pfSense: Firewall and Router Ledger 2026 Scorecard
pfSense has the largest installed base and a complete feature set, but since 2023 Netgate has moved the free tier, the new features and the roadmap behind the Plus subscription and Nexus.
Each square is one capability area in one year. The brighter it is, the more the area gained in the Firewall and Router Ledger that year; 1, 2 and 3 mark that year's biggest pushes.
’16
’17
’18
’19
’20
’21
’22
’23
’24
’25
’26
Routing and WAN
2
1
2
Firewall and NAT core
2
VPN and remote access
1
1
Threat protection
1
1
Network services
2
Platform and hypervisor freedom
2
1
High availability and performance
3
Management, API and automation
1
Observability
Platform security and lifecycle
3
no change+0.5+1+1.5 or moreScores out of 5 per area.
Biggest pushes overall: Routing and WAN (+1.5), Threat protection (+1.5), VPN and remote access (+1). Already strong in 2015: Firewall and NAT core, VPN and remote access, Network services.
Top focus each year: 2017 VPN and remote access; 2019 Threat protection; 2022 Platform and hypervisor freedom; 2023 VPN and remote access; 2024 Routing and WAN; 2025 Management, API and automation; 2026 Threat protection. 4 of 11 years show no gain in any area.
Engine: FreeBSD with pf, strongSwan, OpenVPN, Unbound and Kea; FRR, Suricata, Snort and pfBlockerNG as packages
Licence: pfSense CE: open source, free, community support only (licence name not read in this pass). pfSense Plus: closed source under a EULA; TAC Lite 129 USD, TAC Pro 399 USD, TAC Enterprise 799 USD per instance per year; TAC Lite free on Netgate appliances; AWS and Azure 0.08 to 0.40 USD per hour; Netgate Nexus priced per managed device (price not published)
Latest release: pfSense Plus 26.07 (2026-08-13); pfSense CE 2.9.0 (2026-08-20); before that Plus 26.03 (2026-04-01) and 25.11 (2025-12-11)
Support lifecycle: No end-of-life dates published for either edition; Plus ships about two majors a year; CE went 17 months between 2.7.2 (2023-12-07) and 2.8.0 (2025-05-28); in-place upgrades; CE to Plus by TAC purchase; no LTS
Next milestone: pfSense Plus 26.10, date TBD; a Go-based GUI delivered through Nexus is the stated direction (2026-08-13)
Security record: 0 entries on the CISA KEV catalogue for 2023 to 2026 (feed of 2026-10-15); no deduction. Netgate publishes pfSense-SA advisories; 26.07 cites SA-26_06 to SA-26_21, mostly cross-site scripting and command execution through CR and LF characters, plus the WireGuard fix for CVE-2026-58085
Hypervisors: Guides for Proxmox VE, VMware ESXi and Hyper-V; KVM and Xen named; VirtualBox and Workstation for testing only; AWS and Azure marketplace images for Plus; no XCP-ng or Google Cloud page; x86-64 for both editions, ARM only on Netgate appliances; the 26.07 notes say VMs and some third-party platforms may not support the new GUI
Tier: Open-source platform
Archetype: Portfolio-led builder
Evidence grade: A. The versions page, the release notes for 2.4.0, 2.5.0, 2.7.0, 2.8.0, 2.9.0, 23.05, 24.03, 24.11, 25.11, 26.03 and 26.07, the pricing and software-types pages, the 2022 press release, the two October 2023 blog posts and the virtualisation index were read from Netgate sources; the CISA KEV feed was queried on 2026-10-15. The CE licence text, the Nexus price, Netgate ownership and the partner programme were not read. The threat protection step dated 2019 rests on the dossier's draft rather than a release note.
Scope of the scores: The scores cover pfSense CE and pfSense Plus together. Where a capability exists only in Plus or only through Netgate Nexus, the step says so; Nexus is licensed per managed device on top of a Plus subscription.
