OPNsense® Desktop Security Appliance DEC800 Series (c) 2021 Deciso B.V., All Rights Reserved. [rev.300821] (c) 2021 Deciso B.V., AMD EPYC™ Performance. The first embedded appliance that delivers high performance yet doesn't make a sound. The specially designed cooling profile allows for cool operation even when stressed to the max 17Gbps Throughput Guard Web Access 1.5 Mega Packets per Second Filtering (SSL) Proxy Captive Portal with Voucher 256GB SSD ~2Gbps Inline Intrusion Prevention Offering Sufficient Space for Logging & Reporting Fast Filtering System wide two-factor Up to 50.000 Connections per authentication. Second Compatible with Google Authenticator. Hardware Assisted Encryption 2.5Gbps IPsec (AES256GCM16) Securing Networks™ DATASHEET Deciso Sales B.V. • +31 187 744 020 • [email protected] • www.deciso.com CERTIFIED HARDWARE FROM THE DEVELOPERS - MADE IN THE NETHERLANDS DEC800 SERIES Bundled with a free year OPNsense® Business Edition √ Commercial firmware repository √ Free GeoIP database √ Official OPNsense Open Virtualization Image √ Free professional plugins (OPNcentral, Proxy Access) √ Free E-Book ( English & German ) Securing Networks™ Deciso Sales B.V. • +31 187 744 020 • [email protected] • www.deciso.com SOFTWARE VERSATILE - OPEN SOURCE - FULLY FEATURED OPNsense is Deciso’s fast growing open source firewall and security platform released under an Open Source Initiative approved license. Its rich feature set is combined with the benefits of open and verifiable sources. All features can be used from within the easy to use graphical interface, equipped with a build-in search feature for quick navigation. Protecting your network has never been this easy with features such as; the integrated intrusion prevention system and two-factor authentication for safely connecting mobile users. OPNsense® Secure Your Network With Ease™ Businesses Protect your business network and secure your connections. From the stateful inspection firewall to the inline intrusion detection & prevention system everything is included for free.Use the traffic shaper to enhance network performance. Schools Limit and share available bandwidth evenly amongst students and utilize the category based web filtering to filter unwanted traffic such as adult content and malicious websites. It is easy to setup as no additional plugins nor packages are required. Hotels OPNsense offers a captive portal to control guest internet access for a limited duration. Vouchers can easily be created via the graphical user interface. On the road Even on the road OPNsense is a great asset to your business as it offers OpenVPN and IPSec VPN solution with road warrior support and two-factor authentication. The easy client exporter make configuring your OpenVPN SSL client setup a breeze. Remote Offices / Branches & SOHO The integrated site to site VPN (IPsec or SSL VPN) can be used to create a secure network connection to and from your remote offices. Enjoy the easy configuration and online searchable documentation with simple how-to type of articles to get you started, quickly. Pluggable support is offered for ZeroTier, Tinc as well as Wireguard. Securing Networks™ Deciso Sales B.V. • +31 187 744 020 • [email protected] • www.deciso.com SOFTWARE FEATURE OVERVIEW (For updated information on current release see docs.opnsense.org) • GUI • SSH / Console ๏ Integrated rulesets ๏ File Backup Certificates • SSL Blacklists ๏ Cloud Backup Stateful firewall ๏ Certificate Authority • Feodo Tracker ๏ Git Backup ๏ Filter by • Create or Import CA’s • Emerging Threats ETOpen SNMP • Source • Create or Import Certificates ๏ SSL Fingerprinting ๏ Monitor & Traps • Destination ๏ Let’s Encrypt (Plugin) ๏ Auto rule update using Diagnostics • Protocol • Automated (Trusted) CA configurable cron ๏ Filter reload status • Port 802.1Q VLAN support Captive Portal ๏ Firewall Info (pfInfo) • OS (OSFP) ๏ max 4096 VLAN’s ๏ Typical Applications ๏ Top Users (pfTop) ๏ Limit simultaneous connections on Link Aggregation & Failover • Guest Network ๏ Firewall Tables a per rule base ๏ Failover • Bring Your Own Device (BYOD) • Aliases ๏ Log matching traffic on a per rule ๏ Load Balance • Hotel & Camping Wifi Access • Bogons bases ๏ Round Robin • Template Management ๏ Current Open Sockets ๏ Policy Based Routing ๏ Cisco Ether Channel (FEC) • Multiple Zones ๏ Show All States ๏ Packet Normalisation ๏ 802.3ad LACP ๏ Authenticators ๏ State Reset ๏ Option to disable filter for pure Other Interface types • All available authenticators ๏ State Summary router mode ๏ Bridged interfaces • None (Splash Screen Only) ๏ Wake on LAN Policy organization ๏ Generic Tunnel Interface (GIF) ๏ Voucher Manager ๏ ARP Table ๏ Alias Support ๏ Generic Routing Encapsulation • Multiple Voucher Databases ๏ DNS Lookup • IP addresses Network Address