pfSense Plus vs CE Differences Explained: Which to Run

pfSense Plus vs CE differences explained in short: CE is the free, Apache-licensed edition for any amd64 box; Plus is Netgate’s closed-source branch with OpenVPN DCO, QAT crypto offload, GUI-managed ZFS boot environments, Layer 2 filtering, ARM support and faster releases. Plus is free on Netgate appliances and from $129/yr elsewhere. Most homelabs should run CE.

Both editions come from one codebase. Netgate introduced Plus in January 2021 and renamed the open-source project Community Edition at the same time. Right now they are closely aligned: Netgate’s version table lists Plus 26.07 (2026-08-13) and CE 2.9.0 (2026-08-20) on FreeBSD 16-CURRENT with the same config revision, 24.6. If you are new to the platform, start with what pfSense is and where it fits.

What are the actual differences between pfSense Plus and CE?

Five things differ: license and source access, price, a short list of Plus-only features (mostly crypto offload and enterprise plumbing), CPU architecture support, and release cadence with vendor support attached. Firewall rules, outbound NAT, port forwards, VLAN interfaces, DHCP and the DNS Resolver work the same way on both, so a working CE design moves to Plus without a redesign.

Feature rows come from Netgate’s Plus overview, licensing from the pfSense Plus FAQ, which states Plus “is closed source” while CE “will remain Apache licensed,” and architecture from the CE download page, which offers amd64 images only, and Netgate’s hardware selection guide, which lists Plus-compatible Netgate appliances on arm (armv7) and arm64.

Which Plus-only features matter on a home network?

For a typical 1 to 4 VLAN home network, none of them is mandatory. DCO matters if you run a busy OpenVPN server on modest hardware, boot environments matter if you upgrade on release day, and unicast CARP matters only for HA pairs on networks that drop multicast. If your remote access is WireGuard, the headline Plus performance feature does nothing for you.

OpenVPN DCO. Data Channel Offload keeps encrypted packet processing in the kernel instead of switching context for every packet. Netgate’s DCO documentation lists hard constraints: Plus 22.05 or later, UDP only, AES-256-GCM, AES-128-GCM or ChaCha20-Poly1305 only, no compression, TLS-based modes only, no /30 or smaller peer-to-peer tunnel networks, and no multi-client site-to-site server with LAN-to-LAN routing yet. A road-warrior server on UDP/1194 with AES-256-GCM is the ideal case. If clients can move to WireGuard, which both editions support, the gap mostly disappears; the trade-offs are in OpenVPN DCO vs WireGuard on pfSense.

QAT, IPsec-MB, SafeXcel and CESA. Plus supports Intel QuickAssist hardware acceleration and Intel IPsec Multi-Buffer, which uses extended CPU instructions for crypto. On ARM appliances it drives SafeXcel (Netgate 1100, 2100) and CESA (Netgate 3100). These pay off when IPsec throughput is the bottleneck, such as several site-to-site tunnels on a busy office link. A homelab with one or two tunnels rarely gets there.

ZFS boot environments. Plus manages boot environments from the webConfigurator and adds a ZFS dashboard widget. The workflow: snapshot before upgrading, and if the new release breaks a package or a NIC driver, boot the previous environment. CE has no GUI for this, so the CE rollback plan is an exported config.xml from Diagnostics > Backup & Restore plus a reinstall, or a hypervisor snapshot if the firewall is a VM.

CARP unicast. Plus lets you choose multicast or unicast CARP advertisements. Unicast is the fix when the segment between HA nodes filters multicast, which many cloud networks do. A CE pair needs a sync and LAN path that passes multicast cleanly; the CARP failover guide covers that layout.

The rest of the list. LDAP client certificates, plus three Plus-only add-on packages: the AWS VPC VPN Connection Wizard, the IPsec Profile Wizard and OpenVPN Client Import. Layer 2 rules, NetFlow export and 802.1X WAN bridging from the table matter to specific ISP or monitoring setups, not to most homes.

How much does pfSense Plus cost in 2026?

pfSense Plus is included free on Netgate appliances, starts at $129 per year on your own hardware or a VM through the Netgate Installer, and costs $0.08 to $0.40 per hour on AWS and Azure, according to Netgate’s pricing page. CE costs nothing on any amd64 hardware. The free Plus Home+Lab tier no longer exists.

Netgate ended free Home+Lab downloads on October 26, 2023, citing appliance vendors that redistributed the image on their own boxes. The same post says CE users “will continue to receive updates and security patches,” and Netgate appliance owners keep TAC Lite for the appliance’s lifespan.

The arithmetic for common builds:

• One DIY box or mini PC: CE at $0, or Plus at $129/yr, which is $387 over three years.
• CARP pair on DIY hardware: the migration doc notes activation tokens are single use, so plan on one subscription per node.
• Netgate appliance: Plus is included in the hardware price; check current prices on Netgate’s appliance page, because they change. Whether the entry model has the throughput your WAN needs is a separate question, covered in Netgate vs Protectli vs DIY.

How different are the release cadences?