2.4: ARM (SG-1000), UEFI and ZFS installer, 32-bit removed
2017
VPN and remote access
3 → 3.5
+1.2
2.4: OpenVPN 2.4 with AES-GCM, strongSwan 5.6
2019
Routing and WAN
2 → 2.5
+1.2
FRR package with BGP and OSPF (package date not read; dated by the dossier draft, grade C for the year)
2019
Threat protection
2 → 3
+2.4
Suricata and Snort packages with inline IPS mode and pfBlockerNG-devel feeds (dated by the dossier draft, not a release note; grade C for the year)
2022
Platform and hypervisor freedom
2.5 → 3
+1.0
22.01: Plus available on third-party hardware and VMs; guides for Proxmox VE, VMware, Hyper-V and KVM; AWS and Azure marketplace; ARM only on Netgate hardware, no hardware acceleration outside Plus QAT
2023
High availability and performance
3 → 3.5
+0.8
23.05: unicast CARP and multi-buffer crypto for IPsec; Intel QAT in Plus since 21.02; Kea DHCP HA in 24.11; active-passive only
2023
Network services
3 → 3.5
+0.8
2.7.0: captive portal moved from IPFW to pf
2023
Observability
2 → 2.5
+0.6
23.05: packet capture GUI
2023
VPN and remote access
3.5 → 4
+1.2
23.05: WireGuard installed by default on new installs; IPsec on swanctl (2.5.0); ChaCha20-Poly1305 and removal of 3DES and MD5 (2.7.0); strongSwan 6.0.3 (25.11); the Nexus zero trust VPN is a vendor claim
2024
Firewall and NAT core
3 → 3.5
+1.2
24.03: interface-bound default state policy; Ethernet layer 2 rules since 23.05; endpoint-independent NAT experimental in 25.11; no layer 7 identification
2024
Network services
3.5 → 4
+0.8
24.11: Kea DHCP high availability for DHCPv4 and DHCPv6, NTP authentication; CoreDNS in 26.07 is Nexus only
2024
Observability
2.5 → 3
+0.6
24.03: pflow NetFlow and IPFIX export; ntopng as a package
2024
Platform security and lifecycle
2.5 → 3
+1.0
24.03: Boot Environments 2.0 for rollback; 26.03 post-quantum SSH key exchange, certificate auto-renewal and the System Patches package by default; 0 CISA KEV entries 2023 to 2026, so no deduction; no LTS, no Secure Boot, CE waited 17 months for 2.8.0
2024
Routing and WAN
2.5 → 3
+1.2
24.03: selective state kill on gateway recovery
2025
Management, API and automation
2 → 3
+2.0
25.07: Netgate Nexus multi-instance manager with a REST API, Plus only and per managed device; no official single-instance REST API (the community pfREST package fills the gap); no vendor Terraform or Ansible content
2025
Routing and WAN
3 → 3.5
+1.2
2.8.0 and 25.07: NAT64 and PREF64; 25.11 VXLAN interfaces return; no VRF, MPLS or probe-based path selection beyond gateway groups
2026
Threat protection
3 → 3.5
+1.2
26.07: Snort 3 and the ThreatGate bulk list manager, available only in the Nexus GUI; no TLS inspection, no vendor threat intelligence
Direction, 2023 to 2026
Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).
