Firewall and Router Ledger 2026: 18 Platforms Scored
Firewall and router platforms for homelabs, small offices and data centres scored on routing, firewall core, VPN, threat protection, hypervisor freedom, management and security record since 2015, plus credibility, risk and lock-in, from public records only.
Where the field put its effort, 2016 to 2026
Each square is one capability area in one year, with the score gains of all 18 firewall and router platforms added up. The brighter it is, the more the field moved there; 1, 2 and 3 mark that year's biggest pushes.
| ’16 | ’17 | ’18 | ’19 | ’20 | ’21 | ’22 | ’23 | ’24 | ’25 | ’26 | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Routing and WAN | 1 | 2 | 2 | 1 | 3 | ||||||
| Firewall and NAT core | 3 | 2 | 3 | 1 | 3 | ||||||
| VPN and remote access | 3 | 1 | 1 | ||||||||
| Threat protection | 1 | 3 | 2 | 2 | 1 | ||||||
| Network services | 2 | ||||||||||
| Platform and hypervisor freedom | 1 | 3 | 1 | 2 | 3 | 3 | 1 | 3 | |||
| High availability and performance | 3 | 2 | |||||||||
| Management, API and automation | 1 | 2 | 2 | ||||||||
| Observability | 2 | ||||||||||
| Platform security and lifecycle |
Biggest pushes overall: Threat protection (+19.5), Platform and hypervisor freedom (+19.5), Routing and WAN (+18.5).
Top focus each year: 2016 Threat protection; 2017 Platform and hypervisor freedom; 2018 Routing and WAN; 2019 Platform and hypervisor freedom; 2020 Management, API and automation; 2021 VPN and remote access; 2022 Routing and WAN; 2023 VPN and remote access; 2024 Firewall and NAT core; 2025 Platform and hypervisor freedom; 2026 Threat protection.
Reports in this series
How the Firewall and Router Ledger scores OPNsense, pfSense, VyOS, OpenWrt, MikroTik, FortiGate, Palo Alto, Check Point and the rest: fixed anchors, a security record and public evidence only.
Barracuda CloudGen Firewall keeps a clean KEV record and a deep SD-WAN and VPN stack, with thin public pricing and lifecycle data under a private-equity owner.
Check Point's gateway pairs reference-grade policy management with four-year support windows, but its hypervisor list is unpublished and two gateway flaws sit on the KEV catalogue.
Cisco's virtual firewall has the broadest hypervisor list after Fortinet and the first ML detection in Snort, behind a mandatory management centre and nine ASA/FTD KEV entries.
Forcepoint's Stonesoft-derived firewall keeps a clean KEV record and strong clustering, under three renames since 7.0 and the thinnest public evidence in this group.
FortiOS ships the widest feature set and platform list in its group, and carries seven FortiOS entries on the CISA KEV catalogue since 2023.
IPFire is a free zone-based firewall with inline Suricata IPS and a steady update rhythm, but no high availability, API or official hypervisor list.
Junos gives vSRX the strongest routing in its group and an open-source MCP server, under HPE since July 2025 and with three J-Web flaws on the KEV catalogue.
TNSR is a VPP router with BGP, OSPF and IPsec at line rate on commodity x86, a stateful firewall since 2025 and no threat, web or captive portal layer.
Arista NG Firewall keeps Untangle's app-based UTM depth and reporting, with VMware as the only documented hypervisor and few public release dates.
OpenWrt is the free router firmware behind more than 1,790 devices and several firewall products, strong on platform reach and weak on HA, with short support windows.
OPNsense ships two majors a year on dates fixed since 2015, keeps every feature free and carries no CISA KEV entry, while ARM and central management stay thin.
PAN-OS remains the reference for application and identity policy, sold only through credits, with nine PAN-OS entries on the CISA KEV catalogue since 2024.
pfSense has the largest installed base and a complete feature set, but since 2023 Netgate has moved the free tier, the new features and the roadmap behind the Plus subscription and Nexus.
RouterOS gives deep routing and perpetual low-cost licences on any x86 VM, with no threat engine and three KEV entries in September 2026.