Translation • Export vouchers to CSV ๏ NDP Table • Port ranges ๏ Port forwarding ๏ Timeouts & Welcome Back ๏ Ping • Domain names (FQDN) ๏ 1:1 of ip’s & subnets ๏ Bandwidth Management ๏ Packet Capture ๏ Interface Groups ๏ Outbound NAT • Use Traffic Shaper ๏ Test Port • Create security zones with equal ๏ NAT Reflection ๏ Portal bypass ๏ Trace route rules Traffic Shaping • MAC and IP whitelisting Monitoring ๏ Rule Category ๏ Limit bandwidth ๏ Real Time Reporting ๏ Zabbix Agent (Plugin) • Easy access rule sets ๏ Share bandwidth • Live top IP bandwidth usage ๏ Monit (Plugin) Granular control state table ๏ Prioritize traffic • Active Sessions • Proactive System Monitoring ๏ Adjustable state table size ๏ Rule based matching • Time left Enhanced Reporting ๏ On a per rule bases • Protocol • Rest API ๏ Network Flow Analyzer ‘Insight’ • Limit simultaneous client • Source Virtual Private Networks • Fully Integrated connection • Destination ๏ IPsec • Detailed Aggregation • Limit states per host • Port • Site to Site • Graphical Representation • Limit new connections per • Direction • Road Warrior • Clickable and Searchable second IGMP Proxy ๏ WireGuard (Plugin) • CVS Exporter • Define state timeout ๏ For multicast routing • Site to Site ๏ System Health • Define state type Universal Plug & Play • Road Warrior • Round Robin Data ๏ State types ๏ Fully supported ๏ OpenVPN • Selection & Zoom • Keep Dynamic DNS • Site to Site • Exportable • Sloppy ๏ Selectable form a list • Road Warrior ๏ Traffic Graph • Modulate ๏ Custom • Easy client configuration • Live Traffic Monitoring • Synproxy ๏ RFC 2136 support exporter Network Monitoring • None DNS Forwarder ๏ Tinc (Plugin) ๏ Netflow Exporter ๏ Optimisation options ๏ Host Overrides • Full mesh routing • Version 5 & version 9 • Normal ๏ Domain Overrides ๏ ZeroTier (Plugin) • Local for ‘Insight’ • High latency DNS Server • VPN, SDN & SD-WAN Firmware • Agressive ๏ Host Overrides High Availability ๏ Support Virtual Installs • Conservative • A records ๏ Automatic hardware failover • VMware tools (Plugin) Authentication • MX records ๏ Synchronized state table • Xen Guest Utilities (Plugin) ๏ External Servers ๏ Access Lists ๏ Configuration synchronisation ๏ Easy Upgrade • LDAP DNS Filter Caching Proxy • Reboot warning for base • Radius ๏ Supports OpenDNS ๏ Multi interface upgrades ๏ Integrated Servers DHCP Server ๏ Transparent Mode ๏ SSL Flavour selectable • Local User Manager ๏ IPv4 & IPv6 ๏ Support SSL Bump • OpenSSL • Vouchers / Tickets ๏ Relay Support ๏ SSL Domain only (easy filtering) • LibreSSL • FreeRadius (Plugin) ๏ BOOTP options ๏ Access Control Lists ๏ Selectable Package Mirror Authorization Multi WAN ๏ Blacklists ๏ Reinstall Single Package ๏ User Interface ๏ Load balancing ๏ Category Based Web-filter ๏ Lock Package (prevents upgrade) • Local User Manager ๏ Failover ๏ Traffic Management ๏ Audit Feature Accounting ๏ Aliases ๏ Auto sync for remote blacklists • Check installed packages for ๏ FreeRadius (Plugin & External) Load Balancer ๏ ICAP (supports virus scan engine) known security vulnerabilities ๏ Vouchers / Tickets ๏ Balance incoming traffic over Virus scanning (via plugins) ๏ Plugin Support 2-Factor Authentication multiple servers ๏ External engine support (ICAP) REST API ๏ Supports TOTP Network Time Server ๏ ClamAV (Plugin / C-ICAP) ๏ ACL support ๏ Google Authenticator ๏ Hardware devices Reverse Proxy Online Documentation ๏ Supported services: • GPS ๏ HAProxy - Load balancer (Plugin) ๏ Free & Searchable • Captive Portal • Pulse Per Second Online Identity Protection • Proxy Intrusion Detection & Prevention ๏ Tor - Anonymity online (Plugin) • VPN ๏ Inline Prevention Backup & Restore ๏ History & Diff support Securing Networks™ Deciso Sales B.V. • +31 187 744 020 • [email protected] • www.deciso.com FULL SPECIFICATIONS AND MODEL COMPARISON DEC840 DEC850 Software Preinstalled software OPNsense® OPNsense® License Open Source + 1 year free Business Open Source + 1 year free Business Edition Edition Hardware Specifications SFP+ Ports [10Gbps] 2 2 GbE RJ45 Ports [ 10/100/1000Mbps ] 4 4 USB 3.0 Ports 2 2 Console Port 1 1 Internal Storage 256GB M.2. Solid State Flash 256GB M.2. Solid State Flash Memory 8GB DDR4 16GB DDR4 CPU Cores 4 (max frequency 2.9Ghz) 8 (max frequency 3.1Ghz) Virtual Interfaces (802.1q VLANS)1 4093 4093 System Performance Firewall Throughput 14.6Gbps 17.6Gpbs Firewall Packets Per Second 1200Kpps 1450Kpps Firewall Port to Port Throughput 14.6Gbps 17.6Gpbs Firewall Port to Port Packets Per Second 122000 1450Kpps Concurrent Sessions 7000000 15000000 New Connections Per Second 50000 50000 Firewall Latency (average) 100us 100us Firewall Policies (Recommended Maximum)1 10000 10000 IPsec VPN Throughput (AES256GCM16) 2.3Gbps 2.5Gbps IPsec VPN Packet Per Second (AES256GCM16) 200Kpps 220Kpps