If you follow The Geek Pub regularly, then you know we are a huge fan of pfSense. We’ve been running it our environment(s) for several years and its just rock solid and reliable. The biggest issue we have is that although pfSense is community based and open sourced, it is ultimately still owned by Netgate and they are pushing their hardware to pfSense users at what I feel is a steep premium (and unnecessary). The goal of this recommendation article is to help the community find the best pfSense box for the money!
Updated: We update this article quarterly to make sure the latest and greatest hardware is reflected!
What is the Best pfSense Box?
NOTE: We actually use these boxes in our home, our families’ homes, and production small business environments. We have detailed hands on experience with them.Mike Murray – Founder, The Geek Pub
A quick technical detail we need to cover. There are a lot of boxes out there that claim to be pfSense compatible (and they technically are). Any x86 device or PC is generally compatible with the pfSense firewall software. And though they are compatible, they may not be the best pfSense box if they lack support for AES-NI. Simply put AES-NI is encryption service that are included in the die of most new processors. This functionality drastically speeds up cryptography processes for SSL and VPN services.
Indeed, pfSense has considered at least once requiring AES-NI for pfSense compatibility, and then reversed course at the last minute. If future proofing your box is important, this is another reason to look for boxes that have AES-NI support.
In this rundown we will only included boxes that support AES-NI.
THE BEST PFSENSE BOX WITHOUT AES-NI SUPPORT
So… you don’t care. You just want a box without AES-NI support? Then we’d definitely recommend the Protectli. It’s not going to run lots of VPNs or do SSL decryption/encryption for squid proxy or anything else. But if you just want a solid little firewall to protect your family this one should check most people’s boxes… minus AES-NI.
This box does have some nice features even without AES-NI! First, it is super affordable at less than $200. Second it packs a dual-core Celeron J1800 running at 2.4Ghz. Plenty of horsepower for fiber connections such as ATT Fiber or Verizon FiOS.
OK. Now let’s move on to our recommendations for the best pfSense Box that does support AES-NI.
Additional Import Features to Consider
In addition to our notes above, there are some other features you should consider when selecting the best pfSense box for your home.
This is a feature that is often overlooked. Many pfSense boxes don’t even have a video output, instead coming with only a serial port. This can be very frustrating when installing and troubleshooting the box! Some boxes included VGA, HDMI, or both. We highly recommend that you get a pfSense box that has a video output, and HDMI if possible as many modern monitors are no longer shipping with VGA ports. You can disconnect the monitor for normal use.
NUMBER NETWORK PORTS
You can get pfSense appliances with just two ports, or as many as 10 or 12. Most people will only ever need two ports. A WAN port and a LAN port. The WAN port connects to your ISP’s MODEM (or ethernet handoff from the fiber gateway). The LAN port connects to a switch in your home that all of your devices connect to.
More experienced users may want additional ports to support a DMZ for a server, or for VLANs to support guest networks or other private networks.
COOLING AND POWER SUPPLY
Cooling may not sound all that important, but if your firewall is in your bedroom or where you watch your favorite movies, a fanless appliance could be a must. All of our recommendations for the best pfSense box are fanless.
Additionally, some units have internal power supplies, while others have a external power bricks. This could be important depending on how you plan to mount the box or otherwise store it while in use.
HARD DISK TYPE AND CAPACITY
For most people the hard disk type and capacity are going to be somewhat irrelevant. However, if you prefer a silent box and one that is less likely to fail, the solid state is the way to go.
For size, unless you plan to use your pfSense box for caching or serving data then the smallest size mSATA drive should be plenty. Generally the smallest capacity is 32GB. However, some boxes still ship with 16GB. Either (or more) should work fine.
pfSense Minimum Requirements
Of course, if you’re on the lookout for the best pfSense box, it is also important to understand the minimum requirements for running pfSense in the first place. If you don’t meet those it is likely pfSense will still run, but it will be very slow and likely unstable. The following reflect the pfSense developer’s minimum requirements:
- A CPU speed of at least 600 MHz
- Memory capacity of at lease 512 MB
- Minimum of 4GB hard drive
- A network card with two ports, or two separate network cards.
- A USB port that supports booting from the BIOS/EFI or a CD/DVD ROM drive.
You’ll want to keep in mind that these are the minimum requirements and will not perform well. For example, the minimum requirements only support a 100Mb connection. If you want to support higher bandwidth such as fiber connections the minimum won’t work.
