Almost every business we walk into already has "a firewall" - it came bundled with the fibre or LTE router the ISP installed on day one. Technically, that's not wrong. Consumer routers do include basic Network Address Translation (NAT) and a simple packet filter that blocks unsolicited inbound connections. The problem is what that basic filtering doesn't do, and most businesses only discover the gap after an incident, not before one.
OPNsense - the open-source firewall platform we deploy for South African businesses - sits in a completely different category. Not because it's more expensive (it's free), but because it's built to make active, logged, granular decisions about traffic, rather than just quietly keeping casual noise out.
Five things a consumer router genuinely can't do
Stateful rules, not just NAT
A consumer router's "firewall" is mostly a side-effect of NAT - it blocks unsolicited inbound traffic because it doesn't know where to send it, not because a rule engine evaluated and denied it. OPNsense tracks every connection through the firewall and lets you write explicit, auditable rules per interface, per zone, or per IP alias - the difference between "nothing gets in by accident" and "nothing gets in unless we said so."
Multi-WAN failover
Consumer routers have one WAN port and no concept of a backup link. OPNsense can monitor a primary fibre connection and a 4G/5G backup simultaneously, failing over automatically the moment the primary drops - directly relevant in South Africa, where load shedding and fibre outages are a when, not an if.
Built-in VPN endpoints
Most consumer routers offer, at best, a basic single-user VPN client mode. OPNsense includes IPsec, OpenVPN, and WireGuard endpoints out of the box, letting the firewall itself terminate remote-access and site-to-site tunnels for your whole team - no separate VPN box required.
Intrusion detection and prevention
A consumer router has no visibility into what's inside the traffic it's forwarding. OPNsense's built-in Suricata-based IDS/IPS inspects traffic against continuously updated rule sets, alerting on - or actively blocking - known attack patterns before they reach a server.
High availability
If a consumer router dies, your business is offline until someone drives out and replaces it. Two OPNsense units can be clustered using CARP for stateful failover, so a hardware fault or reboot on one firewall doesn't take the network down at all.
Why open source, not just "a bigger router"
You could solve some of this with a more expensive commercial UTM appliance instead - but that usually means per-feature licensing, forced cloud telemetry, and functionality locked behind subscription tiers. OPNsense is built on HardenedBSD, a security-hardened fork of FreeBSD, and is entirely free and auditable. Our fees cover the professional service - design, installation, rule configuration - not a recurring licence fee for turning on IDS/IPS or VPN support.
When it's actually time to upgrade
- You have remote or hybrid staff who need secure access to internal systems
- Downtime from a dropped fibre line costs more than a backup LTE link would
- You're handling client data with real POPIA exposure if it leaked
- You've had a scare - a suspicious login, a phishing click, unexplained traffic - and want actual visibility, not a guess
- You're already running network monitoring or a VPN as separate pieces of infrastructure that a firewall could consolidate
None of these require a large business - we've deployed OPNsense for single-site offices with a handful of staff, purely because the cost of getting it wrong (a breach, a POPIA incident, a day of downtime) was always going to be higher than the cost of doing it properly from the start.
Curious what an OPNsense deployment would look like for your network?
See the full feature set, deployment process, and pricing for OPNsense firewall installations.
