The best pfSense hardware for most home and small-office networks is the Netgate 4200 MAX: four 2.5GbE ports, passive cooling, pfSense Plus with lifetime updates, and 3.21 Gbps of Netgate-published IMIX firewall throughput for $829. Running free pfSense CE instead? Buy a Protectli VP2420e or an Intel N100 box with Intel i226-V ports, starting under $400.
Licensing is what decides it. Netgate sells pfSense Plus for third-party hardware from $129 a year, installed by migrating an existing CE install. The Netgate 4200 MAX includes Plus, “complimentary software updates for the life of the product” and TAC Lite support. Three years of the entry Plus license costs $387, most of the gap between a $359 Protectli and an $829 Netgate. If CE covers what you run (see the pfSense Plus vs CE comparison), that argument disappears and third-party hardware wins on cost per port.
Netgate’s own sizing guidance warns that “estimating throughput of third party / white box hardware is difficult and inaccurate.” Netgate publishes iPerf3 and IMIX results for its appliances. Protectli and the N100 board vendors publish nothing equivalent for pfSense. Size CPU, RAM and NICs first with the pfSense hardware requirements guide.
The shortlist: specs, throughput and price
| Model | CPU | Ports (1G / 2.5G / 10G SFP+) | Firewall, 10k rules (iPerf3 / IMIX) | IPsec (iPerf3 / IMIX) | Software | Price |
|---|---|---|---|---|---|---|
| Netgate 1100 | 2-core ARM Cortex-A53, 1.2 GHz | 3 switched / 0 / 0 | 607 / 191 Mbps | 247 / 90 Mbps | Plus included | $289 |
| Netgate 4200 MAX | 4-core Atom C1110, 2.1 GHz, VAES | 0 / 4 / 0 | 8.61 / 3.21 Gbps | 3.20 / 1.05 Gbps | Plus, TAC Lite included | $829 |
| Netgate 6100 | 4-core Atom C3558, 2.2 GHz, QAT | 2 combo / 4 / 2 | 9.93 / 2.73 Gbps | 1.77 Gbps / 552 Mbps | Plus included | $1,499 |
| Netgate 8200 | 8-core Atom C3758R, 2.4 GHz, QAT | 2 combo / 4 / 2 | 18.55 / 5.1 Gbps | 3.24 Gbps / 810 Mbps | Plus included | $2,399 |
| Protectli VP2420e | Celeron J6412, 4C/4T | 0 / 4 I226-V / 0 | Not published | Not published | CE free; Plus from $129/yr | $359 |
| Protectli VP2440e | Intel N150, 4C/4T | 0 / 2 I226-V / 2 X710 | Not published for pfSense | Not published for pfSense | CE free; Plus from $129/yr | $499 |
| Protectli VP6630 | Core i3-1215U, 6C/8T | 0 / 4 i226 / 2 X710 | Not published | Not published | CE free; Plus from $129/yr | $639 |
| Generic N100 box | Intel N100, 4C/4T | 0 / 4 i226-V / 0 | Not published | Not published | CE free; Plus from $129/yr | $216 barebones (2023) |
Netgate’s numbers come from its appliance catalog, measured through 10,000 firewall rules. Plan around IMIX, a mixed packet-size profile, rather than iPerf3, a large-packet best case: the 4200 drops from 8.61 to 3.21 Gbps between the two. IPsec is AES-GCM-128 everywhere except the 1100, which Netgate tested with AES-CBC-128 and SHA1. Prices are list on October 12, 2026. Netgate’s store says the 4200 price “includes a fluctuating memory and component cost,” and the VP2420e and VP6630 were on backorder.
None of these boxes supplies PoE, so access points and cameras need a PoE switch behind the firewall. Update cadence differs by edition: Netgate’s release history shows Plus 26.03, 26.03.1 and 26.07 shipping between April 1 and August 13, 2026, while CE moved from 2.8.1 (September 4, 2025) to 2.9.0 (August 20, 2026).
Netgate 4200 MAX: where it wins, where it loses
The 4200’s Atom C1110 is four Gracemont E-cores at a 13 W TDP with AVX2 and VAES. Netgate’s results put it ahead of the $1,499 Netgate 6100 on IMIX firewall (3.21 vs 2.73 Gbps) and IPsec (3.20 vs 1.77 Gbps). The 6100 only makes sense if you need its SFP+ cages.
Wins
- Software bundled. Plus, lifetime updates and TAC Lite. Plus also unlocks IPsec-MB acceleration, which Netgate’s cryptographic accelerator docs mark Plus-only and which covers IPsec, OpenVPN DCO and WireGuard.
- Real storage. A 128 GB NVMe SSD, not eMMC, so Suricata and pfBlockerNG logs land somewhere built for sustained writes.
- Silent. Passive aluminum chassis and heatsink, no fan.
Losses
- 4 GB of LPDDR5. Fine for routing, VPN and pfBlockerNG; tight for inline Suricata.
- No 10G. Four unswitched RJ45 2.5GbE ports, no SFP cage of any speed.
- Volatile price. The store attributes part of the $829 to memory and component costs, so check it on the day you buy.
Best hardware for pfSense CE: Protectli VP2420e or an N100 box
For CE on a 1 to 2.5 Gbps line, buy four Intel i226-V ports on a quad-core x86 CPU and stop there. Netgate’s hardware notes say “the best practice is to use Intel NICs because they have solid drivers in FreeBSD and they perform well,” and that USB network adapters “of any make/model should not be used.”
