our impressions if we manage to get our hands on it.

pfSense is currently actively maintained by Netgate as a FreeBSD-based firewall and router platform. It has had its own share of controversies in the past, including clashes with the OPNSense fork and a public dispute with the WireGuard team.

Cybernews previously demonstrated how to build your own capable router using open source software.