FreeSenseFreeSense
Download
Product · Coming soon in 1.2

FreeSense Fleet

Every firewall, one control centre, and 100% yours. Fleet is self-hosted: not a cloud service, with no account and nothing sent to FreeSense. Join firewalls with a pasted invitation, watch them live, then back up, update and check them against policies together. Firewalls call the controller, so they can sit behind NAT.

Read the documentationTry the Development build
1.2Development previewSelf-hostedNo cloud, no accountPrivateNothing leaves your network
The FreeSense Fleet dashboard with firewall count, 24-hour availability, alerts and a pulse grid per firewall
What Fleet does

Many firewalls. One place.

One firewall runs the Fleet controller, an optional package. Every other firewall joins it with the agent that is already part of FreeSense, so managed firewalls need nothing installed.

Joining

Guided joining

Make an invitation, paste it into Add to fleet on the new firewall, compare a 6-digit code and approve. Over the Fleet tunnel, Tailscale or a direct connection.

Monitoring

One live dashboard

Groups, 24-hour availability, alerts and internet quality for every firewall, plus a wall-screen view that pages by itself.

Updates

Updates in rings

Maintenance windows, rolling reboots, templates and schedules. Risky changes run under commit-confirm and roll back on their own.

Policy

Policies

Audit, fix or lock settings across the fleet. Locked rules cannot be edited on the firewall itself.

High availability

HA pairs

Set up CARP with state and configuration sync from two firewalls in a step-by-step guide, optionally over an encrypted WireGuard link.

Backups

Backups

Configuration backups of every firewall, kept on the controller with retention rules.

Self-hosted by design

Your fleet. Your controller.
Our cloud is not involved.

Most central managers live in a vendor's cloud. Fleet does not. The controller is a FreeSense system that you run, and everything stays on it.

No cloud

No Fleet cloud, no account

There is no FreeSense-hosted Fleet service, no sign-up and no subscription. The controller is an optional package on a FreeSense system you own.

Your data

It stays on your controller

The inventory, history, alerts, backups, policies and keys live on the controller under /fleet. Removing the package does not delete the fleet.

No phone home

Nothing sent to FreeSense

Fleet makes no connection to FreeSense servers. The invitation points at your controller, and each firewall pins its certificate.

Encrypted

Authenticated and encrypted

Firewalls reach the controller over the Fleet WireGuard tunnel, a tailnet or directly. Joining needs your invitation and a 6-digit approval code.

Run the controller wherever you want.

It is an ordinary FreeSense system, so you choose where it lives. The firewalls open the connection to it, so only the controller has to be reachable.

Fleet works the same in every setup. Tailscale, ntfy and Telegram are used only if you choose them.

  • On your own network. A firewall or VM at your headquarters or lab, reached over your WAN, LAN or VPN.
  • On your own server. A VM on a hypervisor you operate, in a rack or a closet.
  • On a public host that you control. Deploy the controller from a FreeSense cloud image on a server or cloud account that you own, give it a public address, and manage your fleet from there over a secure connection. It is still your server and your data.
  • Inside a tailnet. With Tailscale, firewalls join without any public port on the controller.
The Fleet NOC wall-screen view with internet status, groups and a paged list of firewalls
Live view

Built for a wall screen.

Health, internet failovers and every firewall by group, with CPU, memory, traffic and HA role. It pages by itself and can sound an alert when something goes down.

About the live view
Getting started

Three steps to a fleet.

Step 1

Install the controller

On one firewall, install FreeSense Fleet from System → Package Manager and switch it on in the guide.

Step 2

Invite a firewall

Make an invitation on the controller and paste it into Add to fleet on the new firewall.

Step 3

Approve

Compare the 6-digit code on both screens, approve, and the firewall appears on the dashboard.

Honest status

Tested in a lab. Not for production yet.

Fleet is part of the Development line, is experimental and unsupported, and is not in Stable 1.1. It arrives with FreeSense 1.2.

  • One controller managed seven firewalls, one of them over Tailscale.
  • A three-ring update of all seven took 20 minutes.
  • An HA pair took over within seconds when its MASTER lost power.
What was tested, and what was not

Where to go next

Copied to clipboard