OPNsense alternatives: verify network policy under failure

For OPNsense alternatives, build a lab that mirrors important interfaces and rules before changing a live gateway.

• Recreate VLANs, DHCP, DNS, NAT, VPN, and firewall policy.
• Test both permitted and blocked paths from each network segment.
• Rehearse software update, reboot, WAN loss, and configuration restore.
• Check logs, alerting, hardware drivers, and throughput under realistic traffic.
• Keep a console-access and rollback plan for cutover.

Do not translate rules one-to-one without checking their meaning and order. The goal is equivalent isolation and reliable recovery.