Netgate pfSense Reviews

I use pfSense as a home firewall and router. I don't use it for anything professional. When I first deployed pfSense, I was using my ISP-provided gateway, and there were a few things that I felt a little frustrated about. I didn't have control over the networks in my home and lacked some features, such as dynamic DNS, the ability to split different VLANs, multiple gateways, etc. There are a lot of features I use now, such as DNS or GeoIP blocking, that I knew about but couldn't take advantage of. 

The gateway failover helps prevent downtime. The ZFS Boot Mirror would also help prevent downtime in the event of a disk failure. The dynamic DNS is nice because when my IP changes, my web services won't be affected because it automatically caches my new IP.

PfSense has features that drive data-driven decisions. I was using pfSense years ago on a capped internet connection. It was a Comcast connection with a set amount of data I could use monthly. One useful thing was that it had the traffic totals as a package, so I could track the amount of data I was using and the clients that were using it broken down by client and network. I can determine how much data I use to ensure I don't exceed that limit. That's something I couldn't find in any other similar product.

From a performance perspective, it can help in terms of bandwidth and things like that because I know that the machine I'm using has enough processing power to establish all of my routes, DNS blocking, IDS, IPS, etc. I can utilize the full spectrum of my connection and a custom 10-gig NIC. If I had a smaller off-the-shelf product or an ISP-provided gateway, it wouldn't have the performance I need.

I'm using pfSense Plus, which has several features I like, such as the ZFS boot environment. I support Netgate because they're one of the biggest contributors to FreeBSD, so I'm happy to contribute. The most valuable feature to me is the gateway failover.  The area where I live has a lot of natural disasters and times when my Internet connection will go down. I work from home sometimes, and my wife works from home all the time, so it's essential to have a reliable connection. I like that it can automatically pick the connection based on packet loss.

The flexibility seems to be excellent. It has a large set of features to choose from that are built into the UI, so I can do 99 percent of it through the interface. It's also nice that I can run it on my own hardware. I don't necessarily need to buy a Netgate appliance, even though they make good products. It's nice that I can run it just about on any x86 PC with a dual NIC.

If we're adding a plug-in to the pfSense platform, that can be difficult, but I don't mind because Netgate vets the plugins before they make them available. That said, I found FreeBSD easy to deploy, and adding custom packages to it is simple. 

It doesn't prevent data loss in other machines, but pfSense has ZFS built in and can mirror it in two disks in different boot environments. If I have a corrupt OS, a bad update, or something else that goes wrong so that I can't connect to my Netgate, that's something built in so I don't have data loss on my firewall.

The dashboard is extremely easy to use. I like that I can go to one page and see the status of my hardware, packages, gateways, interfaces, disks, RAM, thermal sensors, and traffic graphs. It's a one-stop to look at each item and see everything operating properly. I can see them in different menus in the UI, but having one page where I can view them together is nice.

I would like them to have more security platforms. The pfBlocker is nice, but they don't have anything native for CrowdSec or Fail2Ban. I'm running CrowdSec on a web server instance on my server instead, but I'd like to move more of these services to the edge and put them in pfSense. I think that's something that's coming. I don't know if Failed2BAN is, but I'm sure CrowdSec is a popular platform, so it would be nice to have a package that's native to the platform. 

I've used pfSense for about five years.

I rate pfSense 10 out of 10 for stability. I've never seen it crash, and I have deployed two of them without any problems.

I think the scalability should be pretty good. I can put two of them into high availability. If I add more clients and start to deploy a lot of these for a small business, it would be able to handle that. I don't have experience doing that personally, so I can't speak to that, but I have seen evidence of it being used in a more scaled environment.

I rate Netgate support nine out of 10. I only needed help from the support team to transfer a license because I bought new hardware. They could answer my questions pretty easily.

Positive

I've tried UniFi gateways. The feature set was lacking, and it ran on substandard products. Unlike pfSense, I could not run it on my equipment. I've run OPNsense, which was a fork of pfSense at one point. I didn't like the UI or their documentation, but it seems like a fine product. I've also tried OpenWRT back in the day. 

Deploying pfSense is easy. I'm not a network administrator, but I'm familiar with computers. I can install it on a USB and set it up like any other operating system. The documentation is excellent. I can configure it based on that, and many YouTubers cover it.

The only people who would have any problems installing it would be people who don't know how to use a computer beyond basic functions. Anyone who's installed Windows can easily install pfSense, and anyone who has used an off-the-shelf consumer router would know how to use it. If you don't change anything, it doesn't require any maintenance besides updating packages twice or thrice annually.

The price of pfSense seems reasonable. I pay around a hundred dollars a year for pfSense Plus, which is inexpensive for such a complex product. It's also good that they can still release a community edition. If it started to get extremely expensive to the point where it was more of an enterprise-only product that costs thousands of dollars a year or something like that, I might consider stepping down to the community edition or looking elsewhere.

The total cost of ownership seems pretty low because you have the cost of the OS and VPN. If I'm paying for a VPN that's probably five to 10 dollars a month, and the firewall is already included.  

I rate Netgate pfSense nine out of 10. It's an excellent product. I advise new users that you don't need a Netgate product if you're deploying it at home. It's one way to go, but pfSense works on any old mini PC or PC you have lying around. You can get something off eBay and throw a 20-dollar network interface card into it and you're off to the races. It's not as expensive as you think to get started. The basic routing and firewall rules aren't too complicated. Don't be intimidated, and it's not expensive.

I do some consulting work for a couple of organizations on the side, and I have a few personal home lab builds of pfSense, so I use it in both a professional and personal home lab environment. I'm using the community edition and pfSense Plus.

I began seeing the benefits of pfSense immediately. The use cases for pfSense were creating remote VPN servers and satellite offices where remote employees connect. I've been using it for so long now that I have some baseline configurations. When I bring a new site online, I load that default configuration and ship it out to where it's needed. They plug it in, and the system comes online. It's fantastic from that from that perspective.

PfSense gives you much control and visibility into your boundary that helps you identify nefarious actors and things that could lead to eventual data loss.