Date
Item
Theme
Driver
2023-05
Plus 23.05: WireGuard default on new installs, packet capture GUI
Plus about two majors a year with dates on the versions page; CE irregular, 17 months between 2.7.2 and 2.8.0; 26.10 listed as TBD
Roadmap transparency
2
No public roadmap; direction appears in release blogs; next version date TBD; Plus source closed
Say-do
3
Nexus, Snort 3 and Kea HA shipped as announced; the CE 2.8 promise was kept late; the Go GUI is stated direction without a date
Velocity
3.5
Plus gained Nexus, Kea HA, NAT64, pflow and post-quantum SSH within three years; CE receives them later or not at all
Lifecycle stability
2
Free Home+Lab withdrawn and repriced within four days in October 2023; a GUI rewrite that may not run on VMs; no published support windows
Commercial risk: 14.0 / 25 (lower is better)
Criterion
Score
Basis
Price and licence volatility
3.5
Free Home+Lab licence withdrawn on 2023-10-26, TAC Lite at 129 USD added on 2023-10-30; list prices unchanged since then; Nexus added a per-device metric in 2025
Purchase constraints
3
Plus on own hardware or a VM needs a subscription of at least 129 USD per year per instance; Nexus per managed device; CE remains free
Channel and access
3
Plus installs through the Netgate Installer with a subscription; Plus patches need a current TAC subscription; Home+Lab installs without one got no updates; CE download is open
Owner stability
1.5
Private company with a long record; owner details not published; no acquisition found
Cost of staying supported
3
Plus updates stop without a subscription; new features land in Plus and Nexus first; CE users are encouraged to move to Plus
Technical lock-in: 6.0 / 25 (lower is better)
Criterion
Score
Basis
Formats
1.5
One XML configuration file with encrypted export and free AutoConfigBackup to Netgate's cloud; Plus is closed source
Export path
2
No vendor converter; moving to OPNsense or another firewall means a rebuild, with community guides only
Stack coupling
0.5
Runs alone; Nexus is optional today but hosts the new GUI and the newest features
Hardware / cloud coupling
1
Any x86-64 machine; ARM only on Netgate appliances; Plus tied to the Netgate Installer and subscription; works offline
Skills and tooling coupling
1
FreeBSD and pf skills with the largest admin pool among software firewalls; no official single-instance API
Integrator fit: 10.5 / 20
Criterion
Score
Basis
Partner programme openness
2.5
Resellers and marketplaces exist; partner programme terms not found on netgate.com; Netgate sells direct
Multi-tenancy and self-service
2.5
Nexus manages many instances with a REST API; early users report no shared objects across instances; no tenancy or portal
API and infrastructure-as-code
2.5
Nexus REST API for Plus; single instances rely on the community pfREST package; Terraform and Ansible community only
Skills and certification
3
Netgate training offers and a large pool of experienced administrators; certification track not verified
AI leverage: 1.5 / 20
How the product uses AI, scored per year like capability. Only GA counts.
Criterion
2019
2022
Today
Latest step
AI in threat detection
0
0
0
2015: None
AI platform stack
0
0
0
2015: None
AI-assisted operations
0
0
0
2015: None
Agent openness
1
1
1.5
2025: 25.07: Nexus REST API for Plus instances; community MCP servers (night4me, gensecaihq, abl030) run on the community pfREST package; no official MCP server
AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. No AI item was announced by Netgate between 2023 and 2026; the 26.07 release blog does not mention AI.
pfSense uses no AI in detection, operations or the console; Snort, Suricata and list-based blocking do the work. Agents can drive a single instance only through the community pfREST package, and the vendor API arrived in 2025 inside Nexus for Plus customers.
Reading
pfSense remains a complete firewall with the deepest pool of administrators, and its capability line keeps pace with OPNsense on VPN, DHCP and observability. What separates the two is the commercial record: the free Plus licence for home use vanished and came back as a 129 USD subscription within four days in October 2023, the Community Edition then went 17 months without a release, and since 2025 the newest features (Nexus, Snort 3, CoreDNS, the Go GUI) ship only through Nexus on Plus. The Portfolio-led label reflects that five of sixteen direction items serve the subscription rather than a user request. A buyer should settle which edition they are buying and read the 26.07 note that the new GUI may not run on VMs and some third-party platforms before standardising on a virtual deployment.
Open questions and items to re-score
The exact open-source licence of pfSense CE was not read from a Netgate page.
Netgate Nexus pricing per managed device and whether Nexus itself runs on VMs were not found.
The 2019 threat protection step (inline IPS mode in the Suricata and Snort packages) rests on the dossier draft, not a release note.
Kernel WireGuard in 2.5.0 and its removal from CE in 2.5.1 come from community reports and were not verified.
XCP-ng and Google Cloud support: no documentation page found.
Netgate ownership and the partner programme terms were not found.
