Certified pfSense Team

pfSense & TNSR: network security and high-performance routing

Combine pfSense for security and TNSR for software routing to protect branches, data centers, and cloud workloads with enterprise support.

Talk to an expert View products

1M+

Active installations worldwide

20+

Years of continuous development

100+ Gbps

Software routing performance

24/7

Enterprise support available

Netgate products

Choose the platform that matches your security and routing goals.

pfSense

Next-generation firewall, VPN, and network services on Netgate appliances or virtual infrastructure.

Explore product

TNSR

High-speed software router and VPN concentrator built on VPP for multi-cloud and edge.

Explore product

Why Netgate

Netgate combines open networking innovation with enterprise-grade support and hardware designed for security workloads.

Security first

Stateful firewalling, IDS/IPS, segmentation, and VPN built into the platform.

Proven performance

Routing and VPN throughput validated on Netgate appliances and cloud instances.

Flexible deployments

Deploy on Netgate hardware, private cloud, or public cloud with consistent management.

Expert support

Global support options, updates, and guidance from the Netgate team.

Deployment options

Scale from branch offices to multi-cloud architectures using the same operational model.

AWS and Azure images for rapid cloud rollout

Netgate appliances for on-premises performance

Hybrid designs with centralized control

Automation via APIs, CLI, and orchestration tools

Platform lifecycle

Operate with confidence using documented procedures, upgrades, and knowledge transfer.

Comprehensive documentation and configuration guides

Lifecycle updates and security advisories

Training paths for operations teams

Centralized management and monitoring

Netgate hardware ecosystem

Appliances mapped to home, branch, enterprise, and data center performance tiers.

Compact entry devices for small sites

Branch and medium business appliances with multi-gig interfaces

Data center and service provider throughput models

Side-by-side performance comparisons for routing, firewall, and VPN

Resources from the datasheets

Use Netgate documentation, hardware comparisons, and datasheets to validate your design.

pfSense documentation covering routing, VPN, HA, and operations

TNSR datasheets for performance and deployment options

Global support offerings for critical networks

pfSense Plus vs Commercial Firewalls

Objective comparison of features and costs between pfSense Plus and the most common proprietary alternatives in the enterprise market.

Feature	pfSense Plus	SonicWall	Sophos XGS
Licensing Model	No per-feature cost — IDS/IPS, VPN, HA all included	Mandatory annual subscription (TotalSecure)	Base license + annual subscription modules
VPN	IPsec, OpenVPN, WireGuard — unlimited tunnels	IPsec, SSL-VPN — user license limited	IPsec, SSL-VPN — model-limited
IDS/IPS	Suricata with ET Pro rules — included	Capture ATP — additional subscription required	Xstream Protection — Xstream license required
High Availability	CARP active/passive — included at no cost	HA active/passive — requires 2 licensed appliances	HA active/passive — requires license on both nodes
5-year TCO (mid-range)	~$5,000 USD (hardware + TAC)	~$18,000 USD (hardware + TotalSecure 5 years)	~$22,000 USD (hardware + Xstream Protection 5 years)
Technical Support	Netgate TAC + TUTARI local 24/7	SonicWall Support (English) + distributor	Sophos Support (English) + distributor

Which pfSense model do I need?

Netgate hardware selection guide based on your organization size, required throughput, and use case.

Model	Throughput	Users	Use Case
Netgate 1100	1 Gbps	1–50	Remote office, lab, site-to-site VPN
Netgate 2100	5 Gbps	50–200	Mid-size office, branch with IDS/IPS
Netgate 4100	10 Gbps	200–1,000	Corporate, data center, multi-WAN with HA
Netgate 6100	20 Gbps	1,000–5,000	Enterprise, campus, ISP edge with BGP
Netgate 8200	40+ Gbps	5,000+	Large data center, carrier-grade, high-density VPN

WHY TUTARI?

Why buy Netgate through TUTARI?

We have a Netgate-certified team with expertise in pfSense and TNSR firewalls for enterprise environments.

Netgate-Certified Team

Team certified in pfSense and TNSR. Design, deployment, and support of enterprise-grade open-source firewalls.

Local LATAM Presence

Offices in Costa Rica and Mexico. Local invoicing, Spanish-language support, and personalized attention in your time zone.

24/7 Technical Support

Bilingual team available around the clock. Response in under 2 hours for critical incidents.

