The short answer
- Best all-round choice: OPNsense. Free for business use under a permissive BSD licence, updated every few weeks, with a modern interface and an optional Business Edition at €149 a year per firewall.
- Best if you want Netgate behind you: pfSense Plus. pfSense CE remains free and open source, but business use of Plus needs a paid subscription, from US$129 a year per firewall.
- Best lightweight Linux option: IPFire. Simple, hardened and steadily patched, though it has no built-in high availability.
- Avoid: Smoothwall Express, which stopped receiving updates long ago. Treat Arista’s free NG Firewall tier, formerly Untangle, as the entry level of a paid product rather than an open-source firewall.
- The real cost is the person who runs it. If nobody on your staff can patch, monitor and fix a firewall at 7 a.m. on a Monday, a supported commercial firewall usually costs less in the end.
Why a business needs more than the internet provider’s router
Most offices begin with the box their internet provider installed. It translates addresses, blocks unsolicited connections from outside and hands out Wi-Fi. For a household that is enough. For a business holding client files, payroll data and a line to the bank, it leaves large gaps: everything shares one network, nothing inspects traffic for attacks, remote access is improvised, and there are no logs to look at when something goes wrong.
A proper firewall sits between the modem and everything else. It decides what may enter and leave, splits the office into separate networks so a compromised camera cannot reach the accounting server, watches traffic for known attack patterns, and gives staff working from home an encrypted way in. The picture below shows where it fits.
Here is how the three common options compare on the jobs that matter to a business.
| What it does | ISP router | Open-source firewall | Commercial firewall |
|---|---|---|---|
| Blocks unsolicited traffic from the internet | Yes | Yes | Yes |
| Separate networks with rules between them | Rarely | Yes | Yes |
| Intrusion prevention | No | Suricata or Snort | With subscription |
| Application control | No | With a plugin | Yes |
| Remote access VPN with MFA | No | Yes, with setup | Yes |
| Logs you can keep and search | No | Yes | Yes |
| Vendor support and security response | Provider only | Community or paid tier | Yes |
| Licence cost | Included | Free, or a modest subscription | Yearly subscription |
What “open source” really means for a firewall
Open source means the code is published under a licence that lets anyone read, run and modify it. For a business, the practical meaning is simpler: you can run the firewall in production without paying a licence fee, and you are not locked into one vendor’s pricing decisions. The licences differ slightly. OPNsense uses the 2-clause BSD licence, pfSense CE uses Apache 2.0 and IPFire uses the GPL, version 3. All three allow commercial use.
Two things are easy to miss. First, free software is not free security. The licence costs nothing, but someone still has to design the rules, apply updates, read the alerts and recover the firewall when it fails. Second, several well-known names are now open core: a free edition that leads to a paid one. pfSense Plus and Arista’s NG Firewall both work this way, and the free edition is not always the one that gets new features first.
The contenders in 2026
Four projects are worth a business’s attention, and one familiar name is not. Our ratings reflect how each one suits an office of 10 to 100 people with some in-house technical skill.
OPNsense
Our top pick
OPNsense began in 2015 as a fork of pfSense and is developed by Deciso in the Netherlands. It ships two major releases a year with frequent updates in between. Version 26.1, released in January 2026, rebuilt the firewall rules screen and added threat-intelligence blocklists and host discovery, and 26.7 followed in July. It is the open-source firewall we would choose for most offices today.
Strengths
- Free for any use, including business
- Security fixes arrive every few weeks
- Clean interface and a full API for automation
- Suricata intrusion prevention built in
- High availability with two firewalls
Watch out for
- Only the latest release is supported, so upgrades cannot be skipped
- Application control needs the Zenarmor plugin, with paid tiers for business features
- Rich feature set means a real learning curve
pfSense CE and pfSense Plus
Long track record
pfSense has protected small networks since the mid-2000s and has the largest body of guides and forum answers of any open-source firewall. Netgate now develops it as two products. pfSense CE stays free and open source, but new releases arrive less often. pfSense Plus is proprietary, comes with Netgate’s own appliances and, on your own hardware, needs a paid subscription for business use: US$129, US$399 or US$799 a year per firewall depending on the support tier.
Strengths
- Huge community and documentation
- Netgate appliances with Plus and support included
- Snort or Suricata, plus pfBlockerNG for blocklists
- High availability with two firewalls
- Direct vendor support with Plus
Watch out for
- CE updates arrive less often than Plus updates
- Plus on your own hardware needs a subscription for business use
- Interface feels dated next to OPNsense
IPFire
Lightweight
IPFire is a hardened Linux firewall that divides the network into colour-coded zones: green for the office, red for the internet, orange for public-facing servers and blue for Wi-Fi. It is patched through numbered Core Updates every month or two. In 2026 it moved to the Linux 6.18 long-term kernel, added a DNS firewall and domain blocklists, switched its DNS resolver to Knot Resolver with encrypted forwarding, and shipped an emergency update within days when a serious kernel flaw appeared.
Strengths
- Simple zone model that is easy to reason about
- Suricata intrusion prevention
- DNS firewall and domain blocklists
- Runs well on modest hardware
Watch out for
- No built-in high availability
- Smaller ecosystem and fewer add-ons
- Limited application control
Arista NG Firewall Free (formerly Untangle)
Free tier of a paid product
Untangle was popular with small businesses for its friendly dashboard and reports. Arista bought it in 2022 and now sells it as Edge Threat Management NG Firewall. After a trial, a deployment falls back to NG Firewall Free with basic connectivity and security, and most of the protection that made it attractive needs a paid subscription. Arista also announced in March 2026 the end of sale of its NG Firewall appliances, pointing hardware buyers to its VeloCloud Edge range, which makes its long-term direction harder to predict.