It helps minimize downtime from a boundary perspective. They have some features. I have used Plus in boot environments quite regularly to test out some things before going live into production, which has been nice because I've made some configuration changes that I regretted. 

The boot environments help you get back into kind of what you had. Both the community and Plus editions have a fantastic configuration export. Your boundary device is relatively static once you can configure it how you need it. You can export those configs relatively easily so that when something goes catastrophically wrong, the hardware fails, or something along those lines, you can reload the configuration onto that device or the replacement device and go about your day. 

One thing I can say about pfSense specifically and the Netgate hardware is that it is not something I worry about from a security or a resiliency perspective. It's stable. It works. I have the ability to forget about it. As an IT professional, I have so many things to worry about daily, and it's incredible to minimize those things. I think pfSense has done a great job in that area.

There's a lot of logging that produces a ton of data I can pull into a data analytics platform and make data-driven decisions about bandwidth increases or changes to firewall rules, intrusion detection rules, or employee access.

It also enables us to optimize performance, one of the biggest things you do when you get a new Internet service provider or a modem replacement or something along those lines. There are tons of tools built into pfSense that let you look at how that's working, and even some tools online that allow you to tailor that experience based on your real-world use case.

In the time that I've used pfSense, I'm continuously blown away by the quality of the product, its attention to security, and all of the features it has. It's easy to use. The web-based interface is great. The tutorials on the website are fantastic. I wouldn't say it's necessarily one feature. It's the full offering of all of the features that make it for me. I use firewalling, intrusion detection, and two of the VPN features: WireGuard and OpenVPN. 

The flexibility is great. PfSense will run on homebrew hardware and Netgate. The interface is excellent on the web and through the console. There's a lot of flexibility through the console. It lets you get into a low bandwidth environment to do the things that you need to do when you're remotely administering some of these things. 

I enjoy the fact that the web interface is customizable. A seldom-used feature is the ability to change to one of several built-in themes. I use those themes to tell which system I'm administering because they're all remote to me, and the interfaces all look the same. I don't have those little tells about changing the colors of certain things. 

Sometimes, it takes some back and forth to figure out which one I'm on. I never thought the themes would be a feature I would use. I use it all the time. The user interface is fantastic and responsive. The tooltips are in the right areas and help you build out your firewall and boundary device.

The ease of deploying and configuring features depends on the feature. Most of their features are designed to be implemented with some basic knowledge level, but some are super-advanced, and you need that knowledge level. They have excellent guides for just about every feature on their website or that's inside pfSense. They're great. They explain all the different things about adding new features and each package's function. I don't think that there has been a feature that I wanted that someone didn't already have a package built for.

I would like to see a better plugin for data analytics. They have some things that you can do, but it's not purpose-built to get data out super easily. That's kind of an advanced feature, and you do have to do some configurations that are a little more advanced than some people might be comfortable with. 

I would also like some type of fleet management, like a dashboard where I can see multiple pfSense and their statuses. I'd also like that to be self-hosted. I don't necessarily want a cloud version of it. I'd like to host that at a parent site and have the satellite offices push their status there. 

I have to manage each of the devices individually. There is no interface where I can manage multiple devices. I wouldn't call it single pane of glass management. It does give me a single pane of glass for everything related to the boundary, including VPN intrusion detection, DNS, DHCP, VPN, and firewall rules. But it doesn't have that fleet management piece. I would love to see something like that.

The last thing that I would like is not a feature. It's Netgate as an organization. I would like more transparency from them when they make some decisions that sometimes appear to be made in a vacuum. Most recently, the change in licensing and some of those things did not go over well in the community in general. I think some transparency from their organization would be valuable to the community at large.

I've been using pfSense for around 15 years.

I rate pfSense 10 out of 10. I have never had a system fail in more than 15 years. I've never had one fail on-site. They are incredibly stable and resilient

PfSense is highly scalable depending on the hardware you buy. Their hardware is well-documented. If you buy a device designed to scale with your business needs, I don't think there would be any issues with that.

I rate Netgate support 10 out of 10. I have never had a bad interaction with any of their folks. They respond quickly, and their answers are always extremely thorough. 

Positive

I used the old m0n0wall, which I migrated away from. I have also used SonicWall and OPNsense in a lab environment and various Cisco and HP devices throughout my career.

PfSense offers the best bang for your buck from a feature and cost perspective. Many other systems have some cool features that either aren't necessary or are significantly more costly than pfSense.

The initial deployment is easy, and it's even easier once you've spent some time with it. If you buy devices from Netgate, they provide you with "zero to ping." 

Even if you have some kind of odd setup or something weird you can't figure out, you can call their technical support, and they will help you get online. They'll even remote into the device to help you get online or solve a problem, which is incredible. 

Now, I have a standard image that I use from a configuration perspective, so it takes me about half an hour. It is typically a one-person job. The only reason why I put a caveat on that is I am fully remote from all the services that I support, so I do need a person on-site to at least plug the thing in, but the rest of the setup is a one-person job. After deployment, it doesn't require any maintenance aside from standard firmware updates. 

I don't like subscription models, and unfortunately, the latestpfSense license, pfSense Plus, went to a yearly subscription model. I think yearly is probably the best of the worst because at least I can pay it once, and be done with it for the year. I would rather see either a one-time cost or something along those lines that would be at that price point. I think the costs for their hardware are reasonable. I wouldn't call them cheap, but I also wouldn't call them expensive. I think the hardware costs are reasonable.

I personally run a couple of black box or white box servers that are custom built using pfSense Plus that I've licensed, but all of the other deployments that I support are devices purchased from Netgate.

I rate Netgate pfSense eight out of 10. I recommend that new pfSense users join the community. PfSense has an active community on Reddit and a community forum. You can also get a copy of the community edition and deploy it to a virtual machine to learn it before you put it into production. You won't be disappointed.

I have the Netgate 6100 firewall with pfSense at my house, and I also have several business clients on it. I use it for site-to-site VPN from one doctor's office to another so their PBX phone systems can replicate across the network. 

PfSense helps prevent data loss. It's a firewall, so unless you open ports, they are completely closed off, and nobody will crack into your network. You can set up various rules that will let you know if you have an intrusion or block an IP address, country, etc., for malicious threats. 

