Netgate TNSR: Firewall and Router Ledger 2026 Scorecard

Part of the Firewall and Router Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: product
Owner: Rubicon Communications, LLC, trading as Netgate (Austin, US; private); the same company owns pfSense
Engine: FD.io VPP dataplane with DPDK; FRRouting for dynamic routing, strongSwan for IPsec, Clixon for configuration, Snort for IDS and IPS; Ubuntu base since 21.11
Licence: Proprietary with open-source components; per-instance annual subscription with TAC support and no throughput or feature limits. 2020 list price USD 499 (TAC Pro) or USD 899 (TAC Enterprise) per instance per year; no current public price. Home+Lab free non-commercial edition launched 2020-09-10, current status unconfirmed
Latest release: 26.02 (2026-03-03); point releases 26.02.1 and 26.02.2 (dates not stated)
Support lifecycle: No published support or end-of-life policy; releases about every four months; upgrade path documented per release; no LTS branch
Next milestone: none published
Security record: 0 CISA KEV entries since 2023 (vendor Netgate absent from the catalogue). Advisories: https://www.netgate.com/security
Hypervisors: VMware ESXi (since 18.11); Proxmox VE and KVM/QEMU through a documented router-for-VMs recipe with vhost-user interfaces; a bare metal image for most x86 virtual environments; AWS and Azure Marketplace; Hyper-V, XCP-ng, GCP and ARM not found; Secure Boot must be disabled
Tier: Router operating system
Archetype: Narrow specialist
Evidence grade: B. The 26.02 release post and the 26.02.2 release notes, the releases index, the pricing page, the 2020 pricing press release, the Proxmox and KVM recipe and the KEV check were read from Netgate pages and the CISA catalogue. Release notes for 19.x to 25.x were not read, so the years of the firewall, WireGuard and IDS steps are estimates and are flagged. The platform page was read through a search summary only.

Scorecard

Dimension	Score	Direction
Capability today	61.2 / 100	higher is better
Momentum since end of 2022	+4.0 points (2018 to 2022: +14.8)	higher is better
Credibility	13.0 / 25	higher is better
Commercial risk	13.5 / 25	lower is better
Technical lock-in	9.0 / 25	lower is better
Integrator fit	7.5 / 20	higher is better
AI leverage	2.0 / 20	higher is better
Ledger Index	48.6 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Routing and WAN (12)	n/a	3.5	4	4
Firewall and NAT core (12)	n/a	2	2	3
VPN and remote access (12)	n/a	2	3	3
Threat protection (12)	n/a	0	2	2
Network services (8)	n/a	2.5	2.5	2.5
Platform and hypervisor freedom (10)	n/a	2.5	3.5	3.5
High availability and performance (8)	n/a	3	3	4
Management, API and automation (10)	n/a	3	3	3
Observability (6)	n/a	2.5	2.5	2.5
Platform security and lifecycle (10)	n/a	3	3	3
Total / 100	n/a	46.8	57.2	61.2

Year by year: 2018: 42.4 · 2019: 46.8 · 2020: 47.8 · 2021: 50.2 · 2022: 57.2 · 2023: 57.2 · 2024: 57.2 · 2025: 59.6 · 2026: 61.2

What moved the score

Year	Domain	Change	Points	Trigger
2019	Firewall and NAT core	1 → 2	+2.4	19.x: NAT44 with ACL filtering (year grade C)
2019	High availability and performance	2.5 → 3	+0.8	19.x: VRRP high availability (year grade C)
2019	Routing and WAN	3 → 3.5	+1.2	19.x: OSPFv3, VRFs and RPKI for BGP (year grade C)
2020	Platform and hypervisor freedom	2.5 → 3	+1.0	20.x: AWS and Azure Marketplace images (year grade C)
2021	VPN and remote access	2 → 3	+2.4	WireGuard tunnels, route-based (release not read; year from editor knowledge); no OpenVPN, SSL VPN client or MFA
2022	Platform and hypervisor freedom	3 → 3.5	+1.0	Proxmox VE and KVM/QEMU recipe with vhost-user interfaces (year grade C); VPP and DPDK acceleration; no ARM, Hyper-V or GCP; Secure Boot off
2022	Routing and WAN	3.5 → 4	+1.2	22.x: IS-IS, MAP and BGP policy depth (year grade C); no SD-WAN path selection, MPLS or EVPN found
2022	Threat protection	0 → 2	+4.8	Snort IDS and IPS with rule updates (release not read; dossier places it by 2022); no TLS inspection, web or DNS filtering, feeds or sandbox
2025	Firewall and NAT core	2 → 3	+2.4	VPF stateful firewall with state tracking and NAT (documented by 25.10; release that introduced it not read); no application or identity rules
2026	High availability and performance	3 → 4	+1.6	26.02: VPF firewall state sync between HA peers with heartbeat resync; no active-active clustering; QoS limited to policers