SonicOS 8 brought NSv to Proxmox VE with vCPU-sized subscriptions, while forced generation migrations, two SSL VPN flaws on the KEV catalogue and the 2025 cloud backup incident weigh on trust.
Sophos Firewall pairs a deep threat stack and a free Home edition with short maintenance windows and two KEV entries added in 2025 for old CVE-2020 flaws.
VyOS is the routing-first network OS of this group, with BGP, VRF, MPLS and a VPP dataplane, but its LTS images and early security fixes are reserved for subscribers.
WatchGuard's virtual Firebox is a complete small-office UTM on four hypervisors, with two KEV entries in late 2025 and no published support window per Fireware version.
Part of the Firewall and Router Ledger (edition 2026-10-16). How the scores work: methodology.
Enterprise virtual appliances, open-source platforms and router operating systems share one table, and the two audiences read it through different lenses: the homelab lens weights hypervisor freedom, VPN and network services, the data centre lens weights threat protection, high availability and central management. FortiGate and Palo Alto lead on capability; OPNsense sits second on the balanced index because its commercial risk and lock-in are the lowest in the field. Several enterprise vendors show negative momentum since 2022: their platform security score carries a deduction for each of their own entries on the CISA Known Exploited Vulnerabilities catalogue since 2023, named in each report.
| Fortinet FortiGate-VM (FortiOS) | OPNsense (Deciso, Community and Business editions) | Palo Alto Networks VM-Series (PAN-OS) | Check Point CloudGuard Network Security (Quantum Gaia) | Cisco Secure Firewall Threat Defense Virtual (and ASAv) | VyOS (VyOS Networks: LTS, Stream and rolling) | Juniper vSRX (Junos OS) | Sophos Firewall (virtual, software and Home edition) | pfSense (Netgate: pfSense CE and pfSense Plus) | Barracuda CloudGen Firewall (Vx and public cloud) | MikroTik RouterOS (x86 licences and Cloud Hosted Router) | SonicWall NSv (SonicOS) | WatchGuard FireboxV and Firebox Cloud (Fireware OS) | OpenWrt (community project, Software Freedom Conservancy) | Netgate TNSR | IPFire | Forcepoint Network Security Platform (formerly Forcepoint NGFW) | Arista NG Firewall (formerly Untangle NG Firewall) | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Capability today /100 | 84.8 | 70.0 | 84.0 | 77.6 | 81.0 | 66.0 | 75.6 | 73.4 | 68.4 | 75.0 | 57.6 | 70.4 | 68.0 | 56.6 | 61.2 | 56.2 | 70.6 | 63.4 |
| Capability 2015 | 68.8 | 43.2 | 69.0 | 67.0 | 61.2 | 45.8 | 66.2 | 59.2 | 49.0 | 61.8 | 56.2 | 54.8 | 58.4 | 47.0 | n/a | 48.4 | 65.0 | 57.2 |
