pfSense CE vs pfSense Plus: What Actually Differs

pfSense CE and pfSense Plus differ in price, release timing and a short list of Plus-only features. For most home and small-office networks the answer is CE: it is free, licensed under Apache 2.0, and handles routing, VLANs, firewalling and WireGuard. Plus costs $129 a year per install on your own hardware or virtual machine and is included on Netgate appliances. It earns that price when you need OpenVPN DCO, QAT or IPsec-MB acceleration, ZFS boot environments, CARP unicast or vendor support.

The edition does not decide your NAT throughput or IPS ceiling; hardware and configuration do. Netgate’s published version table answers the release-timing question, and its pricing and feature pages answer the rest. Check licensing and upgrade eligibility against those pages before committing to an edition.

pfSense CE vs pfSense Plus at a glance

These rows come from Netgate’s Plus feature page, pricing pages and version table, checked in October 2026.

One lineage, two release trains

pfSense CE is the community edition. pfSense Plus is the commercial edition Netgate ships on its own appliances and also sells for third-party hardware and cloud instances. They share a lineage: the version table shows releases with matching FreeBSD bases and configuration schema revisions. Shared ancestry does not make their feature sets identical.

What differs is the schedule. The editions last shipped on the same day on 7 December 2023, when CE 2.7.2 and Plus 23.09.1 were released from the same 14.0-CURRENT base commit at config revision 23.3; earlier joint releases came on 13 April 2021 (2.5.1 and 21.02.2), 14 February 2022 (2.6.0 and 22.01) and 29 June 2023 (2.7.0 and 23.05.1). Every release since has shipped on its own date.

The cadence gap, from the table

Count the releases in the version table and the divergence is arithmetic rather than opinion.

The single most informative gap in that list sits in the middle of it. CE 2.7.2 was released on 7 December 2023. The next CE feature release, 2.8.0, arrived on 28 May 2025, roughly seventeen and a half months later. During that same window Plus shipped 24.03 on 23 April 2024 and 24.11 on 25 November 2024. Netgate states that Plus major releases are scheduled three times a year.

Release timing is one practical difference for anyone running pfSense on their own hardware. If your NICs and packages work on current CE, the gap mostly means waiting longer for non-urgent fixes. Check each release’s notes for the specific driver or fix you need; the edition name alone does not establish when it became available.

The divergence is not permanent, and it has flipped direction

It would be easy to read the gap above as CE being permanently behind. The table does not support that reading.

CE 2.8.0 shipped on 28 May 2025 with the FreeBSD base recorded as 15.0-CURRENT@bf06074106cf. Plus 25.07, carrying the identical base commit, shipped on 4 August 2025, more than two months later. In that cycle the community edition reached the newer base first.

The current cycle runs the other way. Plus 26.07 shipped on 13 August 2026 on 16.0-CURRENT@4bdcff554368. CE 2.9.0 shipped on 20 August 2026 against the same base commit, one week behind Plus. The base is shared; the release timing is not.

So the honest summary is that the two trains run on the same track at different, irregular intervals, and the lead changes hands. Anyone told that one edition is simply “newer” is being sold a version of the table rather than the table.

Configuration revisions decide portability

The column most people skip is the one that matters when hardware changes hands. Each release carries a configuration revision, and it is shared across editions at matching points in the lineage.

A configuration backup has a schema revision. Netgate’s restore documentation permits restoring the same or an older revision onto a target release; a backup with a higher config revision “cannot be restored to an older version.” Matching revisions do not remove the need to check interface assignments and edition-specific settings.

That is also why there is no documented downgrade from Plus. Today Plus 26.07 and CE 2.9.0 share revision 24.6, but a Plus 26.03 backup (24.5) would not have restored onto CE 2.8.1 (24.0).

The operational rule that follows is simple. Before restoring a configuration onto replacement hardware or a different edition, check the revision the backup was written at and the revision the target release expects. That check costs a minute and prevents the most common bad afternoon in a firewall migration.

What does pfSense Plus cost in 2026?

On hardware Netgate didn’t sell, Plus costs $129 per year per install, whether bare metal or a virtual machine, according to Netgate’s pricing page. The Netgate Store lists $258 for two years. Netgate appliances include TAC Lite for the life of the product, so the software carries no separate bill there.

