OPNsense Core is the system management and web interface layer for the OPNense firewall distribution, a FreeBSD-based network security appliance. It provides a comprehensive web GUI (PHP MVC framework) and a backend service daemon (configd in Python) to configure and manage all aspects of a network firewall/router: firewall rules (PF, IPFW), NAT, VPN (OpenVPN, IPsec, WireGuard), routing, DNS (Unbound, Dnsmasq), DHCP (Kea), IDS/IPS (Suricata), traffic shaping, captive portal, system updates, monitoring (Monit, Netflow, RRD), authentication (Local, LDAP, RADIUS, TOTP), and high availability (CARP, XMLRPC sync). The system is designed to be configured entirely through the web UI, which translates user actions into XML configuration files and system commands via the configd backend. The architecture is a monolithic application with a strong plugin-like module structure. The PHP MVC layer handles HTTP requests, validates data against a rich set of custom field types and constraints, and persists configuration to XML files. The Python configd daemon reads these configurations, generates system service templates, and executes the necessary system commands (pfctl, ifconfig, swanctl, etc.) to apply changes. A large collection of Python, PHP, and Shell scripts handle low-level operational tasks such as parsing firewall states, managing certificates, and aggregating netflow data. The codebase demonstrates high craftsmanship in its core abstractions, particularly the field type system, constraint framework, model migration pattern, and pluggable authentication/backup providers. These components are well-isolated, follow clean interface-based designs, and could be extracted for use in other PHP or Python projects. However, the project carries significant technical debt in the form of legacy PHP scripts that coexist with the modern MVC code, hardcoded system paths, static caches in field types, and a mixed-language codebase that increases maintenance complexity. Despite this, the project is actively maintained with a large community and frequent commits.