Is MurOS a fork of OPNsense?

Yes. MurOS is an open source fork of OPNsense, ported from FreeBSD to Debian 13. It keeps the OPNsense web UI and configuration model and re-implements the system layer for Linux: nftables instead of pf, systemd instead of rc and configd, apt instead of pkg, and iproute2 instead of ifconfig. The result is the OPNsense feature set running natively on the full Linux hardware ecosystem. MurOS is an independent project, not affiliated with or endorsed by Deciso B.V. or the OPNsense project.

Why does MurOS refuse a plugin system?

A plugin catalogue means uneven quality, untested feature combinations and a compatibility matrix that breaks on upgrade. MurOS ships every feature in the core, tested end to end, integrated into the same UI and documented in one place. The attack surface is known and the whole product is tested at every release.

Is MurOS really free?

Yes. MurOS is licensed under GPL-3.0-or-later. There is no enterprise edition, no paywalled module and no per-seat or throughput subscription. You install the same package everyone else runs.

What hardware does MurOS run on?

Anything Debian 13 supports: a mini PC, a 1U server, a virtual machine on Proxmox or VMware, or a small appliance with two or more network cards. There is no proprietary hardware requirement.

THE SHORT VERSION

Why MurOS

MurOS is an open source fork of OPNsense, ported from FreeBSD to Debian Linux. The same proven web UI and feature set, managed as one tested product, now running on far more hardware than the BSD-based original.

Commercial appliances like FortiGate are polished but closed: licensed per tier, tied to one vendor and one hardware line. The open source option, OPNsense, removes the lock-in and has a mature web UI and a proven feature set, but it runs on FreeBSD, which narrows hardware support and leans on a catalogue of community plugins of uneven quality.

MurOS starts from OPNsense rather than reinventing it. We forked it and ported it from FreeBSD to stock Debian Linux: the same web UI and configuration model, with the system layer rebuilt on nftables, systemd, apt and iproute2. You get the firewall you already know, on the hardware Linux runs on.

It already runs the core a perimeter firewall needs on Linux: stateful filtering, NAT, routing, multi-WAN gateway monitoring, DHCP and clean logs. VPN, DNS, high availability and multi-WAN failover run as well. Free, open source, no subscription, no lock-in.

Install guide See every feature

What makes MurOS different

Not one feature, but the combination: free, open, built on Linux, and integrated as a single tested product.

Free and open source

GPL-3.0, no enterprise edition, no paywalled module, no per-throughput subscription. Everyone runs the same package, and it stays yours to inspect, script and keep.

Built on Linux, runs almost anywhere

Stock Debian 13 brings the full Linux driver set: mini-PCs, rack servers, VMs on Proxmox or VMware, and recent or cheap NICs that the BSD-based OPNsense often will not drive.

One integrated core

Every service is native and tested together at each release, so the attack surface is known and upgrades are predictable. No third-party plugin matrix to break: it ships and updates as one unit, installed and upgraded straight from the MurOS apt repository.

Everything from one web UI

Edit in the web UI, click Apply, and MurOS rebuilds the nftables ruleset, validates it with nft -c before loading, and keeps a mandatory anti-lockout rule so the management session stays reachable. The same pattern on every page, no command line required.

What you get out of the box

MurOS is in beta. The list below is honest about what is wired on Debian today and what is still being ported; the features page tracks it module by module.

Working today

Stateful nftables filtering, NAT (outbound, port forward, 1:1) and aliases compiled to named sets.
Interface assignment, VLANs, bridges, LAGG and tunnels through iproute2.
Static routing and per-gateway latency, loss and availability monitoring.
Live diagnostics: connection states, packet capture, ARP/NDP, sockets and the loaded ruleset.
Dashboard, health graphs and the firewall log streamed from journald.
DHCP server for IPv4 and IPv6 on the Debian Kea daemons, with live leases.
VPN on the Debian daemons: WireGuard, OpenVPN and IPsec, with the PKI and the runtime devices.
Recursive validating DNS on Unbound, with forwarders, local records and blocklists.
High availability on keepalived and conntrackd, with the configuration synchronised to the backup.
Intrusion detection and prevention on Suricata, inline through the nftables ruleset, and NetFlow export.
Captive portal for guest networks and traffic shaping on the kernel queueing disciplines.
Per-rule policy routing to a gateway or a gateway group, with automatic multi-WAN failover between tiers.
One config.xml; web UI and SSH on shared PAM accounts with TOTP.

Being wired in

SNMP and notifications on the Debian equivalents, snmpd and an SMTP relay.
The full apt upgrade flow from the UI, and the sshd options.
Long-run soak testing of the high availability state synchronisation.

Who it is for

MurOS targets the firewall the large majority of companies actually run. What is not in the core today is on the roadmap as a native feature, never as a third-party plugin.

A good fit

Small and mid-size companies that need a reliable perimeter firewall.
Admins who prefer Debian and standard Linux tooling under the hood.
Teams that value a tested, predictable product they fully control.
Anyone replacing an end-of-life appliance without a new subscription.

On the roadmap

LDAP and Active Directory authentication for the web UI and VPNs.

Try it on a spare box

Write the installer ISO to a USB key or attach it to a VM, boot it, and reach the web UI in minutes. No account, no key, no phone-home. Already on Debian 13? Install the package instead.

Download the ISO View on GitHub