Popular firewall software pfSense merges paid and community editions: all features now free, except one

pfSense, a major open-source firewall platform popular among prosumers and businesses, is merging its CE and Plus editions into a single release. Free users get every feature that was previously paid-only, but lose online upgrades – manual reinstall is required with each new release.

Starting with version 26.10, expected before the end of November, there will be only one version of pfSense, the popular firewall and router software preferred by many homelab enthusiasts, Netgate announced.

Netgate, a network appliance manufacturer that manages two versions of the same platform, CE (Community Edition) and Plus, says all users will get the full feature set on any capable hardware.

This includes the intrusion prevention and detection system Snort 3, IP blocklist management tool ThreatGate, a new graphical user interface, an API, free security updates and bug fixes, and many more advanced features: OpenVPN DCO, IPsec multi-buffer, QAT crypto acceleration, ZFS boot environments with rollback, unicast CARP, L2 filtering, 802.1X/VLAN 0 on the WAN, NetFlow/IPFIX and LDAP client certificates, etc.

“This isn’t a promotion or an introductory offer. This is how pfSense software works from now on: the full feature set, with free security fixes,” Netgate said in a blog post, celebrating the twentieth anniversary of pfSense.

pfSense software is used by hundreds of thousands of networks in homes, schools, hospitals, ISPs, public and private clouds, and in some of the largest companies in the world, the company said. DIY routers can be built using old hardware.

However, a new burden will be placed on free-version users – they will no longer receive online upgrades to new releases. Only bug and security fixes will arrive online for free.

That means significantly higher maintenance for any self-deployed system – manually booting the installer and going through all the backup, update, and configuration procedures with every major release.

“To move to a new version, reinstall from the installer at no cost. It saves and restores your configuration for you. Or, if you’d rather skip the reinstall, upgrade online in one step with a subscription,” the Netgate blog post reads.

Moving from pfSense CE 2.9 to the new 26.10 will be the last free upgrade.

Many CE users voice frustration

The announcement has stirred the pfSense community. On Reddit, some free-tier pfSense users say they would prefer to keep online upgrades over the new features.

“One edition with all the features sounded good. But after reading it properly, online upgrades now need a subscription. For me, that’s a basic thing on any firewall; I don’t see it as a convenience feature,” wrote one of the redditors.

Some say they’re unwilling to “reinstall from scratch every 6 months,” and would rather switch to a competing open-source alternative, OPNsense. Others called the announcement “cryptic,” asking for a simpler explanation of what's changing.

“What, do I need to copy a new version to a USB stick and use my janky DIY USB-to-RS232 cable every time there’s an update?” a redditor posted.

Another major concern is the uncertain future of pfBlockerNG, a free plugin for blocking unwanted internet traffic. It continues to work in the existing PHP-based GUI, which will be retired. Many fear that pfBlockerNG maintainers might not port it to the new GUI.

“I’m done with pfSense. After the latest corporate monetization BS, I’m planning my migration to OPNsense immediately,” another user posted.

“The new Nexus UI feels like a crippled version of the tried-and-true PHP interface, stripped of necessary functionality and introducing distinctions without a real difference.”

However, many users appreciated the return of the installer for air-gapped systems, requiring no internet connection for installation.

“I honestly prefer this sort of monetization model over what it is replacing. Charge for support and convenience items, but otherwise the base system and features are free to use for everyone. Makes things approachable for newcomers, gives cash-strapped users a path forward,” a user supported the move.

Why is Netgate doing this?

The company explains that two editions meant two separate codebases, two release tracks, and too many conversations about which one users should be running.

AI tools are now finding bugs faster than ever before, and the team wants to protect firewalls as soon as possible.

With the merge, Netgate is also moving the base system to packages – they allow shipping a fix for just the component that needs it. Users can install it like an update, without requiring a new release.

“When a critical fix lands in FreeBSD, OpenSSL, or anything else pfSense software is built from, we want it on your firewall as soon as it’s ready, not at the next release,” Netgate explains.

“Security fixes go to the current release, and since moving to a new release is free, every pfSense install can always be on a release that’s getting them.”

The switch to the new GUI will happen with a separate notice, “once the new GUI covers everything it does.” This will eliminate much of the work required to fix bugs in old PHP code.

Netgate hardware owners do not require a subscription for pfSense and receive online upgrades. Current Plus subscriptions carry over, and users don’t need to do anything. Currently, the cheapest pfSense Plus license costs $129/year and ranges up to $799/year, depending on the level of technical support.

Netgate is a major contributor to open-source software – it is the third-largest sponsor of FreeBSD by commit volume.