OPNsense® Desktop Security Appliance DEC600 Series (c) 2021 Deciso B.V., All Rights Reserved. [rev.300821] (c) 2021 Deciso B.V., Gigabit Performance. This embedded appliance delivers gigabit performance yet doesn't make a sound. The specially designed cooling profile allows for cool operation even when stressed to the max. Guard Web Access 3.300Mbps Throughput Filtering (SSL) Proxy 250.000 Packets per Second Captive Portal with Voucher support 327Mbps Inline High Speed Up to 356Gb SSD Intrusion Prevention & Offering Sufficient Space for SSL Finger Printing Logging & Reporting Fast Filtering System wide two-factor 35.000 connections P/S authentication. Low Latency ~1.6mS (with Compatible with Google CoDel & Traffic Shaper) Authenticator. Hardware Assisted Encryption 600Mbps IPsec (AES256GCM16) Securing Networks™ DATASHEET Deciso Sales B.V. • +31 187 744 020 • [email protected] • www.deciso.com CERTIFIED HARDWARE FROM THE DEVELOPERS - MADE IN THE NETHERLANDS DEC600 SERIES Bundled with a free year OPNsense® Business Edition √ Commercial firmware repository √ Free GeoIP database √ Official OPNsense Open Virtualization Image √ Free professional plugins (OPNcentral, Proxy Access) √ Free E-Book ( English & German ) Securing Networks™ Deciso Sales B.V. • +31 187 744 020 • [email protected] • www.deciso.com SOFTWARE VERSATILE - OPEN SOURCE - FULLY FEATURED OPNsense is Deciso’s fast growing open source firewall and security platform released under an Open Source Initiative approved license. Its rich feature set is combined with the benefits of open and verifiable sources. All features can be used from within the easy to use graphical interface, equipped with a build-in search feature for quick navigation. Protecting your network has never been this easy with features such as; the integrated intrusion prevention system and two-factor authentication for safely connecting mobile users. OPNsense® Secure Your Network With Ease™ Businesses Protect your business network and secure your connections. From the stateful inspection firewall to the inline intrusion detection & prevention system everything is included for free.Use the traffic shaper to enhance network performance. Schools Limit and share available bandwidth evenly amongst students and utilize the category based web filtering to filter unwanted traffic such as adult content and malicious websites. It is easy to setup as no additional plugins nor packages are required. Hotels OPNsense offers a captive portal to control guest internet access for a limited duration. Vouchers can easily be created via the graphical user interface. On the road Even on the road OPNsense is a great asset to your business as it offers OpenVPN and IPSec VPN solution with road warrior support and two-factor authentication. The easy client exporter make configuring your OpenVPN SSL client setup a breeze. Remote Offices / Branches & SOHO The integrated site to site VPN (IPsec or SSL VPN) can be used to create a secure network connection to and from your remote offices. Enjoy the easy configuration and online searchable documentation with simple how-to type of articles to get you started, quickly. Pluggable support is offered for ZeroTier, Tinc as well as Wireguard. Securing Networks™ Deciso Sales B.V. • +31 187 744 020 • [email protected] • www.deciso.com SOFTWARE FEATURE OVERVIEW (For updated information on current release see docs.opnsense.org) • GUI ๏ Integrated rulesets ๏ File Backup • SSH / Console • SSL Blacklists ๏ Cloud Backup Certificates • Feodo Tracker ๏ Git Backup Stateful firewall ๏ Certificate Authority • Emerging Threats ETOpen SNMP ๏ Filter by • Create or Import CA’s ๏ SSL Fingerprinting ๏ Monitor & Traps • Source • Create or Import Certificates ๏ Auto rule update using Diagnostics • Destination ๏ Let’s Encrypt (Plugin) configurable cron ๏ Filter reload status • Protocol • Automated (Trusted) CA Captive Portal ๏ Firewall Info (pfInfo) • Port 802.1Q VLAN support ๏ Typical Applications ๏ Top Users (pfTop) • OS (OSFP) ๏ max 4096 VLAN’s • Guest Network ๏ Firewall Tables ๏ Limit simultaneous connections on Link Aggregation & Failover • Bring Your Own Device (BYOD) • Aliases a per rule base ๏ Failover • Hotel & Camping Wifi Access • Bogons ๏ Log matching traffic on a per rule ๏ Load Balance • Template Management ๏ Current Open Sockets bases ๏ Round Robin • Multiple Zones ๏ Show All States ๏ Policy Based Routing ๏ Cisco Ether Channel (FEC) ๏ Authenticators ๏ State Reset ๏ Packet Normalisation ๏ 802.3ad LACP • All available authenticators ๏ State Summary ๏ Option to disable filter for pure Other Interface types • None (Splash Screen Only) ๏ Wake on LAN router mode ๏ Bridged interfaces ๏ Voucher Manager ๏ ARP Table Policy organization ๏ Generic Tunnel Interface (GIF) • Multiple Voucher Databases ๏ DNS Lookup ๏ Alias Support ๏ Generic Routing Encapsulation • Export vouchers to CSV ๏ NDP Table • IP addresses Network Address Translation ๏ Timeouts & Welcome Back ๏ Ping • Port ranges ๏ Port forwarding ๏ Bandwidth Management ๏ Packet Capture • Domain names (FQDN) ๏ 1:1 of ip’s & subnets • Use Traffic Shaper ๏ Test Port ๏ Interface Groups ๏ Outbound NAT ๏ Portal bypass ๏ Trace route • Create security zones with equal ๏ NAT Reflection • MAC and IP whitelisting Monitoring rules Traffic Shaping ๏ Real Time Reporting ๏ Zabbix Agent (Plugin) ๏ Rule Category ๏ Limit bandwidth • Live top IP bandwidth usage ๏ Monit (Plugin) • Easy access rule sets ๏ Share bandwidth • Active Sessions • Proactive System Monitoring Granular control state table ๏ Prioritize traffic • Time left Enhanced Reporting ๏ Adjustable state table size ๏ Rule based matching • Rest API ๏ Network Flow Analyzer ‘Insight’ ๏ On a per rule bases • Protocol Virtual Private Networks • Fully Integrated • Limit simultaneous client • Source ๏ IPsec • Detailed Aggregation connection • Destination • Site to Site • Graphical Representation • Limit states per host • Port • Road Warrior • Clickable and Searchable • Limit new connections per • Direction ๏ WireGuard (Plugin) • CVS Exporter second IGMP Proxy • Site to Site ๏ System Health • Define state timeout ๏ For multicast routing • Road Warrior • Round Robin Data • Define state type Universal Plug & Play ๏ OpenVPN • Selection & Zoom ๏ State types ๏ Fully supported • Site to Site • Exportable • Keep Dynamic DNS • Road Warrior ๏ Traffic Graph • Sloppy ๏ Selectable form a list • Easy client configuration • Live Traffic Monitoring • Modulate ๏ Custom exporter Network Monitoring • Synproxy ๏ RFC 2136 support ๏ Tinc (Plugin) ๏ Netflow Exporter • None DNS Forwarder • Full mesh routing • Version 5 & version 9 ๏ Optimisation options ๏ Host Overrides ๏ ZeroTier (Plugin) • Local for ‘Insight’ • Normal ๏ Domain Overrides • VPN, SDN & SD-WAN Firmware • High latency DNS Server High Availability ๏ Support Virtual Installs • Agressive ๏ Host Overrides ๏ Automatic hardware failover • VMware tools (Plugin) • Conservative • A records ๏ Synchronized state table • Xen Guest Utilities (Plugin) Authentication • MX records ๏ Configuration synchronisation ๏ Easy Upgrade ๏ External Servers ๏ Access Lists Caching Proxy • Reboot warning for base • LDAP DNS Filter ๏ Multi interface upgrades • Radius ๏ Supports OpenDNS ๏ Transparent Mode ๏ SSL Flavour selectable ๏ Integrated Servers DHCP Server ๏ Support SSL Bump • OpenSSL • Local User Manager ๏ IPv4 & IPv6 ๏ SSL Domain only (easy filtering) • LibreSSL • Vouchers / Tickets ๏ Relay Support ๏ Access Control Lists ๏ Selectable Package Mirror • FreeRadius (Plugin) ๏ BOOTP options ๏ Blacklists ๏ Reinstall Single Package Authorization Multi WAN ๏ Category Based Web-filter ๏ Lock Package (prevents upgrade) ๏ User Interface ๏ Load balancing ๏ Traffic Management ๏ Audit Feature • Local User Manager ๏ Failover ๏ Auto sync for remote blacklists • Check installed packages for Accounting ๏ Aliases ๏ ICAP (supports virus scan engine) known security vulnerabilities ๏ FreeRadius (Plugin & External) Load Balancer Virus scanning (via plugins) ๏ Plugin Support ๏ Vouchers / Tickets ๏ Balance incoming traffic over ๏ External engine support (ICAP) REST API 2-Factor Authentication multiple servers ๏ ClamAV (Plugin / C-ICAP) ๏ ACL support ๏ Supports TOTP Network Time Server Reverse Proxy Online Documentation ๏ Google Authenticator ๏ Hardware devices ๏ HAProxy - Load balancer (Plugin) ๏ Free & Searchable ๏ Supported services: • GPS Online Identity Protection • Captive Portal • Pulse Per Second ๏ Tor - Anonymity online (Plugin) • Proxy Intrusion Detection & Prevention Backup & Restore • VPN ๏ Inline Prevention ๏ History & Diff support Securing Networks™ Deciso Sales B.V. • +31 187 744 020 • [email protected] • www.deciso.com FULL SPECIFICATIONS AND MODEL COMPARISON DEC670 DEC690 Software Preinstalled software OPNsense® OPNsense® License Open Source + 1 year free Business Open Source + 1 year free Business Edition Edition Hardware Specifications GbE RJ45 Ports [ 10/100/1000Mbps ] 4 4 USB Ports 1 1 Console Port 1 1 Internal Storage 16GB Solid State Flash 256GB Solid State Flash Memory 4GB DDR3 8GB DDR3 CPU Cores 4 (1.6Ghz) (1.6Ghz) Virtual Interfaces (802.1q VLANS)1 4093 4093 System Performance Firewall Throughput 3300Mbps 3300Mpbs Firewall Packets Per Second 250Kpps 250Kpps Firewall Port to Port Throughput 941Mbps 941Mpbs Firewall Port to Port Packets Per Second 78Kpps 78Kpps Concurrent Sessions 3000000 7000000 Firewall Latency (average) 200us 200us Firewall Policies (Recommended Maximum)1 10000 10000 IPsec VPN Throughput (AES256GCM16) 600Mbps 600Mbps High Availability with State Synchronisation Requires Two Requires Two Dimensions Height x Width