| Capability 2022 | 86.8 | 62.6 | 84.0 | 78.6 | 78.2 | 54.4 | 78.6 | 73.2 | 55.8 | 71.8 | 60.6 | 71.4 | 67.8 | 55.6 | 57.2 | 53.8 | 70.6 | 63.4 |
| Momentum since 2022 | -2.0 | +7.4 | +0.0 | -1.0 | +2.8 | +11.6 | -3.0 | +0.2 | +12.6 | +3.2 | -3.0 | -1.0 | +0.2 | +1.0 | +4.0 | +2.4 | +0.0 | +0.0 |
| Credibility /25 | 17.0 | 19.5 | 17.0 | 16.0 | 15.0 | 17.0 | 15.5 | 15.5 | 13.5 | 14.5 | 16.0 | 14.5 | 14.5 | 15.0 | 13.0 | 15.5 | 11.5 | 11.0 |
| Commercial risk /25 (lower better) | 11.0 | 4.5 | 13.5 | 13.0 | 13.5 | 14.5 | 15.0 | 11.5 | 14.0 | 14.5 | 4.5 | 16.0 | 14.5 | 7.5 | 13.5 | 10.0 | 16.0 | 12.0 |
| Technical lock-in /25 (lower better) | 12.5 | 4.0 | 13.0 | 15.0 | 14.0 | 4.0 | 12.0 | 12.0 | 6.0 | 13.5 | 11.5 | 13.5 | 13.0 | 2.5 | 9.0 | 6.5 | 15.5 | 9.5 |
| Integrator fit /20 | 16.5 | 10.0 | 17.0 | 17.0 | 16.0 | 12.0 | 15.0 | 13.5 | 10.5 | 12.0 | 11.5 | 13.0 | 12.5 | 6.0 | 7.5 | 3.5 | 10.5 | 7.5 |
| AI leverage /20 | 8.5 | 2.0 | 5.0 | 9.5 | 5.5 | 2.0 | 5.0 | 5.0 | 1.5 | 1.5 | 1.5 | 3.5 | 3.5 | 1.5 | 2.0 | 0.5 | 1.5 | 0.5 |
| Ledger Index /100 | 66.4 | 64.6 | 63.4 | 62.0 | 60.8 | 59.2 | 58.1 | 58.0 | 55.9 | 54.2 | 53.1 | 52.7 | 52.5 | 51.8 | 48.6 | 48.1 | 47.3 | 46.4 |
| Idea-to-need index | 0.55 | 0.00 | 0.25 | 0.27 | 0.27 | 0.29 | 0.25 | 0.29 | 0.11 | 0.00 | 0.14 | 0.00 | 0.00 | 0.25 | 0.00 | 0.14 | 0.00 | 0.00 |
| Archetype | Real innovator with a long KEV record | Dependable builder | Dependable builder under exploitation pressure | Dependable builder with an AI push | Dependable builder, slowed by renames | Dependable builder | Dependable builder under a new owner | Dependable builder | Portfolio-led builder | Steady maintainer | Dependable builder | Follower with lifecycle churn | Steady maintainer | Dependable builder | Narrow specialist | Dependable builder | Portfolio reshuffle | Slow follower |
n/a: the product did not exist yet that year, or the score does not apply (an open-source engine has nothing to buy, so it has no commercial risk score).
Capability by domain today
| Domain | Fortinet FortiGate-VM (FortiOS) | OPNsense (Deciso, Community and Business editions) | Palo Alto Networks VM-Series (PAN-OS) | Check Point CloudGuard Network Security (Quantum Gaia) | Cisco Secure Firewall Threat Defense Virtual (and ASAv) | VyOS (VyOS Networks: LTS, Stream and rolling) | Juniper vSRX (Junos OS) | Sophos Firewall (virtual, software and Home edition) | pfSense (Netgate: pfSense CE and pfSense Plus) | Barracuda CloudGen Firewall (Vx and public cloud) | MikroTik RouterOS (x86 licences and Cloud Hosted Router) | SonicWall NSv (SonicOS) | WatchGuard FireboxV and Firebox Cloud (Fireware OS) | OpenWrt (community project, Software Freedom Conservancy) | Netgate TNSR | IPFire | Forcepoint Network Security Platform (formerly Forcepoint NGFW) | Arista NG Firewall (formerly Untangle NG Firewall) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Routing and WAN | 4.5 | 3.5 | 4 | 3.5 | 4 | 4.5 | 4.5 | 3.5 | 3.5 | 4 | 4 | 3 | 3 | 3 | 4 | 2.5 | 3.5 | 3 |