#1 – The Protectli Vault FW4B Firewall Appliance
We’ve deployed many of these little boxes for friends and family and they work excellent. It’s got all the specs where it counts. It is ideal for Gigabit and Fiber ISPs because it packs the horsepower to route and filter on the fastest networks, along with full support for AES-NI. Something every pfSense box should have.
For 2022 we feel this is the best little pfSense box you can get for the money. Hands down. These boxes work great. They are highly reliable, and they are silent. We’ve deployed at least 30 of these over the last two years and they have worked flawlessly. And the Amazon reviews show the same, over 90% positive feedback. You can’t go wrong with this box.
They include the following specifications:
- Intel Quad Core Celeron Celeron J3160, 64 bit, 2.2GHz, 2MB L2 Cache
- Full AES-NI hardware support
- 4x Intel Gigabit Ethernet NIC ports
- 4GB DDR3L RAM
- 32GB mSATA SSD
- 1x USB 2.0
- 1x USB 3.0
- 1x RJ-45 COM (serial)
- 1x HDMI
Our favorite thing about this little box is that it is 100% solid state… No fans!!! It doesn’t make even a tiniest noise during operations. It’s perfect for home use and very affordable.
#2 – The Qotom ITX Appliance
The Qotom ITX appliance is slightly larger than some of our other pics. But that’s because it’s based on an actual ITX board. This is the box Mike recently chose for an AirBNB and supplies gigabit internet for guests of the property It’s connected to a Ubiquity NanoBeam for getting WiFi down to the boat dock. In addition a managed VPN between this property and his commercial building for managing the home remotely. This box is snappy, quiet (fanless), and has all the futures most people will need.
- Intel Core I3-4005U @ 1.7GHz
- 8GB of RAM
- 16GB SSD
- AES-NI support
- 4 Gigabit ports (1x WAN, 3x LAN)
- 2x USB 2.0 ports
- 2x USB 3.0 ports
- 1x HDMI
#3 – The Zotac ZBOX (Mini-PC w/dual Ethernet)
This box is an outlier for a best pfSense box rundown. However, it’s really fantastic! Rather than being a network appliance, the Zotac ZBOX actually just a mini-PC built for running Windows or Linux in a tiny form factor. However, the fact that it has dual Ethernet ports makes it a perfect small pfSense firewall appliance too!
In addition to being super small, it has the ability to mount to any VESA mount. This means it can be mounted virtually anywhere. And of course, it is fanless and silent!
- Quad-core Intel N4100 Processor @ 1.1GHz (up to 2.4GHz turbo)
- VGA, HDMI, and Display Port video
- 4 x USB 3.0 (1 x Type-C)
- 1 x USB 2.0
#4 – The Firewall Appliance
Next on our picks for the best pfSense box is the Firewall Appliance is a beast of a little firewall for home users. Its a little more expensive than our first choice, but it comes with a quad-core Celeron processor. Additionally it drops the VGA port in favor of two HDMI ports. Additionally, it has a barrel lock connector to keep unauthorized access out of the box, protecting the hard drive from access. Here’s the spec rundown for this little guy:
- Intel Quad Core Celeron J3160, 64 bit, up to 2.2GHz
- Full support for AES-NI
- 8GB DDR3L RAM
- 128GB mSATA SSD
- 4x Intel i210 Gigabit Ethernet ports
- 2x USB 3.0
- 1x RJ-45 COM
- 2x HDMI
- Solid State, Fanless Silent Operation
This device combines the power of pfSense in a small fully consumer friendly device. It will also route and filter at close to Gigabit speeds for even the fastest ISPs.
Runner Up – The Netgate SG-3100
Some of you are going to want to stick to Netgate products since we know they will most likely remain 100% compatible through their usable life. There are examples of course where manufacturers dropped support for their own products before they were truly end-of-life (we are looking at you Apple!), the chances are pretty low. The Netgate box while overpriced and under spec’ed is a solid box that should perform reliably enough. It’s specs include:
- ARM v7 Cortex-A9 @ 1.6 GHz Dual Core
- 2X 1GB LAN/WAN ports
- 4X 1GB Switched only ports
- 2GB RAM
- 8GB Storage
- 1X USB
So that wraps up my pics for the best pfSense box for ordinary home users! Happy pfSensing!