Verifiable protection
The pf packet filter on FreeBSD, with every image built in public CI from pinned sources and signed before it reaches you.
Security updateFreeSense 1.1.11 is the current Stable release. 1.1.10 and 1.1.11 fix two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619): update systems on 1.1.9 or earlier promptly. Development 1.2 has the fix since its 23 October build.Read the details →
Open source · Built in public
FreeSense
The firewall you can verify, from source to image.
FreeSense is a new, open-source firewall and router built on FreeBSD. Every release is built in public CI from pinned sources and signed. No accounts, no telemetry, no artificial limits.
Latest news
FreeSense 1.1.11: cloud images are back, same PHP security fixFreeSense 1.1.10: update now, two critical PHP vulnerabilities are fixedFreeSense Fleet is self-hosted: no cloud, no account, all yourssecurity.freesense.org: every FreeBSD advisory, and what it means for FreeSenseFreeSense Fleet: manage every firewall from one place (1.2 preview)FreeSense 1.1.9: RADIUS works again, plus hardening and PHP 8 fixes
Runs where your network lives
- FreeBSD
- Proxmox
- QEMU / KVM
- OpenStack
- bhyve
- VMware
- Bare metal
- ARM64
- pf
- ZFS
- WireGuard
- Raspberry Pi
One open distribution
Why FreeSense?
A complete firewall with nothing held back, and a build you can check line by line.
Easy to run
A reworked WebUI with grouped menus and Ctrl+K menu search, plus a REST API for everything you would rather script.
Nothing held back
One edition with every feature. Apache-2.0, no accounts or activation, no telemetry or phone-home.
New in 1.1
Run it from the WebUI. Or from a script.
FreeSense 1.1 replaced 1.0 as the supported Stable line, with a rebuilt interface and new ways to automate it.
Current systemRunning
Before system updateActivate
Known-good baselineActivate
ZFS boot environments snapshot the whole OS before an upgrade, so you can roll back from the WebUI or the boot menu.
Rules you can read
pf underneath. Clarity on top.
Write rules in the WebUI or drive them from the API. Threat Shield filters DNS for the whole network with AdGuard Home.
| PASS | LAN net | any | keep state |
| BLOCK | <threats> | WAN | quick |
| PASS | any | WAN :51820/udp | WireGuard |
| PASS | VLAN 20 | DNS :53 | Threat Shield |
| BLOCK | any | WAN | log |
Live from the pipeline
What just shipped
Read live from the signed release feeds and GitHub. Every build is pinned to exact source, ports and FreeBSD revisions you can inspect.
1.1released
The release feed could not be read just now. The Stable release notes list every change.
1.2 devbuilt
The release feed could not be read just now. See the latest commits on GitHub.
Stable1.1supported lineDevelopment1.2 devnightlyARM64 dev buildaarch64experimentalNetSpiderv0.1.0Windows
Development activity
FreeSense-org on GitHub ↗Recent commits could not be loaded. Browse FreeSense-org on GitHub.
Verify the latest build
The newest Development build was produced from these exact revisions. Pin, build, sign, publish, all in public CI.
FreeSense sourceSystem portsOptional packagesOS definitionFreeBSD portsFreeBSD src
How FreeSense is built →1
Pin
Source, ports, OS definition and FreeBSD fixed to exact commits.
2
Build
System and packages built from that sealed set in public CI.
3
Sign
Repositories and images signed with the project key.
4
Publish
Verified images go up first, then the channel advances.
Optional packages
Threat Shield. The whole network, on a wall.
DNS filtering, IP threat lists and country blocking, with a live threat map and a full-screen kiosk board in four styles. One of 34 optional packages that the project builds and signs.
New in 1.2 · Development preview
FreeSense Fleet. Every firewall, one control centre. All yours.
Self-hosted and private: not a cloud service, with no account and nothing sent to FreeSense. Join firewalls with a pasted invitation, watch them on a live dashboard or a wall screen, then back up, update and check them against policies together. Run the controller on your own network or on a public host that you control.
The FreeSense family
NetSpider. Where exactly does it break?
Layer 2 and Layer 3 network diagnostics for Windows: device discovery, MAC-level latency, Path Doctor fault localization, Storm Center and Wi-Fi ↔ LAN testing, drawn as a live spider web.
Newsroom
All newsLatest from the project
Release
FreeSense 1.1.11: cloud images are back, same PHP security fix
A Stable patch that supersedes 1.1.10. It carries the same PHP 8.5.12 security fix and brings the ZFS and UFS cloud images back, now with the VMware guest tools. Nothing to do first.
Security
FreeSense 1.1.10: update now, two critical PHP vulnerabilities are fixed
A Stable security patch. PHP 8.5.12 fixes CVE-2026-109618 and CVE-2026-109619, two critical remote code execution flaws in PHP itself. It also hardens the WebUI, updates HAProxy to 3.4.7 and fixes two smaller problems.
DevelopmentFreeSense Fleet is self-hosted: no cloud, no account, all yours
Fleet is not a cloud service. The controller is a FreeSense system you run, your data stays on it, and nothing is sent to FreeSense.
Ready when you are
Put FreeSense in front of your network.
Install on your own hardware, a virtual machine or a cloud disk. Already on 1.0? Upgrade in place; moving from 1.0 to 1.1 is one-way.