Why MurOS
MurOS is an open source fork of OPNsense, ported from FreeBSD to Debian Linux. The same proven web UI and feature set, managed as one tested product, now running on far more hardware than the BSD-based original.
Commercial appliances like FortiGate are polished but closed: licensed per tier, tied to one vendor and one hardware line. The open source option, OPNsense, removes the lock-in and has a mature web UI and a proven feature set, but it runs on FreeBSD, which narrows hardware support and leans on a catalogue of community plugins of uneven quality.
MurOS starts from OPNsense rather than reinventing it. We forked it and ported it from FreeBSD to stock Debian Linux: the same web UI and configuration model, with the system layer rebuilt on nftables, systemd, apt and iproute2. You get the firewall you already know, on the hardware Linux runs on.
It already runs the core a perimeter firewall needs on Linux: stateful filtering, NAT, routing, multi-WAN gateway monitoring, DHCP and clean logs. VPN, DNS and high availability are being wired in next. Free, open source, no subscription, no lock-in.
What makes MurOS different
Not one feature, but the combination: free, open, built on Linux, and integrated as a single tested product.
Free and open source
GPL-3.0, no enterprise edition, no paywalled module, no per-throughput subscription. Everyone runs the same package, and it stays yours to inspect, script and keep.
Built on Linux, runs almost anywhere
Stock Debian 13 brings the full Linux driver set: mini-PCs, rack servers, VMs on Proxmox or VMware, and recent or cheap NICs that the BSD-based OPNsense often will not drive.
One integrated core
Every service is native and tested together at each release, so the attack surface is known and upgrades are predictable. No third-party plugin matrix to break: it ships and updates as one unit, installed and upgraded straight from the MurOS apt repository.
Everything from one web UI
Edit in the web UI, click Apply, and MurOS rebuilds the nftables ruleset, validates it with nft -c before loading, and keeps a mandatory anti-lockout rule so the management session stays reachable. The same pattern on every page, no command line required.
What you get out of the box
MurOS is in beta. The list below is honest about what is wired on Debian today and what is still being ported; the features page tracks it module by module.
Working today
- Stateful nftables filtering, NAT (outbound, port forward, 1:1) and aliases compiled to named sets.
- Interface assignment, VLANs, bridges, LAGG and tunnels through iproute2.
- Static routing and per-gateway latency, loss and availability monitoring.
- Live diagnostics: connection states, packet capture, ARP/NDP, sockets and the loaded ruleset.
- Dashboard, health graphs and the firewall log streamed from journald.
- DHCP server for IPv4 and IPv6 on the Debian Kea daemons, with live leases.
- One config.xml; web UI and SSH on shared PAM accounts with TOTP.
Being wired in
- VPN service lifecycle: WireGuard, OpenVPN and IPsec (the runtime devices and PKI are already in place).
- Recursive validating DNS on the Debian Unbound daemon.
- High availability with keepalived (VRRP) and conntrackd state sync.
- Automatic multi-WAN failover, SNMP and notifications, and the full apt upgrade flow.
Who it is for
MurOS targets the firewall the large majority of companies actually run. What is not in the core today is on the roadmap as a native feature, never as a third-party plugin.
A good fit
- Small and mid-size companies that need a reliable perimeter firewall.
- Admins who prefer Debian and standard Linux tooling under the hood.
- Teams that value a tested, predictable product they fully control.
- Anyone replacing an end-of-life appliance without a new subscription.
On the roadmap
- Inline IDS / IPS with Suricata.
- LDAP and Active Directory authentication for the web UI and VPNs.
- Captive portal for guest networks.
Try it on a spare box
Write the installer ISO to a USB key or attach it to a VM, boot it, and reach the web UI in minutes. No account, no key, no phone-home. Already on Debian 13? Install the package instead.