Expert Analysis

Why choose TUTARI for your pfSense projects in LATAM?

TUTARI S.A. — Certified pfSense Engineers

TUTARI S.A. has certified pfSense engineers, each with over 10 years of industry experience deploying open-source firewalls in enterprise environments across Costa Rica, Mexico, and Central America. Our team has completed numerous pfSense high-availability (CARP) deployments for financial services, healthcare, telecommunications, and government organizations.

Our certified pfSense team enables us to deliver top-tier professional services: advanced pfSense Plus configuration, Netgate hardware (1100, 2100, 4100, 6100, and XG-7100 series), Zero Trust network segmentation architecture design, and TAC support escalation management with Netgate when required. Every deployment follows Netgate-documented best practices.

We deliver full lifecycle services: infrastructure assessment, multi-WAN failover topology design, migration from proprietary firewalls (SonicWall, Sophos, WatchGuard, Palo Alto), site-to-site VPN and IPsec/OpenVPN configuration for remote access, IDS/IPS implementation with Suricata, and 24/7 post-deployment support with guaranteed SLA.

FAQ

Frequently Asked Questions about Netgate and pfSense

Answers to the most common questions about our services

What is the difference between pfSense Community Edition and pfSense Plus?

pfSense CE (Community Edition) is the free open-source version under Apache 2.0 license, ideal for labs and personal use. pfSense Plus is Netgate's commercial edition with an optimized kernel, updated drivers, native WireGuard encryption, priority security updates, and official TAC support access. For enterprise environments, TUTARI recommends pfSense Plus for stability, support, and guaranteed updates. pfSense Plus code is based on updated FreeBSD with security patches not available in CE.

Can pfSense replace a SonicWall, Sophos, or Palo Alto firewall?

Yes. pfSense Plus offers the same core capabilities as proprietary firewalls: stateful inspection, IPsec/SSL VPN, IDS/IPS (Suricata with ET Pro rules), web filtering, high availability, multi-WAN, and reporting. For organizations up to 5,000 users with throughput under 10 Gbps, pfSense is a viable alternative with 60-80% lower TCO. TUTARI has successfully migrated organizations from SonicWall, Sophos, and WatchGuard to pfSense without functionality loss.

Which Netgate hardware does TUTARI recommend for my company?

It depends on throughput and required services: Netgate 1100 (up to 1 Gbps, small offices with 10-50 users), Netgate 2100 (up to 5 Gbps, SMBs with 50-200 users), Netgate 4100 (up to 10 Gbps, mid-size enterprises), Netgate 6100 (up to 20 Gbps, Enterprise with IDS/IPS and VPN), XG-7100 (high availability with failover). All include AES-NI crypto acceleration, eMMC/SSD storage, and hardware warranty. TUTARI provides free technical sizing based on traffic analysis.

Does TUTARI offer 24/7 support for pfSense?

Yes. We offer managed support plans including: 24/7 firewall monitoring (CPU, memory, interfaces, CARP state), proactive alerts for traffic anomalies or intrusion attempts, firmware updates scheduled during maintenance windows, incident response with 15-minute SLA for critical severity, and direct access to our certified pfSense engineers. We can also escalate to Netgate TAC for software issues.

Does pfSense support VPN for remote work at scale?

Absolutely. pfSense Plus supports OpenVPN (up to 1,000+ concurrent tunnels depending on hardware), IPsec IKEv2 (native on Windows, macOS, iOS, Android without additional client), and WireGuard (ultra-fast, ideal for mobile devices). TUTARI configures authentication against Active Directory/LDAP, MFA with TOTP/RADIUS, split-tunneling to optimize bandwidth, and granular access policies per user group.

How does pfSense cost compare to commercial firewalls?

pfSense Total Cost of Ownership (TCO) is 60-80% lower than SonicWall, Sophos, or Palo Alto over a 5-year period. There are no feature licensing costs (IDS/IPS, VPN, HA all included), no annual per-user subscription renewals, and Netgate hardware has a 7-10 year useful life. A Netgate 4100 (~$2,500 USD) matches the functionality of a SonicWall NSA 2700 (~$4,500 USD + $3,000/year for TotalSecure). TUTARI provides detailed ROI analysis as part of the initial assessment.

Design your Netgate deployment with us

We help you select pfSense or TNSR, define hardware, and build a rollout plan.

Request a consultation