Tools
A curated directory of 9 tools we use, evaluate, and recommend across the AI security landscape — with our take on each.
Our Tools
pfSense Hardware Sizing Calculator
Enter WAN speed, feature load (Suricata IDS/IPS, VPN type + throughput, pfBlockerNG, shaping), users and NIC needs and get a recommended CPU class, RAM, NIC guidance, storage and a hardware tier — plus the specific feature that bottlenecks your throughput.
Our take
We built this because people size pfSense boxes around 'the firewall' when the real cap is almost always Suricata IPS or OpenVPN. It names the bottleneck and warns about the Realtek-NIC trap so you don't buy a box that throttles at half your WAN speed.
Core pfSense
pfSense CE
FreeBSD-based firewall maintained by Netgate. The Community Edition is the open-source release; pfSense Plus is the Netgate-hardware-only closed variant.
Our take
Mature and stable. The slower release cadence vs OPNsense is the main downside; the upside is rock-solid LTS-style behavior. CE remains our recommendation over Plus for non-Netgate hardware.
Packages
pfBlockerNG
DNSBL ad-blocking + GeoIP blocking + IP feed aggregation. The combined ad-block + threat-intel package that defines a lot of homelab pfSense installs.
Our take
First package most people install. Run the DNSBL in mode "unbound mode" rather than null IP for cleaner client-side behavior. The GeoIP block lists are easy to over-tune — start permissive.
Suricata
IDS/IPS engine, same as OPNsense ships. Snort is also available as an alternative package.
Our take
Default IDS on pfSense in 2026. Start in IDS-only mode and tune for a month before flipping to IPS. ET Open ruleset is enough for most homelabs.
OpenVPN
Built-in to pfSense. Remote-access and site-to-site VPN with TLS/PSK and 2FA support.
Our take
Still the most-deployed pfSense VPN option, with mature client support everywhere. Move new deployments to WireGuard unless you specifically need OpenVPN's compatibility.
WireGuard (pfSense)
WireGuard support in pfSense 2.7+. Earlier history was rocky (briefly bundled then removed in 2021); now stable.
Our take
First-class on current pfSense. Default choice for new VPN deployments. Watch CPU on slower Netgate boxes — wg in-kernel is fast but the smallest appliances are still bottlenecked.
HAProxy
Reverse proxy / load balancer package with ACME plugin for automatic TLS certs.
Our take
Right pick when the firewall doubles as the reverse proxy. Same caveat as OPNsense: at scale, a dedicated Docker host running Traefik is more flexible.
Hardware
Netgate SG-2100
Entry-level Netgate appliance. ARM-based, ships with pfSense Plus.
Our take
Reasonable starter if you want first-party Netgate support and don't mind ARM. For more horsepower, jump straight to the SG-1100's successor tier or move to x86 hardware (Protectli, generic mini-PC).
Protectli FW4C
Fanless x86 mini-PC. Officially supported for pfSense CE installs.
Our take
Best price/performance for self-installed pfSense CE. AES-NI throughput beats the entry-level Netgate boxes.