Netgate sizing guide: which pfSense Plus firewall does your business need?
Updated August 2026 · Written by the Firewall Buddy team, using Netgate's published pfSense Plus benchmarks.
The short answer
Six models cover almost every UK business. Find your row, then read on for the three things that change the answer.
| Your situation | Model | Firewall / IPsec VPN throughput | Price inc. VAT |
|---|---|---|---|
| Home office · 1–5 people · up to ~150 Mbps | Netgate 1100 | 656 Mbps / 74 Mbps | £234.00 |
| Small office · up to ~25 people · up to ~500 Mbps | Netgate 2100 MAX | 964 Mbps / 254 Mbps | £366.00 |
| Growing SME · 25–60 people · full 1 Gbps line | Netgate 4200 MAX | 8.61 Gbps / 3.20 Gbps | £546.00 |
| Established business · 60–150 people · multi-gig or 10G, VLAN-heavy | Netgate 6100 MAX | 10.1 Gbps / 2.1 Gbps | £894.00 |
| Large SME / campus · 150–500 people · 10 Gbps links | Netgate 8200 MAX | 18.5 Gbps / 3.24 Gbps | £1,558.80 |
| Datacentre / HQ core · 500+ people · HA pairs | Netgate 8300 | 26.8 Gbps / 14.6 Gbps | from £4,410.00 |
Throughput figures are Netgate's published benchmarks for pfSense Plus. Rackmount alternatives (1537/1541) and TNSR high-throughput routers are on our full range page.
Adjustment 1: what you switch on matters more than user count
Datasheet throughput is measured doing plain firewalling. Real deployments enable intrusion detection, VPNs and content filtering — and each costs CPU. Broad Suricata rulesets can take a third to half of a small appliance's throughput; every simultaneous VPN user adds encryption work. This is why the honest sizing question isn't how many people? but what will the box be doing? If the answer includes 'IDS on everything and thirty home workers on VPN', go up a size from the table.
Adjustment 2: size for your next connection, not your current one
A firewall serves five-plus years. FTTP is rolling out; leased-line prices keep falling; the 500 Mbps line you have today is likely 1 Gbps mid-life. Buying to today's connection is how a firewall becomes the bottleneck in year three. One model up typically costs £150–£350 more — cheap insurance against replacing the whole unit.
Adjustment 3: when uptime is money, pair up
From the 6100 upward, consider two units in an HA pair (pfSense CARP failover): one fails, the other takes over in seconds, and maintenance stops needing a maintenance window. It doubles hardware cost, so it's for businesses where an hour offline costs more than a second appliance — which, for a 100-person company, it usually does. Our engineers configure HA pairs as part of setup; talk to us before buying and we'll spec the pair properly.
Two-minute quiz, or email us a quick description of your network and we'll give you an honest recommendation — even if it's the cheaper model.