| Firewall and NAT core | 4.5 | 3.5 | 5 | 4.5 | 4.5 | 3.5 | 4 | 4 | 3.5 | 4 | 3.5 | 4 | 3.5 | 3.5 | 3 | 3 | 4 | 3.5 |
| VPN and remote access | 4.5 | 4 | 4.5 | 4 | 4.5 | 4 | 4 | 4 | 4 | 4 | 3.5 | 4 | 4 | 3 | 3 | 3.5 | 3.5 | 3.5 |
| Threat protection | 5 | 3.5 | 5 | 5 | 5 | 0.5 | 4 | 4.5 | 3.5 | 4 | 0.5 | 4 | 4 | 1.5 | 2 | 3.5 | 4 | 4 |
| Network services | 4 | 4 | 3.5 | 3 | 3 | 3 | 3 | 3.5 | 4 | 3 | 3.5 | 3.5 | 3.5 | 3.5 | 2.5 | 3.5 | 2.5 | 3.5 |
| Platform and hypervisor freedom | 4.5 | 3 | 4.5 | 3 | 4 | 4 | 3.5 | 3.5 | 3 | 3.5 | 3.5 | 3.5 | 3.5 | 3.5 | 3.5 | 3 | 3 | 2.5 |
| High availability and performance | 4.5 | 3.5 | 4.5 | 4.5 | 4.5 | 3.5 | 4 | 3.5 | 3.5 | 3.5 | 3 | 3.5 | 3 | 2 | 4 | 1 | 4 | 1.5 |
| Management, API and automation | 4.5 | 3.5 | 4.5 | 4.5 | 4.5 | 3.5 | 4.5 | 4 | 3 | 4 | 3.5 | 4 | 3.5 | 3 | 3 | 2 | 4 | 3.5 |
| Observability | 4 | 3.5 | 4 | 4 | 4 | 3 | 4 | 4 | 3 | 3.5 | 3 | 3.5 | 4 | 2 | 2.5 | 2.5 | 3.5 | 4 |
| Platform security and lifecycle | 2 | 3 | 2 | 2.5 | 2 | 3.5 | 2 | 2 | 3 | 3.5 | 1 | 2 | 2 | 3 | 3 | 3 | 3 | 2.5 |
Capability by year
| Year | Fortinet FortiGate-VM (FortiOS) | OPNsense (Deciso, Community and Business editions) | Palo Alto Networks VM-Series (PAN-OS) | Check Point CloudGuard Network Security (Quantum Gaia) | Cisco Secure Firewall Threat Defense Virtual (and ASAv) | VyOS (VyOS Networks: LTS, Stream and rolling) | Juniper vSRX (Junos OS) | Sophos Firewall (virtual, software and Home edition) | pfSense (Netgate: pfSense CE and pfSense Plus) | Barracuda CloudGen Firewall (Vx and public cloud) | MikroTik RouterOS (x86 licences and Cloud Hosted Router) | SonicWall NSv (SonicOS) | WatchGuard FireboxV and Firebox Cloud (Fireware OS) | OpenWrt (community project, Software Freedom Conservancy) | Netgate TNSR | IPFire | Forcepoint Network Security Platform (formerly Forcepoint NGFW) | Arista NG Firewall (formerly Untangle NG Firewall) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2015 | 68.8 | 43.2 | 69.0 | 67.0 | 61.2 | 45.8 | 66.2 | 59.2 | 49.0 | 61.8 | 56.2 | 54.8 | 58.4 | 47.0 | n/a | 48.4 | 65.0 | 57.2 |
| 2016 | 69.4 | 45.6 | 69.0 | 67.0 | 67.6 | 45.8 | 66.2 | 59.2 | 49.0 | 61.8 | 57.2 | 54.8 | 58.4 | 47.0 | n/a | 48.4 | 65.0 | 57.2 |
| 2017 | 69.4 | 47.8 | 71.0 | 74.0 | 67.6 | 45.8 | 68.6 | 61.6 | 51.2 | 61.8 | 57.2 | 54.8 | 58.4 | 47.8 | n/a | 48.4 | 65.0 | 58.2 |
