Firewall and Router Ledger Methodology: How Every Score Is Built

Part of the Firewall and Router Ledger (edition 2026-10-16). The results are in the overview and the platform reports. The Ledger uses the same method as the VM Platform Ledger; this page covers what is specific to firewalls and routers.

Who this is for

Two audiences share this Ledger. Homelab and small-office readers choose a firewall to run on a mini PC or as a virtual machine under Proxmox VE, and want to know what the free editions include and how long they stay patched. Data centre and enterprise teams choose a virtual appliance for a site edge, a branch fleet or a cloud VPC, and want the routing depth, throughput, central management and security record. The buyer lenses on the interactive page re-weight the domains for each. No vendor was briefed on, paid for or reviewed any score.

What is in scope

A platform is included when it shipped a release in the last 12 months, has public documentation or release notes, is available outside one country as software or a virtual edition, and offers a stateful firewall, NAT, at least one site-to-site VPN, dynamic routing (OSPF or BGP) natively or as a supported package, and a documented configuration backup and restore.

Products sold only with the vendor's own hardware are out, however popular: Ubiquiti UniFi gateways, TP-Link Omada gateways and Firewalla (whose software-only build is still a beta). NethSecurity lacks dynamic routing and is out. Zenarmor is a plug-in for OPNsense and is noted there rather than scored. Switch operating systems (SONiC, Cumulus), load balancers and VPN services are a different category.

Products, community projects and routers

Deciso (OPNsense), Netgate (pfSense), VyOS Networks, MikroTik, Fortinet, Palo Alto Networks, Check Point, Cisco, Juniper, Sophos, WatchGuard, SonicWall, Barracuda, Forcepoint and Arista sell a product and carry a commercial risk score. OpenWrt and IPFire are community projects that nobody sells, so they carry a sustainability risk score instead: maintainer concentration, backer health, licence-change risk, abandonment signs and security response. VyOS, MikroTik RouterOS and Netgate TNSR are router operating systems first and firewalls second; they are scored on the same domains and grouped separately on the interactive page.

Capability: ten domains, scored since 2015

Domain	Weight	What a 3 (solid) means	What a 5 (reference) means
Routing and WAN	12	Static routes, OSPF or BGP, multi-WAN failover, policy routing, IPv6 routing	Full BGP and OSPF with route policies, VRFs, SD-WAN style path selection with health probes, MPLS or segment routing, EVPN or VXLAN
Firewall and NAT core	12	Stateful rules with aliases and schedules, NAT including 1:1 and port forwards, IPv6 parity for the main features, rule logging	Layer 7 application identification, user and identity based rules, policy objects shared across devices, rule hit counters and analysis, consistent IPv6 parity
VPN and remote access	12	WireGuard or IPsec and OpenVPN for site-to-site and remote users, certificate management	All of WireGuard, IPsec with IKEv2 and OpenVPN, an SSL VPN or ZTNA client, MFA integration, route-based VPN, dynamic mesh
Threat protection	12	IDS/IPS with signature updates, DNS or web filtering	Inline IPS with vendor threat intelligence, TLS inspection, sandboxing or file analysis, botnet and geo feeds, documented false-positive handling
Network services	8	DHCP, a DNS resolver with blocklists, NTP, captive portal, dynamic DNS	RADIUS, 802.1X, DHCP failover, DNS over TLS or HTTPS, a captive portal with vouchers, multiple instances
Platform and hypervisor freedom	10	Installs on common x86 hardware, documented as a VM on at least two hypervisors, paravirtual drivers	Any x86 and ARM, documented on Proxmox VE, VMware, Hyper-V, XCP-ng and KVM, cloud images on AWS, Azure and GCP, hardware acceleration
High availability and performance	8	Active-passive failover (CARP or VRRP) with state sync, multi-gigabit throughput with IPS off	Active-active or clustering, 10G to 100G documented throughput with IPS on, QoS with queues, failover under a second
Management, API and automation	10	Web UI, CLI, configuration backup and restore, a REST or RPC API covering the main objects	A complete REST API, Terraform and Ansible content maintained by the vendor or a known partner, central multi-site management, templates, zero-touch provisioning
Observability	6	Traffic graphs, NetFlow or IPFIX export, syslog, SNMP	Built-in flow analytics and reporting, long-term logging, alerting, integrations with Grafana, Zabbix or a SIEM, packet capture in the UI
Platform security and lifecycle	10	Signed updates, published advisories, release notes per update, a support window of at least a year	Secure boot, reproducible or audited builds, CVE response within days, no entries on the CISA KEV catalogue since 2023, long-term support branches, in-place major upgrades

Each domain is scored 0 to 5 at the end of 2015, 2019 and 2022 and today, against the same anchors every year. Only generally available capability counts; previews count half a step at most. A platform that did not exist in 2015 starts its line in its first release year.

The security record

For every entry on the CISA Known Exploited Vulnerabilities catalogue added in 2023 to 2026 that concerns the platform's own firewall software, today's platform security score is lowered by 0.5, up to 1.5. Flaws in a separate management product are named in the report but not deducted. The catalogue was read on 2026-10-15. The open-source platforms and several smaller vendors have no entries; the large enterprise vendors carry the full deduction, and each report lists the CVE ids and the dates they were added.

The other dimensions

Credibility (out of 25): release cadence, roadmap transparency, the say-do record (what was announced in 2023 to 2026 and whether it shipped), velocity and lifecycle stability. Licence reversals and gaps between releases count against stability.
Commercial risk (out of 25, lower is better): price and licence changes since 2023 (pfSense Plus Home+Lab, VyOS LTS image access, credit-based licensing on virtual appliances), purchase constraints, channel access, owner stability (HPE's purchase of Juniper, DataCore and others) and the cost of staying supported.
Sustainability risk (out of 25, lower is better): used instead for OpenWrt and IPFire.
Technical lock-in (out of 25, lower is better): configuration format and export, migration paths to and from other firewalls, coupling to the vendor's hardware or cloud, and skills.
Integrator fit (out of 20): partner programme, multi-tenancy and central management for MSPs, API and infrastructure-as-code depth, skills and certification.
AI leverage (out of 20): AI in threat detection, bundled AI platforms, AI assistants in the console, and official agent interfaces such as MCP servers. Only GA counts.

The Ledger Index

A single number out of 100: capability 35, credibility 20, buyer safety 20, AI leverage 10, integrator fit 10 and momentum 5 (capability gained since the end of 2022). Buyer safety is one minus the sum of commercial (or sustainability) risk and lock-in, divided by 50. The Index is shown only from 2023.

Evidence and calibration

Every score comes from the public record: release notes, documentation, licence and pricing pages, lifecycle pages, security advisories and the CISA catalogue. Reports carry an evidence grade (A primary sources, B secondary, C inferred) and end with open questions. Arista's release history and Forcepoint's release-note PDFs could not be read, so those two reports carry lower grades. Corrections are welcome from anyone, vendors included, with a public source, and are logged in the next edition. The Ledger is refreshed twice a year, in March and October.