That subscription is TAC Lite: Plus updates as they ship, plus 24x7x365 access to Netgate’s support team on a best-effort SLA. CE is supported by the community, principally through the Netgate forum. The fine print of the subscription matters more than the price:

• Lapse means frozen, not dead. Per Netgate’s support FAQ, an expired firewall “will continue to run without the ability to update,” installed packages stop updating, and a reinstall cannot migrate back to Plus.
• It’s bound to the Netgate Device ID (NDI). Netgate will move a subscription to a new NDI once as a courtesy. After that, a dead motherboard means a new subscription.
• Tokens are single use and non-refundable. Have the CE install exactly as you want it before you migrate.
• Billing is per install. A homelab running three virtual firewalls pays $387 a year.

The free Home+Lab route for third-party hardware ended with Netgate’s October 2023 announcement, which moved those users to TAC Lite at $129 a year. Licensing terms for running Plus on hardware Netgate did not sell have changed more than once, so confirm the current figure on Netgate’s pricing page at the moment of purchase.

Run the five-year arithmetic. Five years of TAC Lite comes to $645 per firewall, before hardware. Netgate’s appliance page lists the Netgate 1100 from $289 and the Netgate 4200 from $829, both shipping Plus with lifetime TAC Lite. If you’re going to pay for Plus anyway, price the appliance before the DIY box.

Which Plus-only features matter on a home or small-office network?

On a typical network with one to three access points and one to four VLANs, two matter: ZFS boot environments, and OpenVPN DCO if OpenVPN carries your remote access. The rest serve HA clusters, specific ISP handoffs or flow analytics. WireGuard is a package on both editions, which removes most of the VPN argument.

ZFS boot environments. Boot environments snapshot key filesystem areas so the firewall can roll back to a known-good state after a bad upgrade or config change. On CE, recovery means a config backup, the online installer and a working upstream connection. For a single home firewall, this is the strongest argument for Plus.

OpenVPN DCO. Data Channel Offload cuts per-packet context switching and is unavailable on CE. It requires Plus 22.05 or later, UDP, TLS mode, and AES-256-GCM, AES-128-GCM or ChaCha20-Poly1305. Compression is incompatible, /30 or smaller tunnel networks are unsuitable, and per-peer usage tracking is inaccurate. A legacy TCP 443 tunnel with LZO compression gains nothing until you rebuild it.

IPsec-MB, QAT, SafeXcel, CESA. Netgate’s accelerator documentation marks all four as Plus-only. QAT needs QuickAssist silicon, and SafeXcel and CESA are ARM appliance engines. AES-NI works on both editions and already carries most of the AES workload on modern x86.

CARP unicast. This matters for HA pairs on hypervisors or cloud networks that filter multicast. A single home firewall doesn’t need it.

Layer 2 rules, NetFlow/IPFIX, WAN 802.1X bridging, VLAN 0 PCP tagging. These matter if you filter by MAC address, export flows to a collector, or have an ISP handoff that requires 802.1X or priority-tagged VLAN 0 frames.

Acceleration depends on the hardware and algorithms involved, and DCO has the tunnel compatibility limits above. Check these details before assuming an edition change will improve a VPN.

Keep workload capacity separate from installation prerequisites

Netgate publishes a shared minimum-requirements page for pfSense software. That installation floor does not promise equal VPN throughput across editions: available acceleration features and compatible hardware still matter.

Budget the state table, inspection engine and network buffers, and find which traffic path sets the processing limit, using pfSense workload sizing for VPN, IDS and state tables.

Check before you pay for Plus

If VPN speed is the reason for Plus, confirm that OpenVPN is actually the bottleneck. Run a sustained test through the tunnel from a remote client and watch the firewall at the same time:

# remote client, through the tunnel, 30 s, 4 streams
iperf3 -c 192.168.10.1 -t 30 -P 4

# on the firewall (SSH, option 8), during the test
top -aSH

If one openvpn thread sits near 100% WCPU while the other cores idle, that’s exactly the problem DCO addresses. If the WAN is already at line rate, or the CPU is mostly idle, changing edition won’t help. Check acceleration hardware with grep -i aesni /var/run/dmesg.boot and pciconf -lv | grep -i quickassist. QAT only helps if the second command returns something.

