OPNsense's plugin list is a sweet shop: intrusion detection, reporting, ad blocking, cloud backups, themes. Every plugin is also code running on your firewall, eating RAM and demanding updates. Here is the honest shortlist most networks benefit from — and the discipline that matters more than any single plugin.
Plugins live under System → Firmware → Plugins and install in one click — names start with os-. Some features people hunt for as plugins are actually built into the core already (Suricata intrusion detection, WireGuard, Unbound DNS), while plugins proper add things like dynamic DNS clients, extra VPN options, reporting tools and integrations. The rule of this guide: install for a named need, one at a time, and know how to remove what disappoints.
Before installing anything, inventory the core: Suricata intrusion detection sits under Services → Intrusion Detection and can block known-bad traffic patterns; Unbound handles DNS with optional blocklists; WireGuard and OpenVPN cover VPN; the firewall itself does traffic shaping. Many 'must-have plugin' lists are really tours of the core with extra steps. Turn on the built-in version of a feature first — if it leaves a specific gap, that gap is your plugin shopping list.
For most homes and small offices the short list stays short: a dynamic DNS client (os-ddclient or the built-in service) if you host a VPN on a changing IP; os-wireguard on versions where it is not yet core; a cloud configuration backup plugin (Google Drive or Nextcloud variants) as a second backup location; and a theme, because you will stare at this interface for years. Offices add agent and monitoring integrations. Everything else should have to argue its way in.
Each plugin is software with its own updates, bugs and appetite. Install one, use it for a few days, then decide. If a plugin duplicates something you stopped using, remove it — dead code on a firewall is risk without benefit. After any plugin change, download a fresh configuration backup. And keep perspective: the plugins page is not a progress bar. A firewall with three well-understood additions beats one with twenty mysteries, every single time.
Watch the video for the full OPNsense setup and see which features earn their place on a real network.
▶️ Watch Full VideoYes, like any added software. Inspection engines and proxies consume CPU and RAM, and a buggy plugin can misbehave after a firmware update. That is why the discipline is one at a time with a configuration backup before each change — if something goes wrong, you can remove the plugin or restore the backup and be back in minutes.
Not necessarily. Unbound DNS, built into the core, supports blocklists that stop many ad and tracking domains network-wide. It is DNS-level blocking, so it cannot remove ads served from the same domain as the content — in-video ads, for example. A dedicated tool like a Pi-hole does the same class of job; pick one place for DNS filtering and keep it tidy.
The community plugins in the firmware list are free and open source. A few third-party additions offer paid tiers for extra features or larger deployments. The firewall itself and everything needed for this guide series remains free; pay only when a specific paid feature solves a specific problem you actually have.