I haven't experienced any downtime with the 6100, but I've had problems with the Netgate 2100 appliances. One of the data-driven procedures is performance. If you make a change, your traffic comes up almost immediately. If I had to compare pfSense to SonicWall, I probably wouldn't use SonicWall based on the boot time. When you have to restart the system or something like that, pfSense is quick, whereas these other firewalls will take 10 minutes to come back online. 

The visibility pfSense provides helps optimize performance. Some of the stuff is visible in their charts and graphs. You can see their traffic moving in real time. That's beneficial to me, especially if I'm looking for something. For example, if you're looking for an IP address that's seeing a lot of data, you can narrow it down to what device it is.

The most valuable aspect of pfSense is the community. If you have a question, you can post it on the forum. The backups are also good. I restored it from a hard drive recently and was back up in 10 minutes. 

I like pfSense's flexibility. It lets you install it on multiple applications, such as a VM, appliance, or white box. For a short time, the community edition had a free upgrade to the Plus edition, so you could technically download the version and convert it into a Plus version. They offered support there for a while, but I don't know if they still do. 

If you log into it, it is a single pane of glass, but the features are scattered everywhere. If you make a firewall rule and you run a port, it will automatically make the firewall rule for you, so you don't have to do that. That's convenient versus some firewalls where you have to make the net rule, then you have to make the firewall rule to allow the net to operate. 

It's easy to add features, but some require configuration. Depending on the feature you're adding, that can be tricky. I wish their GUI were easier to use because it's always been scattered instead of having everything in one column. You have to click one thing to get something to work kind of like UniFi. You have to be a little techie to get it working as you want. The only other problem I've encountered is that sometimes it has buffer bloat, and you have to go in and change some firewall limiter rules to get the bloat to go away. Once you get it down and have done it a couple of times, it seems fairly straightforward. 

If the GUI interface were better, that would be a huge benefit. There's a fork of pfSense called OpenSense with a far superior interface. Everything's in the left-hand column. When you click on one item, you see everything listed under a single tab. You don't have to jump back and forth through the program. 

Everybody is sometimes scared of open firewalls, but they get updates regularly. I check them all the time. I wish it had an app or some alert feature that you could set up. That would make it a little bit easier if something went wrong because you usually don't find out until the last second.

I've used pfSense for 10 to 15 years.

PfSense is highly stable. I don't typically have any crashes. Usually, it's hardware problems, such as a hard drive or memory chip. Beyond that, I have had no issues with any appliances that pfSense installed.

The scalability is good because if you have two identical devices, you can do high availability, so it's highly scalable. 

I rate Netgate support 10 out of 10. Netgate technical support is just phenomenal. If you pay for support, they're on it right away. I've had to call them a couple of times and ask for a system image for some of their lower-end devices. I've noticed that an upgrade will sometimes break them. You can take the serial and model numbers, send them an email, and they'll send you the image. You just download the image, flash it over onto the device, and restore from the backup.

Positive

I've used UniFi's Dream Machines, FortiGate, SonicWall, and OpenSense. I've got one instance of OpenSense out there. They're all about the same in performance, but everything has its own learning curve. The learning curve of pfSense is higher than OpenSense because of the GUI, which is a little confusing and intimidating for someone brand new.

A brand-new user might be confused, especially if they don't have too much networking capability. If you have a white box and download the software, you need to configure everything, including the network interface card, but if you buy an appliance, you should be able to plug into a port and get an IP address. That's not the case with the community. It isn't. For those who want to dabble and play around with it, there's a bit of a learning curve there at the beginning on how to get it. They have some good documentation, but it's a little confusing.

I can have it running in 10 minutes. It depends on what you're doing and whether you have VLANs, which can be confusing to configure. But you can set up a simple home user with no VLANs in 10 minutes. For maintenance, it'll tell you if there's an update, but I typically wait a while before I do the update to ensure that it's solid. They do good testing on it, but I've had some problems where it breaks something else when they do an update.

The price of pfSense is on par with everything else. It depends on how big an appliance you buy and whether you're purchasing it directly from Netgate. Some rack-mounted systems are expensive—a couple thousand bucks. The one that I use at my house was $700.

The total cost of ownership isn't too high or too low. I think it's right where it needs to be. Obviously, with new appliances and faster technology, your prices will go up, but that's expected with any product you buy. It was all free when I first started using it, and you could put it in any box you wanted to buy. 

I rate pfSense eight out of 10. The reason I give it an eight is that the GUI needs to be cleaned up a little. I think Netgate would sell more if the GUI were a little more like Opensense. Before buying, I would test the community edition on a virtual machine and select an appropriate appliance based on your deployment. 

I have two different use cases. I use it as a firewall and security appliance. I also use it in layer three virtual routing scenarios.

The thing that sets pfSense apart from other competitors is the flexibility that it offers. You have a package manager, and there are so many options to choose from -whether it's security, a plugin, or even networking technologies. pfSense supports VPNs. It supports VLANs. It can be virtualized. It can run on physical hardware. You can be agnostic as to which vendors you're using. It is interoperable. It's a very versatile package and system. It's very easy to add features and configure them.

There's a graphical user interface that can be managed and used for almost every feature configuration item and function. There's also documentation on pfSense and NetGate's websites that outlines every configuration item package and configuration setting in extreme detail. There's also a strong community. The community has a support forum online. It is very easy to use.

I've witnessed the benefits pretty quickly. I started using it in production in 2012. Prior to that, I had used it personally from 2009 to 2011. That gave me time to kick the tires and see how it could be used. In 2012, there were very limited deployments of pfSense in the enterprise industry, and support was available, but not like it is now. So, by being able to use it personally, I saw where the benefit was. Then, when we deployed it in a production or enterprise environment, we were able to realize the benefits immediately. And those benefits were: security, supportability, and sustainability. Regarding security, it's backed with BSD, a well-known, tried and tested operating system, and is up to date on patches. It is much more user-friendly to configure than the competition, be it from Juniper or Cisco, HP or the other competitors that are out there. Sustainability is an extreme benefit. The feature parity, along with the cost and flexibility of being able to provide a variety of different hardware networking methods, pretty much sealed the deal.