| 2018 | 74.0 | 52.6 | 71.0 | 74.0 | 67.6 | 45.8 | 68.6 | 62.6 | 51.2 | 67.6 | 57.2 | 54.8 | 61.6 | 51.2 | 42.4 | 50.8 | 65.0 | 58.2 |
| 2019 | 80.6 | 54.8 | 77.0 | 74.0 | 69.6 | 51.2 | 75.0 | 63.8 | 54.8 | 67.6 | 57.2 | 64.6 | 66.6 | 51.2 | 46.8 | 52.8 | 68.4 | 59.2 |
| 2020 | 84.4 | 58.2 | 78.2 | 75.0 | 71.6 | 51.2 | 75.0 | 69.8 | 54.8 | 71.8 | 57.2 | 64.6 | 66.6 | 52.2 | 47.8 | 53.8 | 69.4 | 62.2 |
| 2021 | 85.6 | 62.6 | 81.8 | 75.0 | 71.6 | 54.4 | 76.6 | 71.0 | 54.8 | 71.8 | 60.6 | 71.4 | 67.8 | 53.2 | 50.2 | 53.8 | 69.4 | 62.2 |
| 2022 | 86.8 | 62.6 | 84.0 | 78.6 | 78.2 | 54.4 | 78.6 | 73.2 | 55.8 | 71.8 | 60.6 | 71.4 | 67.8 | 55.6 | 57.2 | 53.8 | 70.6 | 63.4 |
| 2023 | 84.8 | 64.6 | 86.2 | 78.6 | 80.6 | 55.4 | 75.6 | 73.2 | 59.2 | 71.8 | 60.6 | 71.4 | 67.8 | 55.6 | 57.2 | 53.8 | 70.6 | 63.4 |
| 2024 | 84.8 | 67.8 | 83.2 | 78.6 | 78.6 | 61.0 | 75.6 | 74.2 | 64.0 | 75.0 | 60.6 | 70.4 | 67.8 | 55.6 | 57.2 | 53.8 | 70.6 | 63.4 |
| 2025 | 84.8 | 68.8 | 84.0 | 78.6 | 81.0 | 62.6 | 75.6 | 72.2 | 67.2 | 75.0 | 60.6 | 69.4 | 66.8 | 56.6 | 59.6 | 55.0 | 70.6 | 63.4 |
| 2026 | 84.8 | 70.0 | 84.0 | 77.6 | 81.0 | 66.0 | 75.6 | 73.4 | 68.4 | 75.0 | 57.6 | 70.4 | 68.0 | 56.6 | 61.2 | 56.2 | 70.6 | 63.4 |
Driver mix, 2023 to 2026 (% of tagged items)
| Driver | Fortinet FortiGate-VM (FortiOS) | OPNsense (Deciso, Community and Business editions) | Palo Alto Networks VM-Series (PAN-OS) | Check Point CloudGuard Network Security (Quantum Gaia) | Cisco Secure Firewall Threat Defense Virtual (and ASAv) | VyOS (VyOS Networks: LTS, Stream and rolling) | Juniper vSRX (Junos OS) | Sophos Firewall (virtual, software and Home edition) | pfSense (Netgate: pfSense CE and pfSense Plus) | Barracuda CloudGen Firewall (Vx and public cloud) | MikroTik RouterOS (x86 licences and Cloud Hosted Router) | SonicWall NSv (SonicOS) | WatchGuard FireboxV and Firebox Cloud (Fireware OS) | OpenWrt (community project, Software Freedom Conservancy) | Netgate TNSR | IPFire | Forcepoint Network Security Platform (formerly Forcepoint NGFW) | Arista NG Firewall (formerly Untangle NG Firewall) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Vision | 46 | 0 | 21 | 27 | 27 | 24 | 13 | 25 | 6 | 0 | 14 | 0 | 0 | 22 | 0 | 11 | 0 | 0 |
| Customer need | 38 | 53 | 50 | 64 | 73 | 53 | 38 | 63 | 50 | 75 | 86 | 55 | 67 | 67 | 67 | 67 | 33 | 71 |
| Market window | 0 | 0 | 14 | 9 | 0 | 6 | 0 | 0 | 0 | 0 | 0 | 18 | 0 | 0 | 0 | 0 | 0 | 0 |
| Upstream | 8 | 40 | 0 | 0 | 0 | 6 | 25 | 0 | 19 | 13 | 0 | 0 | 0 | 11 | 33 | 22 | 17 | 29 |
| Portfolio | 8 | 7 | 14 | 0 | 0 | 12 | 25 | 13 | 25 | 13 | 0 | 27 | 33 | 0 | 0 | 0 | 50 | 0 |
Related reading
Download the data
Every score in this edition, free to reuse with a link back to this page.