pfSense at 20

Twenty years of pfSense software

Twenty years ago this month, pfSense® software version 1.0 shipped. It started as a small fork of m0n0wall, built by a handful of people who wanted a better firewall than anything they could buy.

Today pfSense software protects and connects hundreds of thousands of networks in: homes, schools, hospitals, ISPs, public and private Cloud and in some of the largest companies in the world. Netgate® has been the largest contributor to the pfSense project over its entire lifetime, but none of this happened because of us alone. It happened because of you: your interest, your support, and your help making pfSense software relevant and useful to everyone who needs to connect securely to the Internet.

So for the twentieth anniversary, we’re looking ahead to where pfSense software needs to go and giving something back to everyone who has made it part of their network security stack. This is the first of several things we’ll be celebrating and announcing through 2027.

One pfSense

Starting with release 26.10, there is one edition of pfSense software. The separate pfSense CE and pfSense Plus editions are now one. Splitting pfSense software was the right call for its time. It let new users get up to speed on firewalls, VPNs, routing and general networking principles with zero-cost, fully featured production-ready software. It also let us fund the kernel and system engineering that pfSense software needed, the backend infrastructure, testing, 24/7 assistance, etc. and this is how features like in-kernel PPPoE, IPsec multi-buffer, the pf L2 filtering we upstreamed to FreeBSD, and ZFS boot environments with rollback got built. But two editions also meant two codebases, two release tracks, and too many conversations about which you should be running.

With release 26.10, everyone runs the same pfSense software:

• The full feature set, free on any amd64 hardware. Every feature is included, from Snort 3 with Intel Hyperscan to ThreatGate with Zero Trust Egress (ZTE). It installs and reinstalls at no cost, with no account or registration required. On AWS, Azure and other public clouds, pfSense software remains available through our marketplace images.
• The new GUI and the full API, for everyone. If you’ve built automation on a third-party API package, the built-in API is now the supported path. The documentation is on GitHub.
• Security updates and bug fixes, free and online.
• The air-gapped installer is back, so you can install pfSense software on networks that never touch the Internet.

This isn’t a promotion or an introductory offer. This is how pfSense software works from now on: the full feature set, with free security fixes.

Netgate keeps you secure, for free

Every pfSense install gets security fixes at no cost, whether it runs on our hardware or yours, and whether or not you ever pay us anything.

This matters more now than it did even a year ago. AI tools are finding bugs in widely used open-source code faster than ever, which means more “patch it now” days for everyone, not fewer. When a critical fix lands in FreeBSD, OpenSSL, or anything else pfSense software is built from, we want it on your firewall as soon as it’s ready, not at the next release.

Moving the base system to packages in 26.10 is what makes this possible. We can ship a fix for just the component that needs it, and you install it like any other update. Security fixes go to the current release, and since moving to a new release is free, every pfSense install can always be on a release that’s getting them.

This is also why we’re retiring the PHP-based GUI. We’ll remove it, with notice, once the new GUI covers everything it does. Much of the security work on pfSense software in recent years has gone into fixing bugs in old PHP code, and keeping up will only get harder as these bugs are found faster. The new GUI and API are built to remove this whole class of problem, not just patch it.

What you can pay for is convenience and help: online upgrades to new versions, fleet management at scale, and support. We don’t charge for security.

If you run pfSense CE software today

You get everything Plus users have had, on the hardware you already own. Nothing about your existing install stops working, and your configuration comes with you.

This includes:

• OpenVPN® data channel offload (DCO) and Intel IPsec Multi-Buffer (IIMB) crypto, for much faster IPsec, OpenVPN and WireGuard® VPNs
• Intel QuickAssist (QAT) crypto acceleration, on hardware that has it
• ZFS boot environments, so you can roll back a bad upgrade or configuration change
• Unicast CARP, for high availability where multicast doesn't work, including many hypervisors and clouds
• Ethernet (layer 2) filtering rules
• 802.1X authentication bridging and VLAN 0 tagging on the WAN, so an ISP gateway that has to authenticate to the network can do so without sitting inline in your traffic. AT&T fiber is the common case.
• Native NetFlow and IPFIX export, straight from firewall states
• LDAP client certificates
• The AWS VPC wizard, IPsec profile wizard and OpenVPN client import packages

We're also publishing the updated PHP and the FreeBSD source for 26.10 to GitHub.

Upgrading from pfSense CE software 2.9 to release 26.10 is free, and it happens in place, the same way you upgrade today.

From release 26.10 on, security fixes keep arriving online, for free. To move to a new version, reinstall from the installer at no cost. It saves and restores your configuration for you. Or, if you’d rather skip the reinstall, upgrade online in one step with a subscription.

The most widely used packages, including HAProxy, FRR and ACME, continue to work on release 26.10. pfBlockerNG continues to work in the existing GUI until that GUI is retired, and ThreatGate, now built in, is its successor for DNS-based blocking.

If you run pfSense Plus software today

Your existing subscription carries over, whether it’s TAC Lite, TAC Pro or TAC Enterprise, and you keep online upgrades. You don’t need to do anything.

If you bought Netgate hardware, nothing changes either: online upgrades to every new version are included for the life of the appliance, with no subscription required.

For partners and MSPs, one product means one thing to deploy, one thing to support, and no more questions about which edition a customer should run.

When

pfSense software version 26.10 will be released before the end of November. We're announcing it now because October is the pfSense project's birthday, and this is the change we wanted to mark it with.

Release notes, online and air-gapped installer images, and upgrade instructions will be on netgate.com on release day.

Thank you

pfSense software exists because people tested releases, answered forum questions at 2 a.m., wrote packages, filed good bug reports and told their friends. Twenty years of this is why it’s still here.

We’ll keep doing our part. Our software engineers, TAC engineers and SREs bring decades of experience across hardware, software, firmware and systems deployment, and they’re the people who take on the hardest problems. Netgate is the third-largest sponsor of FreeBSD by commit volume over both the last five and the last ten years, with several FreeBSD committers on staff. Much of what we build for pfSense software goes upstream, so everyone who builds on FreeBSD benefits. This includes the igc driver for Intel’s 2.5G NICs; layer 2 filtering in pf, used by the pfSense captive portal; dummynet support in pf for traffic shaping; and, just this month, an iflib fix that makes packet forwarding on FreeBSD much faster.

Here’s to the next twenty years of keeping your network secure.