The solution prevents data loss. pfSense offers an auto backup system, so your configuration and systems that you're running by default can be synchronized with pfSense and their cloud product, meaning that if you suffer a failure or a configuration issue that makes you need to roll back, you can actually rebuild a device or virtual appliance in a matter of minutes and have it back up and running just as it was. As far as other building features, it runs BSD, So you can use SFTP, which is a secure transfer protocol, as well as any other industry standard backup product. The main function that's built-in is the auto backup and restore functionality, which we use from time to time, and it's very helpful.

I use both the community and Plus versions of pfSense. For enterprise and production systems, I use pfSense Plus. I use that on both physical and virtual hardware. It works great. The pfSense community edition would be more for a testing environment or a personal deployment.

pfSense features that help to minimize downtime. pfSense comes with opportunities to configure for high availability. In the event of a failure, there are ways to bounce from one appliance or virtual appliance to the other. There is full documentation for that. It uses open standards. Also, on the individual appliances, there are wizards and configurations for WAN and multi-WAN failover bonding or anything in between. That includes failover for your Layer 3 routing firewall rules, filters, et cetera. 

pfSense provides visibility that enables users to make data-driven decisions. pfSense supports many different monitoring and logging types. Out of the box, it can monitor. It also supports Syslog. It supports SMPP. You can create baseline reports and watch trends, and those trends could help you be prepared for an increase in bandwidth, routing capacity, or even CPU utilization for beefing up your security rules.

The visibility in pfSense helps you to optimize performance. You can get an accurate picture of what bandwidth is being used and determine where the bottleneck is. Performance isn't just bandwidth. It could be routing. It could be applications. It could even be firewall rules. This provides visibility into issues. 

I've used pfSense on the Amazon EC two virtual machines in a limited capacity. I don't have any customers currently that are in production on AWS. However, if I did, I would certainly use their supported appliance or their virtual appliance on the marketplace. 

Having a single pane of glass management is on their roadmap. If you have multiple instances, you have to manage these deployments across a wide area. I'm required to keep a third-party product.

The main feature that I could see them adding would be a management interface that lets me manage multiple pfSense instances. As an MSP or consultant, it would be very helpful if I could manage them all from one place. 

There are some modernization efforts on the operating system that are needed. Possibly looking at Linux-based operating systems to allow newer features, better hardware support, et cetera, would increase performance. 

They should continue to expand in bracing the software and appliance model and expanding reach to cloud providers other than just Amazon. It would be nice if they had a supported appliance on GCP as well. I have customers on Google Cloud, and this would be helpful.

They need a more streamlined or documented approach to how they would like to see virtualized or alternate hardware deployments supported. If I build my own hardware, sometimes I don't know what the best type of hardware is to go with, and having some streamlined documentation and explaining the best practices would be helpful.

I've been using pfSense since 2012.

The solution is extremely stable. I've never had a stability problem.

The scalability is excellent. However, when you get past a ten-gigabit connection, and we are seeing the opportunity for 20 and 100 connectivity methods, that's a bit of a struggle right now.

Technical support is fast and accurate. I would rate them as having the highest level of customer service from my experience working with customer service. They are excellent.

Positive

I've been in the industry since the late 90s. I've worked with a variety of solutions, including Cisco, Barracuda, Juniper, and more. pfSense is easy to use and much more flexible. It really cuts down your speed to value and time to delivery. There's not much of a comparison at all.

The initial deployment is extremely easy. If you're a professional in the networking industry and you have a working knowledge of OSI model networking, IP address routing, and firewalling, you'll be fine. The interface is the easiest and most user-friendly on the market. 

For a small to medium-sized business, if I already have accurate information on their Internet connectivity and subnetting, I can get it up pretty fast. You can be up and running in a matter of hours. One person can do a deployment.

There may be some maintenance needed. It depends on what type of agreement I have. Some customers are technically astute enough to handle basic maintenance tasks like updates, security patches, and package updates on a regular basis. If not, I offer a service where I can also manage that for them.

The pricing model is good. It's right about where it needs to be. The total cost of ownership is low and the value is high.

I'm a pfSense customer.

I'd rate the solution eight out of ten.

If users are interested in pfSense, they should try the community edition. It's free to download, and you can just get started and try it out. Moving forward, I wouldn't hesitate at taking a look at the different types of hardware that they have, and to talk to sales.

We use it as a firewall. I've got a few deployed at different customer sites. All of them use OpenVPN for VPN software.

We really started out with general-purpose firewalls, and I used a different firewall. I've used SonicWall in the past and one of the other firewalls had a yearly subscription fee if you want to protect from different sorts of security threats. pfSense uses open software, so you don't have to pay a security fee for that.

The dashboard is pretty good. It lets you control different things. It also has widgets, and you're able to control which sockets are open or not, and you're able to have some open software that allows you to do geofencing. You can restrict the ability to access certain countries.

It's been flexible enough for everything that we've needed to do with it. I have a small operation, so we don't have some of the requirements that a larger one would have. 

Since it's open software, there are typically open modules that you can add. The firewall software also has a menu option that allows you to download different new features. For instance, there's a piece of software called Notes that allows you to make some notes, so you can go into your firewall and look up configuration notes that were written there in the past. There's backup software, so there's another piece of software that allows you to back up the configuration to a file or a PC connected to the firewall. If you have a sufficiently bad power outage, you can lose your configuration. However, it has some features that allow you to track suspicious access to a device. You get a record of intrusion. You still need to interpret it yourself. However, you are alerted to potential hacks.

We began to see the value immediately. It made a big made a big difference not to have to pay that annual fee. There was some learning curve involved. I like to learn new things. 

We do not have a single pane of glass management. It would be nice to have. There are some firewalls that let you have cloud-based management like software as a service. pfSense doesn't allow you to have a central place where you can check everything. I have to remote into local networks and then pull up an individual dashboard.

I've been using the solution for three and a half years.

The stability is good. I haven't had any issues with the firewall crashing spontaneously. What I have seen is, if you have a power glitch, it will go up and down. We have battery backup so that those power glitches don't happen. However, if it does, that can damage the memory storage device inside the firewall and then you have to reload it. 

