Updates
Interim updates and major versions in the maintenance window, after a configuration backup.
Configuration backup
Versioned outside the firewall, regularly and before every change.
High availability
CARP pair with configuration sync, after technical review.
Managed OPNsense firewall operations
We operate your OPNsense firewall: updates, rule changes on your instruction, 24/7 monitoring, configuration backups and VPN access. Hardware and access remain yours.
- OPNsense
- Suricata IDS/IPS
- WireGuard
- IPsec
- HA with CARP
Starting point
The firewall protects the network, but who looks after the firewall?
A firewall is set up once and rarely touched afterwards. That is exactly what makes it a risk.
Updates are left pending
The firewall sits directly on the internet, so vulnerabilities in reachable services such as VPN or the web interface hit it directly. A postponed update is especially costly here.
Grown rule set
Exceptions for old projects remain, and nobody remembers why a rule exists.
No configuration backup
If the hardware fails, the configuration has to be rebuilt from memory.
One admin, no backup
Often only one person knows the VPN access and exceptions.
Services
Scope of firewall operations
Eight building blocks for OPNsense on hardware, as a VM or in the cloud. Not included: on-site hardware, penetration tests, other firewall products.
Rule maintenance on instruction
On instruction of an authorised person, documented with reason and time.
VPN
WireGuard, IPsec and OpenVPN for sites and staff; granting and revoking access.
Rule set review
Flag unused and overly broad rules, clean-up after your approval.
24/7 monitoring
Reachability, gateways, load, VPN tunnels, certificates, HA status; response to P1 incidents by service level.
Intrusion detection (IDS/IPS)
Suricata built into OPNsense: maintain rule sets, review alerts; IPS after technical review.
Process
How we take over your firewall
Four steps from access to ongoing operations.
- 01
Assessment
Version, interfaces, rule set, VPN, plugins and high availability.
- 02
Backup and access
Back up the configuration, set up a dedicated admin account with a second factor, document emergency access.
- 03
Connect monitoring
Connection to 24/7 monitoring and definition of alert paths.
- 04
Ongoing operations
Updates in the maintenance window, changes on instruction, report on work carried out.
Pricing
Price by firewall and service level
The number of firewalls, high availability, VPN scope and service level determine the effort. We state the price in the proposal after the assessment. Individual tasks without an ongoing contract are billed at the support rate of €120 excl. VAT / hour.
Firewall operationsPrice in the proposal
Comparison
Run the firewall yourself or have it managed
OPNsense is quick to install. The work lies in operating it afterwards: updates, rule set, intrusion detection and evidence.
| Task | Run it yourself | Firewall operations (WZ-IT) |
|---|---|---|
| Security updates | when someone has time | in the maintenance window, after a backup |
| Rule changes | often undocumented | on instruction, with reason and time |
| Intrusion detection | rarely set up | Suricata with maintained rule sets |
| Evidence (e.g. NIS2) | your own planning | changes and updates documented |
Frequently Asked Questions
Answers to the most important questions
- Updates in the agreed maintenance window, rule changes on your instruction, 24/7 monitoring, versioned configuration backups and operation of VPN access. The firewall stays yours: on your own hardware, as a VM or in the cloud.
- OPNsense publishes two major versions a year, recognisable by release series such as 26.1 and 26.7, plus interim updates with security fixes. Between 30 April and 12 May 2026, four relevant vulnerabilities came together; the post on OPNsense 26.1.8 describes the case.
- You do. We change rules on the instruction of an authorised person, document the reason, change and time, and point out recognisable risks, such as exposing an internal service to the internet.
- Monitoring runs 24/7. If the firewall fails, the whole network is usually affected; that is usually a P1 incident, to which we respond according to the agreed service level. With a high-availability pair (CARP), the second firewall takes over the shared addresses automatically.
- WireGuard, IPsec and OpenVPN, which OPNsense ships with: site-to-site connections and access for staff. For zero-trust access without open ports there is also managed NetBird.
- Yes, after technical review. OPNsense intrusion detection is based on Suricata. As an IDS it reports suspicious traffic; as an IPS it also drops it. We select rule sets such as ET Open or the abuse.ch lists, maintain them, review alerts and connect them to monitoring. Whether IPS mode fits depends on hardware, throughput and the false-positive rate and is tested in IDS mode first.
- It provides technical evidence. Article 21 of the NIS2 Directive requires, among other things, security in the maintenance of network and information systems including vulnerability handling, backup management and access control policies. Documented updates, versioned configuration backups and logged rule changes evidence such measures. Whether your company falls under NIS2 should be clarified with your legal counsel; we do not provide legal advice. More on the compliance page.
- No. We manage OPNsense on your existing hardware, as a virtual machine or in your cloud. We can advise on the choice of new hardware on request.
- The price depends on the number of firewalls, high availability, VPN scope and service level and is set out in the proposal. Individual tasks such as an update or a rule change without an ongoing contract are billed at the support rate of €120 excl. VAT / hour.
Knowledge
Further reading
Vulnerabilities, network access and related services.
Guides
- OPNsense 26.1.8: two critical RCE bugsFour relevant CVEs in twelve days and what that means for patch management.
- Linux server hardeningChecklist based on CIS and BSI, including firewall and network services.
- Linux patch managementProcess, deadlines and evidence for security updates.
- Managed NetBirdZero-trust access without open ports; WZ-IT is an official NetBird reseller.
Reviews & projects
Operations that visibly relieve customers
Customer feedback on monitoring, updates, maintenance, support and stable production systems.
Networking & Provisioning
WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.
Steve KirchnerManaging Director, nextGYM GmbH
International
Built in Germany's Ruhr Valley. Running worldwide.
WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.
Selected projects
- LiveRemote access platform for distributed water treatment plantsABCO Water Systems · Australia · Secure Access & OT
- 81%AWS migration with substantially lower operating costsEVA Real Estate · UAE · Cloud exit & infrastructure
- 98%Provision new sites in minutes instead of hoursnextGYM GmbH · Germany · Automation & IoT
Read client reviews
Enquiry
Request firewall operations
For an initial assessment, the number of firewalls, version, VPN connections and whether an HA pair exists are sufficient. We only need access credentials after commissioning.
- Straight with Timo and Robin - no sales team, no pitch
- A professional assessment of your situation
- Concrete next steps for infrastructure, software or AI
The conversation is free and non-binding.
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
Jakob ÖschlbergerInno7 GmbH
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.