pfSense Hardware Sizing Calculator
Enter your WAN speed, feature load, users and NIC needs to get a recommended CPU class, RAM, NIC guidance, hardware tier and bottleneck.
This calculator estimates workload headroom. Check the pfSense minimum and recommended requirements for installation compatibility, then use these estimates to compare configurations.
Your workload
Sizing report card
Recommended hardware tier
- Netgate 2100 (ARM)CPU index 90 | WAN class 940 Mbps | 4 GB RAM | Marvell 88E6141 switch, 1 GbE
Good for: Plain firewall + light pfBlockerNG on a 1 GbE line. Official pfSense Plus support.
Not for: Suricata IPS at line rate, multi-gig WAN, OpenVPN above ~150 Mbps.
- Protectli FW4C (Pentium J3710)CPU index 130 | WAN class 940 Mbps | 8 GB RAM | Intel I226-V 2.5G x4
Good for: 1 GbE firewall + pfBlockerNG + WireGuard/IPsec; light Suricata IDS.
Not for: Gigabit Suricata IPS, OpenVPN near a gig, sustained 2.5G+.
- Netgate 4200 (Atom C1110, 4C)CPU index 230 | WAN class 2500 Mbps | 4 GB RAM (soldered) | Intel 2.5G
Good for: Multi-gig WAN plain/firewall, Suricata IDS around 1 GbE, IPsec/WireGuard several hundred Mbps.
Not for: Gigabit-plus Suricata IPS, 10G line-rate, heavy OpenVPN, any profile that needs more than 4 GB RAM.
- Protectli VP46xx (10th-gen Core i3/i5)CPU index 420 | WAN class 5000 Mbps | 16 GB RAM | Intel i226 2.5G
Good for: Suricata IPS approaching 1 GbE, multi-gig WAN, WireGuard 1 Gbps+, busy pfBlockerNG.
Not for: 10G line-rate IPS, very large IDS rulesets at 2.5G+.
- Used SFF / Xeon-D / Ryzen (8C+, SFP+)CPU index 800 | WAN class 10000 Mbps | 32 GB RAM | Intel X5xx SFP+ (add-in)
Good for: 10G WAN, Suricata IPS at multi-gig, all VPN types fast, large rulesets. Best $/perf if you can DIY.
Not for: Low-power/silent/turnkey-support requirements (higher idle watts, no vendor support).
Methodology & honest caveats
Each feature is assigned a throughput-per-CPU coefficient (Mbps sustained per unit of a
single-thread-weighted CPU index). The required CPU index for a feature is
target_Mbps ÷ coefficient; the box must clear the maximum required index across every
feature you enable. That maximum is the bottleneck — and it is almost always Suricata IPS
(coefficient ≈ 1.6) or OpenVPN (≈
1.4), not plain firewalling (≈
12). OpenVPN without DCO also has a hard
~500 Mbps single-tunnel ceiling regardless of CPU, because it is single-process;
OpenVPN DCO on pfSense Plus is not bound by that cap.
RAM = base (1 GB OS, 2 GB floor) + Suricata ruleset (≈ 1 GB + per monitored interface) + pfBlockerNG feeds + state-table memory from your user count. NIC guidance flags onboard Realtek near or above its ~900 Mbps practical ceiling, or whenever IPS is on — BSD Realtek drivers struggle under high packet rates. Storage grows with Suricata and pfBlockerNG logs; SSD/NVMe is required once IDS is on.
Coefficients and hardware tiers live in src/data/pfsense-hw-model.json
(model v1.0.0). These are rounded planning figures across Netgate/Protectli-class hardware, not a
benchmark of your exact silicon — real numbers depend on packet size, ruleset, tunables and driver. Treat the
recommended tier as a floor; size up near any boundary or if you expect growth. Tiers are
listed without prices because vendor pricing changes; check the vendor's store for current figures.