The quality has been very good. If I had paid support, it would be faster. When you get a new firewall, you get 30 days of telephone support for the device while you are initially configuring it. After that, you have email support. You can pay for support every year. However, I work for a lot of non-profits that do not have big budgets. 

Positive

We've had SonicWall or WatchGuard in the past, among others. They had less flexibility and you did have to pay an annual fee.

The initial setup was maybe 50% more difficult than I thought it would be. That said, it wasn't too bad. There are good instructional videos on the internet and the help documentation that Netgate provides is good too. They also have good technical support. The free level of technical support is an email ticket system. If you have a problem, you can raise a ticket, and then it gets solved, maybe not right away, but eventually. It might take a day or two to get solved.

The first time it was deployed, it probably took a day - maybe 12 hours. After that, it takes anywhere from a couple of hours to up to five hours to fully load a firewall with all the different pieces of software I need. 

I handled the deployment myself. 

There is a bit of maintenance needed. I will either go remote to the different firewalls or on-site and update the software. I can download the latest version from Netgate and basically reload it. 

I use the community version of the solution. It is free to use.

I don't consider the cost of how many hours it would take to learn it versus the cost of the annual subscription; however, once I get sufficiently comfortable on many firewalls, that'll average out to zero in terms of cost.

I'm a registered reseller.

I'd rate the solution nine out of ten. It's a good firewall that operates without you having to pay attention to the costs. 

It's really important to back up your configuration. Sometimes, you do have to reload it. It's more important to document the procedure that you take to load and configure the firewall. If you're used to WatchGuard or SonicWall, then there's more of a cut-and-dried procedure to that. With pfSense, you really have a lot of latitude and a lot of flexibility in how you want to configure it. If you just do the minimal configuration, you probably aren't getting the advantage of all the features you would want to have. That's why it pays to document that.

We are a large church, and we use Netgate as the main firewall appliance. We have multiple WAN connections coming in, and we have about 500 endpoints connected to our network, so we use it to make all the bits travel where they need to be.

We were using some other products that were closed-source, and they did not have some of the features that I liked. I liked OpenVPN. In terms of the VPN infrastructure, I had a lot of great information from people online. I could follow a lot of reviews and very good technical documents. It was about unchaining myself from a different licensing program that was charging me almost an extortionary rate for a firewall appliance but did not give me any better security than I would get through pfSense.

I like the idea of packages because I work on Linux all the time. Adding packages is a nice way of adding features. We do iPerf3 testing. With just a few clicks, I can have an iPerf3 server set up on my pfSense. All the tooling has been easy to integrate.

Everybody loved it when I switched over to the VPN. It was easy to use. OpenVPN has a great piece of software. Everybody loves how easy it is to use the VPN to get onto our network but also how secure it is. 

The fact that I do not hear much about it is one of the best parts. The Internet has not been 100% solid here, but we never get to know it because the WAN failover takes us from one endpoint to another without even noticing it. I had the Internet provider come, and he was going to change some hardware. He was asked if we needed to tell anybody. We did not because they would not even know that we were doing it. That is a pretty good feature that it works so flawlessly. If you are going to take your main connection to the Internet down, you have two backups, and nobody is going to know the difference.

I can look at my network as a whole. It is great to see the traffic on my network. I can see where it is coming from and where it is going, and I am able to follow through. The screens are helpful for telling the story of what is going on at the moment with the data. I look at my firewall quite often. If there are any questions, that is one of the first places I go to for troubleshooting.

pfSense Plus and the service program have definitely helped minimize downtime. The fact that I have help on the way anytime I need it is great. I do not have an estimate about the reduction in the downtime because as soon as I got here, I swapped over. I do not have any previous data points on that.

Running their hardware and software helps a lot with the performance.

The customer support is very good. Setting up the VPN is pretty straightforward and easy. 

We have multiple VLANs, and with assistance, it was easy to get everything set up and running in our organization the way we needed it to. We have the flexibility and the ability to adapt things over time as needed. When I needed to add an extra WAN connection, I could. It was not locked behind a paywall. I did not have the issue of not having enough ports on the machine for that. I had all the ability and all the hardware I needed to do all the things that I needed.

When we were setting up VLANs, there was some information about the way the ports, switching, and other things were done inside. Their UI could have hidden some of the complexity better so that it was easy to understand or more general. They could have given some more clarification on the markings on the outside of the machine. There were some questions as to what port was what and how that links to what was being asked in the software. Those things were not always very clear.

The features that I wanted have been added, but I have not taken the time to look at them. I am a big fan of WireGuard, and they have added that, but I have not taken the time to install it yet. Its features are complete for our needs. If I have to ask for anything, it would probably be more education on bolting on some of the XDR platform stuff that is out there, but it is feature-complete. I know that all this exists. It is just taking the time to get educated on it, which is probably on my side.

I have been using Netgate pfSense for about three years.

I have not seen any downtime, so I have to give them a ten out of ten on that. There has not been a time when it has not done what it needs to do.

There is a long way to go above me, but I would not be looking to change if we grew by a lot. I would rate it an eight out of ten for scalability, but I do not know what it would be like in a data center.

It is being used at a single location. We are a fairly large church that has quite a bit of data flowing in and out, but we have just a single location. It is me who works with it, and I have a junior sysadmin and our managed service provider working with it. Three of us interface with it.

They are amazing. They are great. They followed through very well when I had issues. Usually, the issues I had were kind of self-inflicted wounds, and they walked right through everything with me with great continuity. I cannot say enough good about them. I would rate them a nine out of ten.

Positive

We used Sophos. One of the main reasons for the switch was the license model. The way they charge for their software was pretty expensive. I did not feel that we got a lot for those IT dollars. I knew that I could set up pfSense and pay for the service plan so that I have a live person on the other end to help me when I needed it and it would still be way under what we were paying for Sophos.

It is deployed on-prem. We have a couple of Netgate appliances. We have one that is a spare and we have one running in production. In case one goes down, we will just move over to the other. We have a couple of pieces of equipment in our rack locally.

My managed service provider helped me with the deployment. In one night, it was done. It was pretty painless.

