- One installer, two editions: the closest like-for-like swap
- Web-managed firewall distributions
- Router operating systems
- Firmware for embedded routers
- Appliances and managed products
- The eight compared
- VPN support at a glance
- Questions to ask before you commit
- Moving your firewall without a dark evening
- Frequently asked questions
Leave only when you can name the reason: a different licence, a router-first system, or hardware that arrives with the firewall built in. For the closest swap, look at another web-managed firewall distribution. For automation, a router operating system driven from the command line. For consumer kit, router firmware. If you'd rather someone else handles it, a ready-made appliance.
pfSense calls itself a free, open source build of FreeBSD shaped into a firewall and router you manage from a browser. It was forked from the m0n0wall project in 2004. People start looking elsewhere for three main reasons: a different licence or project model, a platform that behaves more like a router than a firewall, or hardware and software sold together as one box.
The eight options below are grouped by those reasons, so jump to whichever matches yours.
One installer, two editions: the closest like-for-like swap
First, know how pfSense reaches you now. Its download page routes both the Plus and CE editions through the Netgate Installer, and Netgate sells Plus as an appliance, as software for bare metal or a virtual machine, and as a cloud option. If that arrangement is what's nudging you away, the nearest swap is OPNsense.
Like pfSense, it sits on FreeBSD. It supports several internet connections at once (multi-WAN), IPsec, OpenVPN and WireGuard, and CARP-based hardware failover. Its homepage claims a simplified 2-clause BSD/MIT licence and says no other open source security platform uses one, so the licence is the point of difference, not the feature list.
Put simply: if you like how your firewall works and only object to how it's packaged, start there. If you want something that works differently, read on. Our pfSense and OPNsense head-to-head goes deeper on that one pairing.
Web-managed firewall distributions
These keep the familiar shape: install on a box, then manage rules from a browser tab.
IPFire
Billed by its makers as the open source firewall, and described as free software. It supports three VPN flavours: WireGuard, OpenVPN and IPsec.
OPNsense
The FreeBSD-based platform covered above, offered as a Community Edition next to a paid Business Edition.
Router operating systems
Pick from this pair if routing is the main job and the firewall is one feature among several.
MikroTik RouterOS
The system inside MikroTik's own routers, switches and wireless kit, bundling routing, firewalling, VPN, wireless control, quality of service, automation and monitoring into one platform. The same system runs across that whole range of kit, so one set of skills covers it.
VyOS
Open-source networking software with a single CLI and API for everything. You can run it on ordinary servers, inside virtual machines or across several clouds.
Firmware for embedded routers
This is the route for anyone who'd like to give a shop-bought router a second life.
OpenWrt
A Linux system aimed at embedded devices, with a writable filesystem, the opkg package manager and a browser interface called LuCI. Because packages arrive through opkg, you add only the features you need.
Appliances and managed products
For people who'd rather buy a box that works than assemble one.
Arista NG Firewall
Formerly Untangle. The old Untangle web address now leads to Arista's Edge Threat Management pages, where NG Firewall is presented as a modular single platform.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Endian
Two lines of gateways, and the one for office networks is sold as UTM security for business IT.
Firewalla
Hardware firewalls in Gold, Orange and Purple series, listing VPN server and client, ad and tracker blocking, and network segmentation.
The eight compared
| Option | Shape | Model |
|---|---|---|
| Arista NG Firewall | Platform | Commercial |
| Endian | Gateways | Commercial |
| Firewalla | Box | Commercial |
| IPFire | Distro | Open source |
| MikroTik RouterOS | Router OS | Commercial |
| OPNsense | Distro | Open source |
| OpenWrt | Firmware | Open source |
| VyOS | Network OS | Open source |
Four of the eight are open source, and four are commercial products. Neither column is automatically safer; it's about who you want to call when something breaks at 9pm.
Open source projects give you the code and a community, and some sell a business edition or support on top. Commercial products give you a company to deal with. If you run a small office with nobody technical on site, a support line may be worth more than any feature. If you run a home lab because you enjoy it, an open project lets you see and change everything.
VPN support at a glance
| Option | VPN types named |
|---|---|
| Firewalla | VPN server and client |
| IPFire | WireGuard, OpenVPN, IPsec |
| MikroTik RouterOS | VPN built into the platform |
| OPNsense | WireGuard, OpenVPN, IPsec |
Remote workers and branch offices are often the real reason a firewall exists, so match this table to the clients you already run. For Arista NG Firewall, Endian, OpenWrt and VyOS, check each one's documentation for the exact VPN types before you shortlist them.
Questions to ask before you commit
- Who maintains it, and how quickly do security fixes arrive?
- Can you back up the full configuration to a single file and restore it on new hardware?
- Which VPN types do your remote users and branch offices need, and are they all supported?
- Do you need two internet connections, or hardware failover between two firewalls?
- Will you manage it from a browser, from a command line, or through automation tools?
- If it's a commercial box, what happens to updates when the support contract ends?
Write the answers down for your top two candidates. The one you can answer fastest from its own documentation is usually the one that'll be easiest to live with.
Moving your firewall without a dark evening
- Save today's configuration file. Next, describe each filter, forwarded service, remote tunnel and fixed address assignment in everyday language.
- Pick one candidate from the group that matches your reason, plus one backup.
- Trial it on spare kit or a VM, never the live box. Give it at least a few evenings of real traffic.
- Rebuild your rules by hand rather than trusting an import. It's slower, and it's how you find the rules nobody remembers adding.
- From a phone off your Wi-Fi, confirm remote VPN logins still work.
- Make the swap during a quiet window and keep the previous box unplugged but ready for a week.
If you can't explain why a rule exists, don't carry it over until someone asks for it. A move is the best moment you'll ever get to clear out years of exceptions.
Want your tool on this list? Featured spots and reviews here are paid partnerships. Here's how to partner with me.
Frequently asked questions
Does Endian cover factory networks?
Yes. Endian sells a second family of gateways aimed at industrial OT environments, separate from its business IT range.
Does IPFire sell hardware?
Yes. It sells appliances and support alongside the free software.
Can I keep my existing firewall hardware?
If the option installs as software, often yes, but check its hardware requirements first. Firewalla and Endian sell their own gateways.
Is there a choice suited to automating many routers?
VyOS documents Ansible and an HTTPS API, and MikroTik RouterOS lists automation among its built-in tools.
Can I try a commercial product before buying?
Arista offers a free trial of NG Firewall. For the others, ask the vendor what evaluation they allow.
Will OpenWrt run on my home router?
It targets embedded devices, but support varies by model, so check the project's device list before flashing anything.
