Every home network has a firewall already. It lives in the router your provider sent, it has opinions you never agreed to, and you cannot read its rulebook. OPNsense and pfSense are the two well-known ways to swap it for one you can.
The short answer
Should you choose OPNsense or pfSense for a home firewall? Both run on ordinary 64-bit PC hardware, and at home the licence and the edition matter more than the feature list [1][12]. Our assessment: start with OPNsense Community Edition. It is free, it uses the plain 2-clause BSD licence [8], it ships two major releases a year [6], and its hardware tiers are written down [1]. Choose pfSense CE if you already know it. We would not start with pfSense Plus on your own hardware, because Netgate lists it with a yearly subscription there [15]. Put the firewall on a mini PC with at least two Ethernet ports [4][12], plug its WAN port into a LAN port of your FRITZ!Box first, and move to "firewall as main router" later if the double NAT annoys you. This guide does not rank the two products, and it does not configure VLANs; that stays in the VLAN guide below.
How it works
What a home firewall box does. It sits between your devices and the internet, tracks every connection in a state table, and drops what you did not ask for. It uses at least two network interfaces, one facing the internet (WAN) and one facing your devices (LAN). OPNsense's installer asks you to assign the first interface as LAN and the second as WAN [4]. Netgate's docs name the first two interfaces WAN and LAN by default [23]. Extra ports become extra networks.
Editions and licences. The four things people compare are not four equal products:
| OPNsense Community | OPNsense Business | pfSense CE | pfSense Plus | |
|---|---|---|---|---|
| Licence | 2-clause BSD [8] | same code family, paid subscription [9][11] | open source project code, Apache licensed according to Netgate [16] | closed source, built on open source parts [16] |
| Cost | free [8] | €149 per year on the shop page, undated [10] | no charge [15] | free on Netgate appliances; $129 per year "TAC Lite" listed for other hardware, undated [15] |
| Release rhythm | 6-month major cycle; 26.7 came out on 15 Jul 2026 [6][7] | selective upgrade path that lags behind the Community edition [9][10] | CE 2.9.0 on 20 Aug 2026 [20][22] | 26.07 on 13 Aug 2026 [21] |
| Your own hardware | x86-64 [1] | x86-64 [1] | amd64 [12] | via the Netgate Installer [15] |
Netgate's statements differ by date. The October 2023 announcement says the free Home+Lab version of Plus was withdrawn and that TAC Lite is only for Netgate appliances, cloud marketplaces, and commodity hardware with a TAC Pro or Enterprise subscription [17]. The undated Software Types page now lists TAC Lite at $129 per year [15]. Check Netgate's store on the day you decide. If a TAC Lite subscription lapses, the firewall keeps running but cannot update, and you cannot migrate from CE to Plus on a reinstall [18]. Netgate calls Plus a commercial fork of CE [16].
Functions that matter at home. Both cover what a household needs. Where we found a vendor statement, it is cited:
| Function | OPNsense | pfSense |
|---|---|---|
| Stateful firewall, NAT, port forwarding | yes [2][3] | yes, state table sizing is documented [13] |
| VLANs (802.1Q) | yes, up to 4096 per interface [3] | yes; the docs advise adapters that do VLAN processing in hardware [14] |
| VPN | OpenVPN, IPsec, WireGuard [3] | release notes name WireGuard, OpenVPN and IPsec fixes [19][21] |
| Intrusion detection | Suricata [3] | Snort and Suricata as packages [13] |
| Failover pair | CARP hardware failover [2] | not covered here |
Plus has extras that CE does not. Netgate names cryptographic accelerator support, Ethernet filtering and OpenVPN DCO (October 2023) [17], and the 26.07 notes add CoreDNS, ThreatGate and Snort 3 in the Netgate Nexus controller [21]. Whether you can use Nexus on your own hardware is unverified. Netgate also says that how much it supports CE "will be evaluated on an ongoing basis" [16]. Our assessment: that sentence is the real long-term risk of CE, and it is the best argument for OPNsense as a default.
Which Community release to expect. OPNsense 26.7 is based on FreeBSD 15.1 [7]. pfSense CE 2.9.0 is based on "FreeBSD 16-CURRENT" and carries a hardware note: some Celeron J devices can hit a kernel panic at boot, with a documented loader setting as the workaround [19]. Mini PCs often use such chips, so read the release notes of the version you install against your hardware before you flash anything.
Hardware: what the vendors write. Take the numbers from the two vendors, not from forum rules of thumb:
| OPNsense [1] | pfSense (own hardware) [12][13] | |
|---|---|---|
| CPU architecture | x86-64 | amd64; Raspberry Pi and other non-Netgate ARM devices are not compatible [14] |
| Minimum | 1 GHz dual-core, 3 GB RAM, 4 GB card; no features that write to disk | 1 GB RAM, 8 GB disk, one NIC; "not suitable for all environments" |
| Reasonable | 1 GHz dual-core, 4 GB RAM, 40 GB SSD | – |
| Recommended | 1.5 GHz multi-core, 8 GB RAM, 120 GB SSD | – |
| Throughput | 11–150 Mbps (minimum), 151–350 Mbps (reasonable), 350–750+ Mbps (recommended) | "estimating throughput of third party / white box hardware is difficult and inaccurate" |
Both vendors say the network card matters: OPNsense recommends Intel chipsets for LAN connections [1], Netgate calls Intel the best practice and says cheap cards use much more CPU [13][14]. Netgate also says USB network adapters should not be used [14]. OPNsense's top throughput tier is 750+ Mbps, so a vendor figure for a sustained 1 Gbit/s line with intrusion detection is unverified. Features change the sizing: Suricata or Snort need at least 1 GB of RAM on pfSense, and a web proxy or captive portal with many users needs more CPU on OPNsense [1][13]. Our assessment: for a home line, buy the recommended tier or better, with two or more Intel ports, and treat any watt or speed figure from a shop page as a claim to check. See the power guide below for measuring what your box actually draws.