In terms of maintenance, there are always updates to do.

There were three of us involved, and it took about four and a half hours to get everything configured. From taking out the old to getting the new in and getting it configured took about four and a half hours.

Compared to what we were doing with Sophos, it provides a great value financially and in terms of time savings. For the most part, I do not have to mess with it. It does not require me to go in and touch it unless I have something I want to change, and that is a win. The upgrades are easy, and they have been flawless. That is a good return on investment. That dollar is well spent.

We are probably paying about 30% of what we were paying previously.

The price is fair. I buy the Netgate hardware so that I can support pfSense and Netgate and I have somebody designing the next layer of software for me in the future. I like their model. It is a high-value piece of equipment with a great team behind it.

With the inclusion of firewall, VPN, and router functionalities, we get a good value.

I would recommend it because it is a good value in terms of the price, performance, scalability, and usability of the metrics that it gives. It is definitely what I would go with.

I would rate pfSense a nine out of ten. It would be a ten if they offered free training and told me about what the free training is. There are probably a few things out there like that, but more one-on-one free training would be the main thing they can do better.

I primarily use it for hybrid home/business power usage at a very small scale. It is both home and business because of working from home. pfSense is serving us as the main routing firewall and network configuration tool. It is the front-end brain for everything in our mixed environment.

pfSense allows me to manage both home needs and business needs and keep them relatively separate or at least appropriately separate. A key feature was to be able to use a small-scale device. I am using Netgate SG-1100, which is built to run pfSense on an RM platform. It has low power consumption, and it is economical. I did not need massive amounts of compute power, but I did need the feature set that typically, you can only get in enterprise-grade product lines such as Cisco.

pfSense is extremely flexible. The areas where I find it very flexible are the sheer number of configuration tools that are available and the extra packages that can be used to augment the core functionality. Even within the core functionality, it is capable of adapting to a massive number of different scenarios and network environments and needs. You can adapt to the needs of your network environment to the outside with ISP and internal needs. You can accomplish what you want to achieve internally with the product. It seems to have pretty much everything under the sun laid out.

It is pretty easy to add features to pfSense and configure them. If I am adding something for the first time, the web GUI is the most helpful tool because the layout is pretty logical in terms of how the forms are organized and fields are named and described. There are help callouts, and, of course, documentation. I have always found the official documentation to be helpful, but it is not uncommon to do some forum searching and read the discussions. Other people might be following a workflow that does not fit quite cleanly in there, but they made it match. Typically, it is pretty easy. Some of the things that I have done with pfSense are not inherently easy processes, but I feel that pfSense has made them much easier than they would be on different platforms.

I was able to realize its benefits immediately. I am an IT professional, but my use of pfSense is not as an IT professional. It is more like a solo entrepreneur for my wife and her business. When I look at the network administration that I am doing here, it says a homeowner and a business co-owner. IT and networking are not the kinds of things I want to dominate my time. It should not be dominating my time spent. From that standpoint, I was able to get the baseline configuration set up so quickly when I first set it up about seven years ago. I definitely felt a big value-add with the configuration backup and restore process. The first time I broke something on pfSense, I was able to revert my last configuration very quickly. That was a big win.

In terms of pfSense helping to prevent data loss, auto configuration backup is probably the number one feature. When I think about data loss in pfSense, I would mostly be concerned with losing the configuration itself. Having my own backups but also having Netgate backups available for me to pull down helps. I just have to make sure I keep the encryption password, and we are good to go. That is a big win.

I use pfSense Plus. I am pretty sure that auto configuration backup is a Plus feature. I am on my second generation of official Netgear appliance, so my experience with the Community Edition is limited. I am not sure if this feature is available to others, but for minimizing downtime, having the auto configuration backup is a big one. There is a restore option for quick reverts if a change did not go quite well. They are incremental, so reverting to whatever snapshot or revision version I need to revert to is very easy.

pfSense does not give a single pane of glass management, but I also would not expect that because it is doing so much and is capable of doing so much. In my environment, it is managing so many different aspects of the whole Netgate, but there is not a single pane. I use the logs a lot, but I have to look through individual logs. I am not aware of any log aggregation and analysis components that are already baked into pfSense. As I understand it, I need to ship my pfSense logs into another system to do a higher-level analysis and insight querying. An area that I am interested in working on is effective outbound traffic filtering. It is on our priority list because it is a tricky one. You do not want to let any outbound traffic go, but you also need to be careful how you are filtering outbound traffic so that you do not break things you are relying on for your functionality. A lot of people use a web proxy, but that only catches web traffic. With smart home devices and business stuff going on, you have to pay attention to it. I am very interested in being able to analyze the traffic logs that are being captured by pfSense with an IO, the outbound traffic, and the existing and potential firewall rules that I have in place for those. My current efforts have been focused on doing so with a different product because I do not believe that pfSense delivers that. I honestly did not expect that it would.

iperf helps with performance. We are able to do iperf bandwidth tests as both client and server to various endpoints and turn on a quick listener and see what is going on with who can get where fast. The diagnostic menu list is probably the longest one in there. That is a good sign because it just means that they have got a lot of tools available for me to use if something is not quite working right. If I want to improve performance, I have to take a measurement and take a look at what is going on currently and compare that to what I would expect to see. There is a wide variety of toolsets. I am not asking for this because it is not the kind of system that I would want to run, but there is no troubleshooting or performance improvement wizard that kind of walks you in a logical step. I know that there is one initial configuration wizard that is meant to get people going quickly for the first time and in a fairly simple setup, but even that was not a great value to me because I want to get quickly into more advanced configurations. It has what I expect for performance tuning.

Being able to configure VLANs on such a small device is one of the key unique features that made it attractive to me.

pfSense is very flexible, but my only drawback in terms of flexibility is that it is web GUI-driven. I know that there are some shell interfaces, but it is not a very heavily developed API when it comes to automation or configuration-as-code management. I would love to see that developed in the future so that I am able to manage my network configuration in YAML and TOML text format, have those changes applied in a source code environment, and have those changes read into an API that could then drive the configuration rather than have always having to use the web GUI just to make some layout changes. Web GUI has its advantages, but there are times when being pinned into that workflow is less efficient.