Strengths
- Very approachable dashboard
- Clear reports for managers
Watch out for
- The free tier lacks most security features
- Not open source in any practical sense today
- Uncertain future as Arista moves hardware to VeloCloud
Retired: Smoothwall Express
Smoothwall Express still appears in many lists of free firewalls, but it has not had a new release in about a decade. A firewall that no longer receives security fixes should not sit at the edge of a business network. If you find one running, replace it.
Side-by-side comparison
| OPNsense | pfSense CE | pfSense Plus | IPFire | |
|---|---|---|---|---|
| Licence | BSD 2-clause | Apache 2.0 | Proprietary | GPL v3 |
| Free for business use | Yes | Yes | Subscription | Yes |
| Built on | FreeBSD | FreeBSD | FreeBSD | Linux |
| Intrusion prevention | Suricata | Snort or Suricata | Snort or Suricata | Suricata |
| Application control | Zenarmor plugin | Zenarmor plugin | Zenarmor plugin | URL filtering only |
| IPsec and OpenVPN | Yes | Yes | Yes | Yes |
| High availability pair | Yes | Yes | Yes | No |
| How often it is updated | Every few weeks | Less often | Several releases a year | Every month or two |
| Vendor support | Business Edition | Community only | Netgate support | Community only |
| Licence cost per firewall | €0, or €149 a year | US$0 | From US$129 a year | €0 |
What an open-source firewall really costs
Licences are the smallest part of the bill. Over three years, on your own hardware, they range from nothing to a little over US$2,000 for pfSense Plus with Netgate’s top support tier.
The larger costs are the hardware and, above all, the time. Someone has to plan the rules, apply updates on schedule, review intrusion alerts, keep configuration backups, and be available when the internet stops working first thing in the morning. Plan for a few hours every month as a minimum, and for one person who genuinely understands the firewall plus a second who can follow written notes. If that person is a contractor billing by the hour, include them in the comparison with a commercial firewall.
Our honest view
Open-source firewalls are excellent software. They suit businesses with a capable IT person or team who enjoys running them. For an office without that person, the savings on licences tend to disappear the first time something goes wrong and nobody knows the setup.
What to run it on
All of these firewalls run on ordinary x86 hardware, which is part of their appeal. The choice of box still matters, because the firewall is the one device every byte of your internet traffic passes through.
- Vendor appliances. Netgate sells appliances with pfSense Plus included, and Deciso sells appliances built for OPNsense. Both are tested for the software and come with support for the hardware.
- Small x86 firewall boxes. If you build your own, look for Intel network chips, a processor with AES-NI for fast VPN encryption, a proper SSD rather than a memory card, and at least 8 GB of memory if you plan to run intrusion prevention.
- Two units, not one. OPNsense and pfSense can run as a high-availability pair, so a hardware failure or an update reboot does not take the office offline.
- Virtual machines with care. A virtual firewall works well in a data centre or Azure. In a small office, it ties the internet connection to the health of one server, so we avoid it for the main firewall unless there are two hosts.
Setting one up properly
An open-source firewall is only as good as its configuration. This is the order we would follow for any new installation.
- Put the provider’s modem in bridge mode. The firewall should hold your public IP address, with no second router doing its own address translation in front of it.
- Lock down the management interface. Never reachable from the internet, separate named administrator accounts, and multi-factor sign-in where the platform supports it.
- Split the network. Separate VLANs for staff, servers, phones and cameras, and guests, with rules that deny by default and allow only what each group needs.
- Start intrusion prevention in alert mode. Watch what it flags for a week, tune out the noise, then switch it to blocking.
- Add DNS filtering and threat blocklists. Many attacks are stopped cheaply at the point a device looks up a malicious domain.
- Build remote access with each person’s own login. IPsec or OpenVPN with multi-factor sign-in, and no shared VPN accounts.
- Send logs somewhere else. Forward them to a log server or monitoring service and keep them long enough to investigate an incident months later.
- Back up the configuration after every change. Encrypted, and stored off the firewall.
- Patch on a schedule. Subscribe to the project’s security announcements and apply updates within days, not at the next convenient visit.
Mistakes we see most often
| Mistake | Why it hurts | The fix |
|---|---|---|
| Management page open to the internet | Attackers scan for firewall login pages around the clock | Manage only from inside the network or over the VPN |
| Never upgraded | OPNsense supports only its latest release, and old pfSense CE builds miss fixes | A written update schedule with a named owner |
| One flat network | A compromised camera or guest device can reach the file server | VLANs with deny-by-default rules between them |
| Intrusion prevention on underpowered hardware | Internet speed collapses, so someone switches protection off | Size the hardware for inspection, not just for routing |
| Only one person knows the setup | Holidays and departures become outages | Documentation and a second trained person |
| VPN accounts for people who left | Former staff, or whoever holds their passwords, can still get in | VPN access tied to the same offboarding checklist as email |
Open source or commercial: which fits your business?
The question is less about features than about who will run the firewall. This is the simple test we use with clients.
Insurance and client requirements matter here too. Cyber insurance applications in Canada now routinely ask whether network devices are vendor-supported and patched, whether remote access uses multi-factor sign-in, and how quickly critical updates are applied. An open-source firewall can satisfy all of that, but only with records to show it. A commercial firewall with a support contract makes those answers easier to give.
Our own network team works mainly with FortiGate firewalls, installed and looked after as part of our networks and firewalls service. If you already run OPNsense or pfSense, our IT assessment or a vulnerability assessment will tell you plainly whether it is set up well and whether to keep it. And if your current firewall is an older SonicWall or WatchGuard, our firewall replacement guide explains what changed in 2025 and 2026.