Where it goes in your network. Two sensible places, one of them reversible:
| A: cascade behind the FRITZ!Box | B: firewall as main router | |
|---|---|---|
| How | FRITZ!Box stays on the line; the firewall's WAN port goes into a FRITZ!Box LAN port | the firewall connects to the line; the FRITZ!Box becomes a phone system or access point, or leaves |
| Good | easy to try and to undo; the telephone setup keeps working | one NAT, no double port forwarding, nothing upstream filters your traffic |
| Watch | double NAT; two sets of port forwards; two address ranges | you need a modem or ONT for your line; some providers need registration of your device |
| Fits | you are testing, or you need the FRITZ!Box for telephony and line | you host services or play online and want one clean NAT |
A in practice. The firewall's WAN gets a private address from the FRITZ!Box. OPNsense blocks "traffic claiming to come from private addresses" on WAN, which should not happen on a real public WAN [5]. Netgate describes the same option as typically wanted only on WAN interfaces [23]. Community sources report that you must untick both "Block private networks" and "Block bogon networks" when the WAN sits in a private network, and that the firewall's LAN must use a different address range from the FRITZ!Box's [29][30]. They also call router-behind-router setups complex, because ports must be opened on both devices [30]. For one service, such as WireGuard, forward exactly that port on the FRITZ!Box to the firewall's WAN address; AVM says sharing only the ports that are actually needed is safer than the alternative [24]. AVM's "Exposed Host" forwards all requests from the internet to one device and switches off the FRITZ!Box firewall for it. AVM says to use it for testing only, but also that it can make sense when another router with an integrated firewall sits behind the FRITZ!Box and provides server services [24]. It needs a public IPv4 address or IPv6 from your provider, and for IPv4 only one device can be the exposed host [24]. Our assessment: use the single-port forward first; enable Exposed Host only after you checked that the firewall's WAN blocks unsolicited inbound traffic, and check from outside your network. If your provider gives you no public IPv4 address, see the CGNAT guide below. For consoles, double NAT can lower your NAT type; the NAT type page below explains it. pfSense CE 2.9.0 adds partial, experimental "Port Restricted Cone" outbound NAT, which Netgate says is not yet full cone [19].
B in practice. Free choice of your own router has applied in Germany since August 2016, and the Bundesnetzagentur confirmed in January 2025 that it also covers fibre modems (ONT) [26][28]. The Verbraucherzentrale adds that on fibre you may need to register the device with your provider, and which method applies depends on the provider [27]. This is information, not legal advice. AVM describes two ways to keep a FRITZ!Box behind another router: as an IP client, in which its firewall is disabled and every device gets unrestricted access, or as a cascaded router, in which its firewall stays on [25]. AVM recommends IP-client mode for simple integration [25]; with your own firewall in front, that mode is a natural fit for telephony and Wi-Fi, because your firewall already protects the network. Whether your FRITZ!Box model can work as the modem for your line is unverified here; check AVM's page for your model.
In practice
Two short calculations show where the money and the memory go.
Cost over three years, vendor prices as listed, no conversion between currencies:
OPNsense Community 3 x 0 = 0
pfSense CE 3 x 0 = 0
OPNsense Business 3 x EUR 149 = EUR 447 (shop page, undated [10])
pfSense Plus, own hw 3 x USD 129 = USD 387 (Software Types page, undated [15])If a price changed since the pages were last updated, the sums change with it. For home use the Community editions cover the function list above, which is why we start there.
Memory for the state table, invented example. OPNsense states that each state entry needs about 1 kB of RAM [1]. Suppose a household has 20,000 active states (the number is made up for the method; read your own under the firewall's state view). That is about 20 MB. Netgate's table says 100,000 states need about 97 MB, and the operating system and services need at least 175–256 MB more [13]. So the state table is not what decides your RAM at home. The services you add (an intrusion detection engine alone wants at least 1 GB on pfSense [13]) and the vendor's tier do.
Checklist
- Write down whether you host services, play online, or only browse. It decides between A and B.
- Choose OPNsense Community unless you have a reason for pfSense; note that reason.
- Check the price on Netgate's or Deciso's store on the day you buy; our pages list undated prices.
- Select a mini PC with an x86-64 CPU, two or more Ethernet ports (Intel preferred) and an SSD.
- Avoid USB network adapters for WAN and LAN.
- Read the release notes of your version for hardware notes, such as the Celeron J boot issue in pfSense CE 2.9.0.
- Pick a LAN range that differs from the FRITZ!Box's range before you plug anything in.
- Untick "Block private networks" and "Block bogon networks" on a WAN that sits in a private network, and keep the default inbound block.
- Forward single ports from the FRITZ!Box to the firewall; try Exposed Host last.
- Test from outside your network that unsolicited inbound traffic is blocked.
- Save the firewall's configuration to a file and store it away from the firewall.
- Plan the move to option B only when you know your line's modem and registration needs.
Related pages: VLANs at home: separating IoT and guests; VLAN (glossary); NAT type on consoles and games; Game server behind CGNAT or DS-Lite: 5 ways; UPnP automatic port mapping; 2.5 GbE in the homelab: when it pays off; Measuring homelab power correctly; UPS – uninterruptible power supply; WireGuard or Tailscale for reaching your homelab; Pi-hole or AdGuard Home? DNS ad blocking at home; Router security checklist for home networks; Double NAT; Exposed host (router).