They should support the idea of configuration management as code from source code and provide a more robust API for managing the pfSense configuration. I know that with the web GUI, everything is dumped into an XML file. That is how it is backed up, and that is how it is imported. It is machine-readable and all that, but it is not necessarily a modern data format that would be used with API typically. They are maybe thinking of moving to REST API and SQLite backend. I do not know what they have in mind. I do not really care how they do it, but I would love to have the ability to interact with my configuration and make incremental changes via source code and utilize the API to implement those changes and roll them back with configuration as code as a strategy for managing my pfSense.

It has been about seven years.

The device is rock solid. I have not had any hardware concerns or issues. I do not have to reboot it. If I am having some kind of network issue, I do not have to restart my pfSense. Why I wanted the free BSP base is that I know that the core layer is rock solid. It is possible that something could happen where I would need to restart, but it almost never does.

It may have been with the older device for which I have worked with them twice. I opened a ticket to get the download link for recovery firmware on the SG-1000, and they gave it to me. That was very easy. That was fine. They responded quickly, no big deal. I appreciate it. I did not really need support. It was something that I could not get directly from the website myself.

I am not sure, but when I bought SG-1000, I might have had to send it back. They sent a replacement. It was less than a year since I had it. I still had a full warranty on the hardware. At some point, everything froze, and all functionality completely stopped. I tried the power cycle, and it would not even boot anymore. They did the serial console connection, and it literally was not even booting. They opened up a case and verified the same symptoms that I described. They replaced the board and sent it back to me, and it worked. It was solid from that point for five years that I continued to use it. After that, I upgraded it. Every once in a while you get bad hardware, but I was glad I could just send it back. The biggest fear I have, and probably the only reason I still have the old one lying around is that if something were to happen to this hardware and I had to send it back for support, I need to be able to keep my network running in the meantime. Even as a home and home business user, you start to creep into that space where you start to think that this is critical. How do you get by without the Internet? I know that I could get Internet back up, and I could plug in any off-the-shelf routers lying around and get basic Internet service back up, but the question is how much work would I have to put in to restore other services that pfSense is performing. I recognize that I did not invest in a high availability solution for my home and home business, so that is just a risk that I have to take.

I would rate their support a ten out of ten. There is nothing difficult about it.

Positive

Prior to my first pfSense appliance, back in 2017, I was running DD-WRT, which is not a commercial alternative. It is an open-source project that does not even have a paid or commercially supported version. It is meant to be flashed onto OEM hardware as a replacement for their firmware. pfSense can be used like that, but Netgate is doing something different with the commercial support and building the appliances and all that. In terms of the baseline functionality, DD-WRT is very similar.

In terms of comparison, pfSense is much more robust. It is a comprehensive solution for networking needs that bridges the gap between a shelf router and building a full enterprise stack, which would be overkill. Most small businesses and home users would not want to do that, make that kind of investment, and keep that kind of compute running all the time. pfSense lands right in that sweet spot. I know that OPNsense and a few other software products are out there. There are some Linux-based ones. I am definitely a fan of pfSense being built on free BSD. That gives me greater peace of mind with the networking stack and everything. I am a Linux guy too, but when it comes to core services, I prefer free BSD. If I have to, I might just go with the vanilla, free BSD system and build it out with automation from scratch, but pfSense does all that for me. I do not have to do all that initial work. They have got the configuration and tuning done already.

If you have general networking knowledge and understand the terminology, it is very easy. It depends on how detailed or how extensive is your configuration and what is the target use case. Are you using a VPN? One of the features I use is OpenVPN.

I go through the box. I have a single WAN connection. I have half a dozen VLANs configured. I have a VPN remote access interface configured. I have got DHCP servers. I also have IPv6 configured. I have extra configurations for each interface that need to be considered, including the VLAN interfaces. There are also firewall rules.

You can start with the baseline, and you can get the thing up and connected to the Internet easily within five to ten minutes. Once you start doing your internal configurations and firewall rules, it scales pretty quickly. With a couple of VLANs, like I have, you spend another half hour to get the VLAN to spec out. With OpenVPN, you have to work on certification generation and certificate matching and exporting. Configuring the client's side tends to be time-consuming. If you have four clients, it could take another hour to three, and then there are firewall rules. It depends on how you write them. If you write your rules well, you do not need to have so many of them. It also depends on how you configure your space. I have a lot of interfaces and a lot of rules. With a good, clear plan and no guessing and backpedaling, you could probably redeploy what I did in three to four hours, but it would actually take longer because of mistakes, troubleshooting, and all that.

In terms of maintenance, I certainly keep up with updates from upstream and make sure that I am aware of any software updates that I need to install. I like to stay updated with patches and all that. That was the main reason I finally upgraded from SG-1000. It was no longer getting the updates. There is always a bit of extra maintenance. It is not because pfSense demands maintenance. It is because the environment demands continual maintenance and monitoring. Paying attention to logs is a healthy practice.

I always make updates via pfSense whenever I am making updates in the environment for adding new DHCP reservations for various hosts in the environment and other things like that. I moved my local DNS services from pfSense because I had to go into the web GUI and clumsily add in new host entries. It was getting burdensome. I just wanted to be able to do this in a text file like I could on a Linux server. You just add your entry to the host file and you are done. I moved to DNS services on the Pi-hole software. Pi-hole is a partial competitor because it does not do everything pfSense does, but it can do some of the things. It focuses on ad blocking and filtering as well as providing local DNS resolution. A nice thing with Pi-hole is that you can literally open up a text file and add your entries there, and they just start working. You do not have to move from a terminal-based workflow to get that change made. Clicking through a web browser is not my favorite. It is a disruption to a workflow. So, maintenance is directed by requirements in the environment.

I buy the appliance and accept whatever comes with it, but I am not bought into paid support. When it comes to the pricing of the appliances, they are pretty competitive. The price is pretty competitive.

