Netgate (pfSense)

What Is Netgate (pfSense)?

You buy a “VPN router” because you’re tired of playing whack-a-mole with VPN apps on every device — and you want one box at the edge that can encrypt traffic, enforce rules, and keep your network sane. pfSense is built for that job: firewalling, routing, and running VPN tunnels at the gateway so clients on your LAN don’t need special software (unless you want remote access).

What makes this platform different from the typical consumer VPN router is that it’s a full firewall/router OS with an enterprise-style ruleset and a serious VPN stack, not a glossy mobile app. It’s aimed at people who care about control: homelabs, small offices, MSP-style deployments, and anyone who wants granular network segmentation (VLANs) and policy-based routing through VPN tunnels.

There are two main “flavors” people mean when they say “Netgate (pfSense)”: pfSense Community Edition (CE) (open source, Apache 2.0 licensed) and pfSense Plus (Netgate’s commercial product line, included with Netgate appliances and sold as a subscription for third-party hardware/VMs). Netgate introduced pfSense Plus and renamed the open-source project to pfSense CE in January 2021.

Netgate (pfSense) Features and Performance

pfSense’s “VPN router” value is straightforward: it can terminate VPNs on the router/firewall and then apply firewall rules and routing policy to the decrypted traffic. Out of the box, the project is centered on IPsec and OpenVPN (both are first-class citizens in the docs and UI), and it also supports WireGuard via an add-on package. L2TP is present, but pfSense’s own documentation explicitly warns it has severe limitations and should generally be avoided unless absolutely necessary.

Protocols (what you can actually deploy)

• IPsec: Used heavily for site-to-site and remote access, and it’s part of the core platform. pfSense documentation covers site-to-site IPsec configuration and also notes IPsec+L2TP support in certain versions.
• OpenVPN: Also core to pfSense, commonly used for both remote access and site-to-site. Where pfSense Plus gets particularly interesting is performance optimization (see DCO below).
• WireGuard: WireGuard support has a history in pfSense. Netgate initially introduced a kernel-mode WireGuard implementation for pfSense/FreeBSD, then removed it from pfSense “base” in March 2021 “out of an abundance of caution” after concerns surfaced and after kernel-mode WireGuard was removed from FreeBSD at the time. Later, WireGuard returned as an experimental package distributed via pfSense’s package system. Current docs instruct you to install the WireGuard package from the Package Manager.
• L2TP: Supported, but pfSense’s documentation is blunt: L2TP over IPsec “has severe limitations and problems” and should be avoided unless necessary; it also notes common client/NAT interoperability problems (especially for Windows behind NAT) and recommends IKEv2 IPsec, OpenVPN, or WireGuard instead.

(For VPNSpotter’s database alignment: the verified protocol list you provided — IPsec, OpenVPN, WireGuard, L2TP — matches what pfSense documentation describes, with WireGuard implemented via package.)

Performance characteristics (what drives speed)

pfSense performance is less about a vendor “speed claim” and more about hardware + crypto path + configuration. Netgate’s own documentation on VPN scaling calls out a few realities:

• Traditional OpenVPN (without special acceleration) has more overhead than IPsec/WireGuard because it’s less efficiently integrated into the OS. The docs explicitly suggest using IPsec or WireGuard if DCO can’t be used.
• OpenVPN Data Channel Offload (DCO) exists specifically to reduce overhead by keeping most data handling in-kernel, and Netgate’s docs say it can bring “huge performance gains.” Netgate also documents that pfSense Plus 22.05 or later is required and that DCO is not available on pfSense CE.
• Hardware crypto matters. pfSense documentation covers cryptographic accelerators and states that when using OpenVPN in DCO mode on pfSense Plus, OpenVPN can use accelerators such as QAT or IPsec-MB automatically when enabled on compatible hardware.

So, if you’re evaluating pfSense as a VPN router for “speed,” the no-BS answer is: the ceiling is set by your CPU/NICs and the VPN mode you choose. WireGuard and IPsec are typically the most throughput-efficient options in the docs, while OpenVPN can become competitive on pfSense Plus when DCO is usable end-to-end (or at least on one side).

Security architecture (how it’s built)

pfSense is a firewall/router distribution built on FreeBSD, with a web UI for configuration and a package system for extensions. The project code for pfSense CE is published under the Apache 2.0 license (and the code is on GitHub), which matters for transparency and independent scrutiny.

On pfSense Plus specifically, Netgate positions it as a product line intended to support business requirements and a faster release cadence. Netgate’s documentation says Plus has major updates scheduled three times per year, with additional point releases as required.

Distinctive features for VPN-router use

A few things stand out if you’re buying this for VPN routing rather than “just a firewall”:

• OpenVPN DCO (pfSense Plus only): This is one of the most meaningful differentiators if OpenVPN is your standard. Netgate’s docs describe DCO as a performance feature (kernel handling, fewer context switches, multithreaded encryption).
• WireGuard via package: You can run WireGuard tunnels, but you should understand the implementation history (removed from base, returned as package, described as under active development in release notes). If you want “set it and forget it” stability, read the current docs carefully and test your specific configuration.
• L2TP exists, but pfSense tells you not to rely on it: That’s actually useful honesty from the vendor docs — and a clue that pfSense expects modern deployments to use IKEv2 IPsec, OpenVPN, or WireGuard instead.

Pricing and Plans

Your database flags the pricing model as paid, which aligns with how pfSense Plus is sold (and how most people mean “Netgate pfSense” as a commercial VPN-router product).

