Question 1

Why does OutaCloud use OPNsense instead of proprietary firewalls (Cisco, Fortinet)?

Accepted Answer

OPNsense is an enterprise-grade open-source firewall. It offers the same feature set as expensive hardware firewalls (Deep Packet Inspection, VPN, HA, IDS) but without artificial license costs or vendor lock-in. The code is transparent and auditable – a decisive advantage for digital sovereignty and security "Made in Europe".

Question 2

Does the firewall run as a VM or on dedicated hardware?

Accepted Answer

In 95% of cases, we virtualize OPNsense directly on your Proxmox cluster. This has massive advantages: We can take snapshots before updates, immediately move the firewall to another node in case of hardware failure, and flexibly scale resources. Using "VirtIO", performance is nearly identical to bare-metal.

Question 3

What does "Managed Firewall" mean? Do I still need to do anything?

Accepted Answer

"Managed" means we take complete responsibility for operations. We handle initial setup, security updates, service monitoring, and rule changes (e.g., "open port 443 for new web server"). You specify requirements, we implement them securely.

Question 4

Can I use OPNsense to replace AWS Security Groups?

Accepted Answer

Yes, OPNsense is significantly more powerful than AWS Security Groups. While AWS SGs only support simple "Allow" rules, OPNsense is a stateful firewall. It offers real traffic shaping, detailed logs, Intrusion Detection (IDS), and VPN endpoints – all things you'd pay extra for on AWS.

Question 5

How secure is the VPN access for my employees?

Accepted Answer

We configure state-of-the-art VPN standards. By default, we use WireGuard (extremely fast and lean) or OpenVPN (high compatibility). We integrate the VPN with your central identity management (e.g., LDAP/AD) and can enforce 2-factor authentication (2FA).

Question 6

Do you offer intrusion protection (IDS/IPS)?

Accepted Answer

Yes. On request, we activate Suricata as an Intrusion Detection & Prevention System. It analyzes traffic in real-time for known attack patterns (based on "Emerging Threats" rule sets) and automatically blocks attackers before they reach your servers.

Question 7

What happens during a hardware failure? (High Availability)

Accepted Answer

For critical environments, we configure a High Availability (HA) cluster with two OPNsense instances. We use the CARP protocol: If the primary node fails, the secondary node takes over the virtual IP within fractions of a second. Your VPN tunnels and connections remain intact – often without users noticing.

Question 8

Can we block specific countries (Geo-Blocking)?

Accepted Answer

Yes. If your business operates only in DACH (Germany, Austria, Switzerland), we can completely block access from high-risk countries (e.g., Russia, China) via GeoIP filtering. This drastically reduces your attack surface.

Question 9

Does the firewall also protect against DDoS attacks?

Accepted Answer

OPNsense handles "smaller" attacks and protocol abuse (e.g., SYN floods) very well. For massive volumetric attacks (hundreds of Gbit/s), our partner data centers' (Hetzner/OVH) upstream DDoS protection scrubs the traffic before it reaches your firewall.

Question 10

How do you segment my network?

Accepted Answer

We follow a "Zero Trust" approach. We divide your network into VLANs (Virtual LANs), e.g., "DMZ" for public web servers, "Internal" for databases, and "Management" for admin access. The firewall strictly controls who can communicate with whom. A compromised web server can't automatically access your database.

Question 11

Can we connect multiple locations (Site-to-Site)?

Accepted Answer

Absolutely. We build stable IPsec or WireGuard tunnels between your Proxmox cluster in the data center and your office or other cloud locations. For you, it feels like one large local network.

Question 12

Do you support Multi-WAN (multiple internet connections)?

Accepted Answer

Yes. If your cluster has multiple uplinks, we can configure load balancing (distributing traffic) or failover (switching on failure) to maximize internet availability.

Question 13

How quickly are security vulnerabilities (patches) addressed?

Accepted Answer

We typically deploy critical security updates within 24-48 hours of release. Using HA clusters or maintenance windows, this usually happens without noticeable downtime for your business.

Question 14

Do I get root access to the firewall as a customer?

Accepted Answer

In the "Fully Managed" model, we advise against it to avoid configuration conflicts. However, you get read access to logs and dashboards. If you want to modify rules yourself ("Co-Managed"), we set up an admin user – but we don't guarantee against misconfigurations you cause yourself.

Question 15

What happens if I lock myself out?

Accepted Answer

That's the advantage of the Managed Service: You call us. Since we have access to the firewall through the Proxmox host (console), we can rescue you even when the VPN is stuck or you accidentally activated the wrong rule.

Your Network, Fortified

Network Security is Complex

Evolving Threats

Complex Configuration

Ongoing Maintenance

Complete OPNsense Management

Deployment & Setup

IDS/IPS & Threat Protection

VPN & Secure Access

High Availability

OPNsense Firewall FAQ

Explore Our Services

Proxmox Support

Proxmox Monitoring

Exit AWS

Exit Azure

Exit GCP

Exit VMware

Tell us about your infrastructure