Plus ships on a calendar and CE ships when it is ready. Since January 2024, Netgate has shipped six Plus feature releases (24.03, 24.11, 25.07, 25.11, 26.03, 26.07) and three CE releases (2.8.0, 2.8.1, 2.9.0). The longest CE gap ran from 2.7.2 on 2023-12-07 to 2.8.0 on 2025-05-28, nearly 18 months.

That split was announced up front. Netgate’s 2021 direction post said CE releases would be “done when they’re ready, not on a regular cadence.” Plus is documented as getting major updates “scheduled three times per year,” though the version table shows two Plus feature releases in each of 2024 and 2025, with point releases such as 25.07.1 and 25.11.1 between them.

Operationally, fixes reach CE only when a CE release ships. CE 2.9.0 rolled up upstream fixes for WireGuard, OpenSSL and the DHCP client along with pfSense advisories. Plus tracks FreeBSD upstream more closely, which helps when new hardware needs a newer driver. Today the two sit a week apart on the same base and config revision, the cleanest window in years to move between them.

Can you switch between CE and Plus?

Yes: CE to Plus migrates in place, while Plus to CE needs a reinstall. Normal upgrades never cross editions. Netgate’s upgrade guide states that “pfSense CE software installations will upgrade to the latest version of pfSense CE software,” and Plus stays on Plus. Changing edition is always a deliberate step.

CE to Plus, per Netgate’s migration procedure:

1. Run CE 2.6.0 or later with working internet access, and export a config backup.
2. Paste the single-use activation token under System > Register.
3. Under System > Update, select the “pfSense Plus Upgrade” branch and confirm.
4. Do not reboot or pull power until the migration completes and the system restarts.

Plus to CE: the Plus FAQ says plainly that “a reinstall is required.” Export config.xml, install CE, restore. Match config revisions: a backup from Plus 26.07 (rev 24.6) lines up with CE 2.9.0 (rev 24.6), while restoring it to CE 2.8.1 (rev 24.0) loads a newer schema onto an older release, the risky direction. Settings for Plus-only features such as DCO, unicast CARP and Layer 2 rules have no CE equivalent, so plan to rebuild those parts. If the firewall is virtual, snapshot first; the Proxmox install guide covers that layout.

Which edition should you run?

Run CE on a mini PC, DIY build or Proxmox VM unless a Plus feature solves a problem you have today. Run Plus on any Netgate appliance, because it is included and CE does not support the ARM models. Pay for Plus on your own hardware only for DCO, crypto offload, unicast CARP or a vendor support contract.

• Homelab with 1 to 4 VLANs, WireGuard and pfBlockerNG on an x86 mini PC: CE. Nothing on the Plus list changes this design, and the VLAN setup guide applies unchanged.
• Netgate 1100 or 2100 owner: Plus. These are ARM models, CE cannot run on them at all, and Plus is offered at no charge on Netgate appliances.
• Netgate 4200 or 6100 owner: Plus as well: it is offered at no charge on Netgate appliances, so there is no licence cost to weigh.
• Office with a busy OpenVPN road-warrior server that cannot move to WireGuard: Plus, for DCO, provided the tunnels meet the UDP and cipher constraints.
• HA pair on a cloud network that drops multicast: Plus, for unicast CARP, with one subscription per node.
• Hard open-source requirement: CE. If CE’s cadence is the sticking point, the alternative is OPNsense; see pfSense vs OPNsense.
• A business that needs a vendor to call: Plus. Netgate’s TAC tiers are sold as Plus subscriptions; CE support is the community forum.

FAQ

Is pfSense Plus free for home use?

Only on Netgate hardware. Netgate ended the free Home+Lab download on October 26, 2023, so running Plus on a mini PC, DIY build or VM now needs a paid subscription starting at $129 per year. Plus remains included with every Netgate appliance, and pfSense CE stays free for home and commercial use.

Is pfSense CE being discontinued?

No. Netgate’s position since the 2023 licensing change is that CE remains free and keeps receiving updates and security patches, and the code stays Apache-licensed on GitHub. CE 2.9.0 shipped on August 20, 2026, on FreeBSD 16-CURRENT. The catch is cadence: CE releases arrive when ready, not on a schedule.

Is pfSense Plus faster than CE?

Only where Plus has an offload feature that CE lacks. Both editions share the FreeBSD base and pf packet filter, and Netgate’s Plus feature list documents no routing or NAT speedup. The documented gains are for encrypted traffic: OpenVPN DCO for UDP tunnels, plus Intel QAT, IPsec Multi-Buffer and the SafeXcel and CESA engines on ARM appliances.

Can I run pfSense Plus in Proxmox?

Yes, with a paid subscription. Plus on a virtual machine or any non-Netgate hardware needs a subscription starting at $129 per year, installed through the Netgate Installer. CE runs in Proxmox for free. Activation tokens are single use, so a CARP pair of Plus VMs needs two subscriptions, one per node.

Related across the network

• OPNsense vs pfSense for Homelab: Packages, Updates, IDS — opnsenselab.com
• OPNsense vs pfSense in 2026: Honest, Side-by-Side Comparison — firewallcompare.com