Turn Linux into a firewall.

MurOS is an open source fork of OPNsense, ported from FreeBSD to Debian 13. The same proven web UI and feature set, stateful filtering, NAT, routing, VPN and high availability, now running natively on Linux: nftables instead of pf, systemd instead of rc, apt instead of pkg. Free, on any hardware Linux runs on.

Install the ISO View on GitHub

GPL-3.0, no subscription
Native on Debian 13
No CLI required

Write the installer ISO to a USB key or a VM, boot it, and pick your keyboard and LAN IP. Already on Debian 13? Install the package instead.

Free and open source

GPL-3.0. No edition, no paywall, no subscription.

Runs on your hardware

Built on Debian Linux: mini-PCs, servers, VMs and modern NICs.

One web UI

Edit, Apply, and MurOS rebuilds the nftables ruleset and reloads services through systemd. No CLI required.

Native, tested core

Every service integrated and tested together, upgraded as one.

The web UI

Every page follows the same pattern: edit your config, click Apply, and MurOS rebuilds the nftables ruleset, validates it with nft -c before loading, and reloads the affected services. A built-in anti-lockout rule keeps your management session reachable.

https://muros.lan/

MurOS dashboard: live system and traffic counters, with the navigation menu on the left

The MurOS dashboard: live system and traffic counters, with every feature one click away in the left-hand menu.

Roadmap and comparison

The OPNsense feature set MurOS inherits, broken down by subsystem. FortiGate and OPNsense ship these as mature, native capabilities; the MurOS column shows how far each one has been ported from FreeBSD to Debian 13. Firewall, interfaces and the web UI already run natively, hence the BETA.

Component	FortiGate	OPNsense	MurOS
Base OS, packaging, install (apt, systemd, ISO)	yes	yes	95%
Stateful firewall and NAT (nftables)	yes	yes	89%
Interfaces, VLAN, bridge, LAGG, routing (iproute2)	yes	yes	90%
Web UI and API (configuration, diagnostics)	yes	yes	90%
Console and system services (NTP, SSH, serial)	yes	yes	90%
Recursive DNS (Unbound, dnsmasq)	yes	yes	80%
Dashboard, reporting and graphs	yes	yes	75%
DHCP server	yes	yes	85%
Captive portal	yes	yes	70%
VPN (IPsec, OpenVPN, WireGuard)	yes	yes	82%
Gateways and multi-WAN failover	yes	yes	50%
IDS / IPS (Suricata) and NetFlow	yes	yes	30%
High availability (VRRP, state sync)	yes	yes	85%
Traffic shaping (QoS)	yes	yes	5%

The percentage is the share of each subsystem already ported to Debian, not a quality rating: 100% means it runs natively on Linux with no FreeBSD code left. Every component is native to the core, not a third-party plugin. See what it is for and what is on the roadmap.