Netgate’s official pricing page breaks pfSense Plus into three delivery models:

1. Netgate appliances: pfSense Plus is included “at no charge” when purchasing a Netgate appliance, with appliances “starting at $189” on the pricing page (hardware cost).
2. Cloud marketplaces (AWS/Azure): pfSense Plus is available through Amazon and Azure marketplaces, with pricing shown as hourly software rates (Netgate lists a range, starting at $0.08/hr) and notes that “Free 30 day software trials are also available.”
3. Software subscription for third-party hardware/VM: Netgate lists software “starting at $129/yr” for pfSense Plus on third-party hardware using the Netgate Installer.

Netgate also publishes a subscription table showing per-instance, per-year pricing tiers for pfSense Plus with different TAC support levels:

• pfSense+ with TAC Lite: $129/yr per instance (and TAC Lite is “complimentary for all Netgate branded appliances”).
• pfSense+ with TAC Professional: $399/yr per instance.
• pfSense+ with TAC Enterprise: $799/yr per instance.

What we did not find in the official sources above: a clearly stated refund window for software subscriptions on the pages we pulled. Since that’s not confirmed here, this review won’t claim a refund policy.

Also worth calling out: pfSense CE exists as a no-charge download (separate from the paid pfSense Plus offering), so if you’re evaluating “pfSense” as a platform, there is a free path — but Netgate (pfSense) as a commercial VPN-router product is largely a pfSense Plus story.

Privacy and Security Assessment

Jurisdiction: United States

Netgate is a US-based company (your database lists jurisdiction: USA). That’s not inherently “bad,” but it does matter for threat models involving US legal process. If you’re buying a VPN router, the jurisdiction question is usually less about the router vendor “logging your traffic” and more about who you trust for:

• update infrastructure,
• support contracts,
• any required registration/subscription,
• and the security posture of the code you run.

Open-source vs closed-source posture (CE vs Plus)

• pfSense CE: The pfSense project says the source code is open source under the Apache 2.0 license, and the main pfSense repository on GitHub is Apache-2.0 licensed.
• pfSense Plus: Netgate documents pfSense Plus as a Netgate product distinct from CE, created in January 2021; Netgate’s docs emphasize business features and release cadence differences.

From a privacy and security standpoint, that split matters: CE gives you maximum code transparency; Plus gives you vendor support and some Plus-only capabilities (notably OpenVPN DCO), but it’s not positioned the same way as a community-distributed open-source build.

WireGuard incident history (real-world criticism)

pfSense has one very public VPN-related stumble: Netgate introduced kernel-mode WireGuard support, then removed WireGuard from pfSense CE and pfSense Plus base releases in March 2021, stating that concerns had surfaced, kernel-mode WireGuard had been removed from FreeBSD, and that Netgate was removing it pending “a thorough review and audit.”

Later, Netgate announced WireGuard’s return as an experimental add-on package built and distributed through pfSense’s package system, and current pfSense documentation describes WireGuard use via that package.

The practical takeaway: pfSense can do WireGuard, but if WireGuard is mission-critical for you, you should validate the exact pfSense version + package version you intend to deploy, and you should be comfortable tracking updates.

“No-logs” status

This is not a consumer VPN service; it’s router/firewall software. There’s no meaningful “no-logs policy” in the VPN-provider sense to audit. pfSense can generate logs as part of firewall/VPN operations (and WireGuard is described in the docs as having minimal kernel logging), but what gets logged is primarily under administrator control and depends on configuration.

Strengths and Limitations

Strengths

• Real firewall/VPN platform, not a toy router: pfSense is built around enterprise-style firewalling and multiple VPN types (IPsec, OpenVPN, and WireGuard via package).
• OpenVPN performance upside on pfSense Plus: DCO is documented as providing major performance gains and is integrated into pfSense Plus (22.05+), which can matter if you standardize on OpenVPN.
• Hardware acceleration support (where available): Netgate documents QAT/IPsec-MB use with OpenVPN DCO when enabled on compatible hardware.
• Choice of free CE vs paid Plus: You can start with CE at no cost, or pay for Plus subscriptions/support (or buy a Netgate appliance with Plus included).

Limitations / trade-offs

• WireGuard isn’t “core” in the same way: It’s installed from the Package Manager, and Netgate’s release notes have explicitly called it “still under active development” (in the context of package availability after removal from base).
• L2TP is available but strongly discouraged: pfSense’s own documentation says L2TP over IPsec has severe limitations and should usually be avoided.
• pfSense Plus is a subscription on third-party hardware: If you want Plus-only features like OpenVPN DCO, the official pricing is per-instance per year (e.g., $129/yr for TAC Lite).
• Not plug-and-play: pfSense is powerful, but it expects you to understand networking (interfaces, NAT, firewall rules). Even the GitHub readme notes a learning curve for users unfamiliar with commercial-grade firewalls.

Who Should Use Netgate (pfSense)?

Good fits

1. Power users who want per-device or per-network VPN routing rules: If you want certain VLANs/devices to go through a VPN tunnel while others go direct, pfSense is designed for policy-driven networking.
2. Small offices / homelabs that need site-to-site VPN: IPsec and OpenVPN are core, well-documented options for linking networks.
3. OpenVPN-heavy environments that need higher throughput: If you can run pfSense Plus 22.05+ and your peers support it, OpenVPN DCO is explicitly designed to improve performance.

Not good fits

1. People who want a consumer VPN app experience: pfSense is a firewall/router platform; it’s not “click connect and forget.”
2. Anyone counting on L2TP as a primary remote-access method: pfSense’s docs say to avoid L2TP over IPsec unless necessary.
3. WireGuard-only buyers who don’t want to manage packages/updates: WireGuard is supported, but as an add-on package and with a history of being removed from base pending review; you should be comfortable validating versions and testing.