The Protectli VP2420e is the documented version of that box: a Celeron J6412 (4C/4T, 2.0 to 2.6 GHz, AES-NI), four Intel I226-V ports, one DDR4-3200 SO-DIMM slot up to 32 GB, 24 W maximum draw, AMI or coreboot firmware and a two-year warranty, for $359. It is the VP2420 without the onboard eMMC.
The generic alternative is an N100 box from CWWK, Topton and similar board vendors. ServeTheHome’s review of a fanless N100 unit with four i226-V ports priced it at $216 barebones in June 2023 and called Alder Lake-N units “game changers.” STH did not benchmark pfSense in that review; the Intel N100 pfSense build review collects owner reports on where WireGuard and inline IPS top out.
Wins: the lowest cost per 2.5GbE port, Intel NICs, and RAM and SSD you choose yourself.
Losses: no published pfSense throughput, hardware-only support, Plus at $129 a year if you later want it, and M.2 SATA only on the VP2420e, no NVMe. Netgate’s selection guide warns that “the use of open source operating systems with untested hardware may create hardware/software conflicts.” Generic listings also hide Realtek chips behind “2.5G LAN”; the pfSense ready hardware checklist shows how to catch that before you pay.
Which pfSense hardware handles 10G or heavy IPS?
For a 10G LAN on pfSense Plus, buy the Netgate 8200: 5.1 Gbps IMIX through 10,000 rules, two SFP+ cages, $2,399. On CE, the Protectli VP6630 pairs two Intel X710 SFP+ ports with a six-core Core i3-1215U and up to 96 GB of DDR5, the resources multithreaded Suricata uses. The fanless VP2440e is the budget 10G option.
The 6100 has the 8200’s port layout (two SFP+, four 2.5GbE, two 1G combo) but publishes 2.73 Gbps IMIX firewall, less than the 4200. Buy it for SFP+ on Plus, not for throughput.
The VP6630 runs 6 cores and 8 threads at up to 4.4 GHz, with two DDR5-4800 SO-DIMM slots, an NVMe slot and two 2.5-inch SATA bays, for $639. It is not fanless; Protectli fits fans that run only when needed. Suricata is multi-threaded, so cores and RAM pay off here; the Suricata vs Snort comparison covers the engine choice.
The VP2440e puts two Intel X710-BM2 SFP+ ports and two I226-V ports around a four-core N150 in a fanless case, for $499. Protectli’s hardware overview places the SFP+ pair on a PCIe 3.0 x4 link and reports about 9.38 Gbps of bidirectional unencrypted throughput, but measured on OPNsense 25.7, not pfSense. Treat it as a 10G routing box and keep inline IPS on the slower links.
One trap applies to both Protectli 10G models: Protectli says the X710 ports negotiate only 1G or 10G. If your ISP hands off at 2.5G or 5G, put the WAN on an i226 RJ45 port.
What to skip
- Netgate 1100 on a gigabit line. 607 Mbps iPerf3 and 191 Mbps IMIX through 10k rules. It is ARM, so Plus only; it suits a slower line and a short rule set.
- Netgate 2100. $599 for 1G ports, 964 Mbps iPerf3 and 249 Mbps IMIX firewall. The 4200 costs $230 more for roughly nine times the large-packet throughput, and Netgate’s selection guide lists the 2100 as an ARM appliance, so no CE.
- eMMC as the only disk on a logging box. Protectli’s own knowledge base says the VP2440’s eMMC is not recommended for operating systems with constant reads and writes; the “e” variants drop it entirely.
What you actually need
- Under 500 Mbps, basic rules, Plus on a budget: Netgate 1100.
- 1 to 2.5 Gbps WAN on Plus, IPsec or WireGuard, a few VLANs: Netgate 4200 MAX. Four ports cover two WANs for multi-WAN failover, a LAN trunk and a spare.
- The same line on CE with pfBlockerNG: Protectli VP2420e or a four-port i226-V N100 box with 8 to 16 GB RAM and an SSD.
- 10G to the core switch on CE: Protectli VP2440e.
- Inline Suricata on several interfaces: Protectli VP6630 on CE, Netgate 8200 on Plus.
- High availability: two identical boxes, each with a spare port for pfsync; see the CARP failover guide.
- An existing Proxmox host: a VM via the Proxmox install guide, accepting that every host reboot takes the gateway down.
FAQ
is netgate hardware worth it for pfsense
Yes, if you want pfSense Plus. Netgate appliances include Plus, lifetime software updates and TAC Lite, while Plus on third-party hardware starts at $129 a year. If CE is enough, you are paying for validation and vendor support you may not need, and a Protectli or N100 box with Intel NICs costs far less.
can i run pfsense on a mini pc
Yes. pfSense runs on any 64-bit amd64 mini PC with at least 1 GB of RAM, an 8 GB disk and a supported NIC, per Netgate’s minimum requirements. In practice, insist on two or more Intel ports, such as the i226-V, and an SSD. Avoid Realtek-only listings and never use a USB adapter as a second port.
does pfsense run on a raspberry pi
No. Netgate’s hardware documentation lists Raspberry Pi, other non-Netgate ARM devices, PowerPC, MIPS and SPARC as not compatible. pfSense runs on 64-bit amd64 hardware and on Netgate’s own ARM appliances, such as the 1100 and 2100, which ship with pfSense Plus. For a low-cost build, use an x86 mini PC with Intel NICs instead.
is 4 gb of ram enough for pfsense
Yes, for routing, NAT, VPN and pfBlockerNG on a home or small-office network. It gets tight once Suricata or Snort runs: Netgate’s sizing guidance calls 1 GB a minimum for those packages and says some configurations need 2 GB or more, not counting the OS, state table and other packages. For inline IPS, buy 8 GB or more.