I just bought a Netgate SG-1100. Within the past year, I upgraded my Netgate SG-1000 from 2017 to Netgate SG-1100. I looked at some of the higher-spec products, but they started to get pricier. For example, Netgate 2100 was a consideration. The difference between the 1100 and 2100 is double. I looked at the specs of 2100 and what it could deliver. I did not need all the extra specs. I do not need to perform at that level although it might be nice to have some extra ports on my box. I then looked at 1100. I could get by with those specs. It was an improvement over the tiny SG-1000 that I was running, so it was a win, but the question always is whether there is something competitive and similar that I can build for less money and whether it would deliver the same value. You can get these Small Form Factor PCs. You can get ARM systems and x86 systems and similar form factors. You can get them with multiple NICs already installed. This is more or less your hardware with no support. You get a warranty on the hardware, but they are not selling you the software. You put whatever you want on it and build your system. You can install pfSense CE on that or build your own router on a device like that. Why I chose to buy it from Netgate was the peace of mind of the full stack support because it is probably the most critical portion of my entire home network. I decided to invest a little bit more and trust somebody else a little bit more to have my back. Peace of mind comes from having bought the official appliance. It has a very reasonable and competitive price model.

In terms of the total cost of ownership, you have the hardware price. You are combining the price of any hardware support contracts that you may or may not be paying for and somehow estimating the administrative time that is required to actually manage the system itself and billing somehow for that appropriately. That is a tough one because that is where there is a gray area of home business usage. Aside from that gray area, the investment rolls off very quickly. I can recoup this investment within a year.

I would rate pfSense a nine out of ten. It is delivering on my needs. There is little room for improvement. They can just close the gap. You always want to keep closing that gap when it comes to usability, inconvenience, and meeting the workflow, but it is definitely delivering to my expectations very well.

I use pfSense at home, and my friends and family use it in their homes. I'm also the IT solutions administrator for a council of governance organizations, and I use it for them. I use pfSense Plus at home and the community edition at some of my friends and family's houses.

I pfSense Plus at home and use the community edition at my friends and family's houses. I have used the community edition multiple times in labs, but I use pfSense Plus for all of my enterprise applications.

I started seeing the benefits when I began playing with it at home 10 years ago. It was an immediate success when I put it in enterprise locations because it was much cheaper than WatchGuard. I was familiar with pfSense, so I quickly trained my staff on it. They know how to operate everything well in pfSense.

With pfSense, you can do a failover. I have used that before, and I see it as a benefit, but there are some drawbacks. You have to use multiple external IP addresses to set it up, but it works well. However, I don't use the failover anymore because of the price. You can have two of these things on the shelf, and in the event of a failure, you can get another one up within five minutes by throwing it on there, configuring it, and plugging it in. That's my failover plan for all my main locations.

PfSense's visibility enables me to make data-driven decisions. I love the way they do geoblocking. You can see where you're improving. The logging ability is diagnostic. You can see all kinds of data. For example, when I make a new rule, Immediately know what's going through that rule. That visibility is very helpful in knowing immediately if my rules are being applied correctly. 

The most valuable feature of pfSense is that it's a stateful firewall. I also like the way the rules are implemented on the firewall. It makes things much easier to see at a glance. 

PfSense is the most flexible device I've ever used. It's open-source software. I've used all the big names, including Palo Alto, WatchGuard, and Sophos. In terms of dependability, this is the best of them. 

It's simple to add and configure features and easier than some of the big competitors like WatchGuard. The front dashboard on pfSense is very customizable. You can get it at first glance. Everything you need to do is in that single box. It shows you if your LAN and interfaces are up. You can see what kind of traffic is going across each interface because they give you a traffic graph that you can do for each interface. 

You can see if your gateway is up and precisely how much data passes through each interface. I like how you can get direct visibility over your IP address updates. If you're not running a static IP address, there's another cool thing on the front page where it shows when the dynamic DNS updates. The way you can customize that dashboard is cool. I haven't seen that with other firewalls, and pfSense gives you good visibility at first glance.

I don't think pfSense's web filtering solution is the best, so I don't use it for that purpose. They could add a little better web filtering solution to pfSense. They have solutions in place, like SquidGuard, but they aren't very good. 

Another feature about pfSense I would improve is adding a single pane of glass management for multiple units I manage across the municipal district. I would love to manage all those devices through one single pane of glass, but that's not a deal breaker for me.

We have used pfSense for around 10 years.

I rate pfSense 10 out of 10 for stability. I've never had a Netgate system fail on me.

The scalability of pfSense is great. It costs very little to expand to multiple systems across multiple locations. It'd be better if they had a mass edit platform where you're running multiple systems. I've heard quite a few people in the community talking about that. I heard someone in France was developing a dashboard that gives you visibility across multiple boxes, but the cost of deployment is very cheap. It's easy to put boxes out there and write rules for them. 

I rate Netgate support 10 out of 10. Most of the tech people I have contacted seem to know exactly what they're doing. They've got, like, 10 people named Chris working support. Every Chris that I've ever spoken to has been spot on. Every once in a while, if I call after hours or something, I might get someone who isn't as adept at it, but they quickly escalate it to someone who can fix the issue. 

Positive

I have used Palo Alto, WatchGuard, and Sophos, and all the major competitors, but I would compare pfSense to WatchGuard, the one I have the most experience with. In my type of environment, pfSense wins hands down over WatchGuard because it's a stateful firewall. One thing I've hated about WatchGuard is that it's not a stateful firewall. It's rules in and rules out. You end up getting thousands of rules over a four or five-year period. PfSense enables you to put notes on your rules. 

If you have a question about a rule, you can read the note you made when you made that rule. Having the ability to document your rules in the dashboard has been a game-changer for me. After you have used a stateful firewall, it's hard to go back because it's much harder to make rules on both sides. 

Deploying pfSense is as easy as any other system. It helps that pfSense has a massive user community and some great YouTubers, so you can go to YouTube University and become a professional with pfSense quickly. You can learn to do some complicated edits and set up complex VPNs. It takes only 20 minutes from start to finish. For maintenance, you only need to update it when the updates come out and change the configuration of your rules as needed. 

PfSense offers huge savings. The price is the lowest in the business. The only thing you can use in place of pfSense is a fork like OPNsense. I'm more familiar with pfSense, so I never got on the OPNsense bandwagon. 

I rate Netgate pfSense 10 out of 10.