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2025-10	25.10: release in the four-monthly rhythm; VPF stateful firewall and NAT documented by this release (release notes not read)	Firewall core	C
2026-03	26.02: VPF HA state sync with heartbeat resync	High availability	C
2026-03	26.02: VPP stable/2510 and DPDK 25.07, new hardware support	Platform	U
2026-03	26.02: VPF statistics filters	Observability	C
2026-03	26.02: prefix-list sequence renumbering to match FRRouting	Routing	U
2026-10	26.02.1 and 26.02.2 (current by October 2026, dates not stated): fixes for a buffer leak with large MTU, a dataplane crash during packet capture and VPF HA heartbeat parsing	Security and lifecycle	C

Centre of gravity: Firewall core (1), High availability (1), Platform (1)
Blind spots (no items): VPN, Threat protection, Network services, Management and API, Packaging, Licensing, AI
Driver mix: Vision 0%, Customer need 67%, Market window 0%, Upstream 33%, Portfolio 0%
Idea-to-need index: 0.00 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 13.0 / 25

Criterion	Score	Basis
Cadence	3.5	Version names show a release about every four months (25.02, 25.06, 25.10, 26.02); no release found after 26.02.2 by October 2026; no published schedule
Roadmap transparency	1.5	Release notes public; no public roadmap or tracker
Say-do	3	No dated promises found to test
Velocity	2.5	26.02 brought HA state sync, upstream VPP and DPDK bumps and fixes; one substantive capability per release
Lifecycle stability	2.5	No published support policy; upgrades are in place and documented per release

Commercial risk: 13.5 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	3	Per-instance pricing since 2020 with no current public number; the free Home+Lab edition is no longer visible on the product pages (status unconfirmed)
Purchase constraints	3.5	Subscription only; package repositories need a business subscription; lab evaluation by request to sales
Channel and access	2.5	Direct sales, resellers and AWS and Azure Marketplace; update certificates tied to the subscription
Owner stability	2	Small private company, same owner since the first release; no acquisition
Cost of staying supported	2.5	Annual subscription per instance; no LTS, so staying supported means following the four-monthly releases

Technical lock-in: 9.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	2	Clixon configuration exportable as text through the CLI and RESTCONF; TNSR-specific syntax
Export path	2	No converter to or from pfSense or other platforms; FRRouting and strongSwan configuration concepts carry over
Stack coupling	1	Any network and storage; runs alone
Hardware / cloud coupling	1.5	x86 with SSE4.2 and DPDK-compatible NICs; Secure Boot must be disabled; Netgate appliances optional
Skills and tooling coupling	2.5	VPP, FRRouting and YANG skills transfer; the CLI is TNSR's own

Integrator fit: 7.5 / 20

Criterion	Score	Basis
Partner programme openness	2.5	Netgate reseller programme; terms not published
Multi-tenancy and self-service	0.5	No tenant model or central manager
API and infrastructure-as-code	3	Complete RESTCONF and NETCONF API; no vendor Terraform or Ansible content
Skills and certification	1.5	Documentation and TAC; no certification found

AI leverage: 2.0 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI in threat detection	0	0	0	2018: None
AI platform stack	0	0	0	2018: None
AI-assisted operations	0	0	0	2018: None
Agent openness	2	2	2	2018: RESTCONF and NETCONF API on YANG models that any agent can drive; no MCP server

Year by year: 2018: 2 · 2019: 2 · 2020: 2 · 2021: 2 · 2022: 2 · 2023: 2 · 2024: 2 · 2025: 2 · 2026: 2

AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. No AI items found for TNSR from 2023 to 2026.

TNSR has no AI features and announces none. Its model-driven RESTCONF API is the one asset an automation agent can use today.

Reading

TNSR scores as a router first: BGP, OSPF, IS-IS and IPsec run on the VPP dataplane with DPDK, and 26.02 added firewall state sync between HA peers. It scores low on threat protection and network services because it has no TLS inspection, web or DNS filtering, captive portal or web UI, so it fits a data centre edge or a lab that wants throughput over features. A buyer should confirm the current price and whether a free lab edition still exists before planning on it, because the 2020 price list is the last public number and Home+Lab has left the product pages. The lack of a published support window is the main lifecycle gap.

Open questions and items to re-score

Whether the Home+Lab free edition still exists; a forum post from 2026 says it is gone and a TAC Lite tier at USD 0 is listed, which was not confirmed.
Current subscription price; the only public figures are USD 499 and USD 899 from 2020-09-10.
Release dates of 25.10, 26.02.1 and 26.02.2.
The releases that introduced the VPF stateful firewall, WireGuard and Snort; the step years 2025, 2021 and 2022 are estimates.
Configuration backup and restore documentation was not opened; scored on the documented configuration save.
IPFIX export, Hyper-V support and the Ubuntu base version of 26.02 were not verified.