How to check this yourself

The cadence and configuration-revision tables above come from Netgate’s version list, checked on 6 September 2026; the at-a-glance table and prices were checked in October 2026. Read that list alongside the feature and migration documentation because each answers a different part of the decision.

The version list has four columns worth attention. Released gives the release date for a cadence comparison. FreeBSD Version identifies the base commit. Config Rev identifies the configuration schema used for backup compatibility. Branch identifies the source branch, which helps describe the installed build when reporting a problem.

Compare dates rather than version numbers: Plus uses a year-and-month scheme and CE uses a sequential one. Use the base commit to understand the lineage, then consult the release notes for a particular driver change. A matching base commit alone is not evidence that every module and feature is available in both editions.

Before upgrading pfSense CE to Plus

Read Netgate’s CE-to-Plus migration procedure and export a configuration backup first. The documented path requires CE 2.6.0 or later, internet connectivity and an activation token from the store. Paste the token under System > Register, then select the “pfSense Plus Upgrade” branch under System > Update. Migration preserves the existing filesystem, so it does not convert UFS to ZFS; if you want boot environments, install CE on ZFS first. Check backup compatibility and recovery options before starting; these prerequisites are not a substitute for the complete vendor procedure.

How to choose

Buying a Netgate appliance settles it. The appliance ships with Plus and is tuned for that combination; the edition question never comes up.

For your own hardware, choose by required features, support and the releases available for your device. By profile:

• Home network, mini PC, IoT VLAN, WireGuard: CE. Spend the subscription money on hardware instead: a CPU with AES-NI and decent NICs, sized for your state table and inspection load.
• Running Suricata or Snort inline: the edition doesn’t change this. CPU and rule set do, so read Snort vs Suricata on pfSense first.
• Homelab with several virtual firewalls: CE, because Plus bills per install.
• Small office with OpenVPN road warriors and no on-call admin: a Netgate appliance such as the 4200, which bundles Plus, DCO and TAC Lite for life.
• HA pair on Proxmox or ESXi: Plus, if CARP multicast doesn’t survive your virtual switching.
• Already slow and blaming the edition: it probably isn’t the edition. Work through finding the real bottleneck behind slow pfSense speeds first.

The historical cadence does not guarantee a future release date, so check the current release notes for either edition. For a memory estimate and planning tiers, use the pfSense throughput and state-table sizer. It does not model edition-specific acceleration or predict the speed gain from an upgrade.

Common mistakes

Treating release cadence as the only difference and overlooking acceleration features. Assuming one edition is permanently ahead, when the lead has changed hands between cycles. Restoring a configuration backup without checking its revision. Budgeting from a licence price quoted in a secondary source instead of confirming it on the vendor page. Paying per install for several virtual firewalls that CE would serve. Expecting an edition change to repair a physical-link problem or remove a state-memory limit.

FAQ

Is pfSense Plus free?

Only on Netgate hardware. Plus ships on Netgate appliances with TAC Lite included for the life of the appliance, so there is no separate software bill. On your own box or virtual machine it costs $129 a year per install, or $258 for two years. AWS and Azure marketplace instances bill hourly, starting at $0.08 per hour.

Is pfSense Plus open source?

No. Netgate’s Plus FAQ describes pfSense Plus as a Netgate product branched from the pfSense project and states that it is closed source. pfSense CE remains open source under the Apache 2.0 licence, with its code published on GitHub. Both editions share a FreeBSD base and much of their history, but only CE can be audited or built independently.

Is pfSense Plus faster than pfSense CE?

Only on VPN crypto paths. Plus adds OpenVPN DCO along with IPsec-MB, QAT, SafeXcel and CESA acceleration, none of which CE has, so OpenVPN and IPsec throughput can rise on identical hardware. Plain routing, NAT, firewall rules and IPS inspection are limited by CPU, NICs and rule sets rather than by the edition label.

Can I run pfSense Plus in a VM?

Yes, with a paid subscription. Netgate sells Plus for third-party hardware, bare metal or virtual machine, starting at $129 per year, and you install it with the Netgate Installer or migrate from CE. Each install needs its own subscription tied to its Netgate Device ID, so a lab with several virtual firewalls multiplies the cost.