#9 of 18 firewall and router platforms · Updated October 2026
pfSense review 2026
pfSense (Netgate: pfSense CE and pfSense Plus) · Portfolio-led builder
pfSense ranks #9 of 18 firewall and router platforms in the Firewall and Router Ledger 2026, with a Ledger Index of 55.9 out of 100. pfSense has the largest installed base and a complete feature set, but since 2023 Netgate has moved the free tier, the new features and the roadmap behind the Plus subscription and Nexus.
Scores
Source: Firewall and Router Ledger 2026, edition 2026-10-16. How each score works: methodology.
Pros
- VPN and remote access4/5
- Network services4/5
Cons
No domain scores 2.5 or lower out of 5. Check the lock-in and buying notes below.
What the Ledger says
pfSense remains a complete firewall with the deepest pool of administrators, and its capability line keeps pace with OPNsense on VPN, DHCP and observability. What separates the two is the commercial record: the free Plus licence for home use vanished and came back as a 129 USD subscription within four days in October 2023, the Community Edition then went 17 months without a release, and since 2025 the newest features (Nexus, Snort 3, CoreDNS, the Go GUI) ship only through Nexus on Plus. The Portfolio-led label reflects that five of sixteen direction items serve the subscription rather than a user request. A buyer should settle which edition they are buying and read the 26.07 note that the new GUI may not run on VMs and some third-party platforms before standardising on a virtual deployment.
pfSense uses no AI in detection, operations or the console; Snort, Suricata and list-based blocking do the work. Agents can drive a single instance only through the community pfREST package, and the vendor API arrived in 2025 inside Nexus for Plus customers.
Capability by area
Buying, lock-in and release record
Buying and licence (commercial risk)(lower is better)
- Price and licence volatility3.5
- Free Home+Lab licence withdrawn on 2023-10-26, TAC Lite at 129 USD added on 2023-10-30; list prices unchanged since then; Nexus added a per-device metric in 2025
- Purchase constraints3
- Plus on own hardware or a VM needs a subscription of at least 129 USD per year per instance; Nexus per managed device; CE remains free
- Channel and access3
- Plus installs through the Netgate Installer with a subscription; Plus patches need a current TAC subscription; Home+Lab installs without one got no updates; CE download is open
- Owner stability1.5
- Private company with a long record; owner details not published; no acquisition found
- Cost of staying supported3
- Plus updates stop without a subscription; new features land in Plus and Nexus first; CE users are encouraged to move to Plus
Technical lock-in(lower is better)
- Formats1.5
- One XML configuration file with encrypted export and free AutoConfigBackup to Netgate's cloud; Plus is closed source
- Export path2
- No vendor converter; moving to OPNsense or another firewall means a rebuild, with community guides only
- Stack coupling0.5
- Runs alone; Nexus is optional today but hosts the new GUI and the newest features
- Hardware / cloud coupling1
- Any x86-64 machine; ARM only on Netgate appliances; Plus tied to the Netgate Installer and subscription; works offline
- Skills and tooling coupling1
- FreeBSD and pf skills with the largest admin pool among software firewalls; no official single-instance API
Release credibility
- Cadence3
- Plus about two majors a year with dates on the versions page; CE irregular, 17 months between 2.7.2 and 2.8.0; 26.10 listed as TBD
- Roadmap transparency2
- No public roadmap; direction appears in release blogs; next version date TBD; Plus source closed
- Say-do3
- Nexus, Snort 3 and Kea HA shipped as announced; the CE 2.8 promise was kept late; the Go GUI is stated direction without a date
- Velocity3.5
- Plus gained Nexus, Kea HA, NAT64, pflow and post-quantum SSH within three years; CE receives them later or not at all
- Lifecycle stability2
- Free Home+Lab withdrawn and repriced within four days in October 2023; a GUI rewrite that may not run on VMs; no published support windows
Partners and services
- Partner programme openness2.5
- Resellers and marketplaces exist; partner programme terms not found on netgate.com; Netgate sells direct
- Multi-tenancy and self-service2.5
- Nexus manages many instances with a REST API; early users report no shared objects across instances; no tenancy or portal
- API and infrastructure-as-code2.5
- Nexus REST API for Plus; single instances rely on the community pfREST package; Terraform and Ansible community only
- Skills and certification3
- Netgate training offers and a large pool of experienced administrators; certification track not verified
Alternatives to pfSense
Questions about pfSense
Is pfSense any good?
pfSense ranks #9 of 18 firewall and router platforms in the Firewall and Router Ledger 2026, with a Ledger Index of 55.9 out of 100. Its strongest areas are vpn and remote access, network services.
What are the best alternatives to pfSense?
The closest by Ledger Index are Barracuda CloudGen (54.2), Sophos Firewall (58), Juniper vSRX (58.1), MikroTik RouterOS (53.1).
How is pfSense licensed and sold?
Free Home+Lab licence withdrawn on 2023-10-26, TAC Lite at 129 USD added on 2023-10-30; list prices unchanged since then; Nexus added a per-device metric in 2025.
How much lock-in does pfSense bring?
pfSense scores 6 out of 25 on technical lock-in (lower is better). Export path: No vendor converter; moving to OPNsense or another firewall means a rebuild, with community guides only.
User reviews of pfSense
No reviews yet
Be the first to say how pfSense worked for you.
Write a review
No account needed and no email asked. We read every review before it appears and remove adverts, spam and personal attacks.