pfSense vs FortiGate for UK small businesses: costs, licensing and lock-in

Updated August 2026 · Written by the Firewall Buddy team. Yes, we sell pfSense appliances — so we've been careful to keep this fair, and we tell you below when FortiGate is the right choice.

The real difference isn't the firewall — it's the business model

Feature-for-feature, a FortiGate and a Netgate appliance running pfSense Plus do the same core job for a small business: stateful firewalling, NAT, VLANs, site-to-site and remote-access VPN, intrusion detection, content filtering. The difference that actually hits your budget is how you pay.

FortiGate follows the commercial UTM model: you buy the hardware, then pay an annual security subscription (FortiGuard bundles) to keep threat updates, web filtering and support active. These renewals commonly amount to a substantial share of the original hardware price, every year — and when you stop paying, the protection features stop updating.

Netgate/pfSense Plus works the other way: the software licence ships with the appliance, software updates are free for the life of the device, and security packages like Suricata IDS/IPS and pfBlockerNG cost nothing. Support (Netgate TAC) is a genuinely optional extra, not a dependency.

Three-year cost of ownership, sketched honestly

Take a typical 20-person office. A Netgate 4200 MAX is £546 inc. VAT once; add our optional setup (£149) and you're at £695 for three years of protection — renewals: zero. A comparable small-business FortiGate starts in the same hardware ballpark, but by year three the accumulated subscription renewals typically mean you've paid for the hardware twice over. We're deliberately not quoting exact FortiGate street prices here because bundles and discounts vary — ask your reseller for the three-year all-in figure and compare it with ours. That comparison is the whole argument.

There's a second cost people forget: the forced refresh. Commercial vendors end support for hardware on their schedule, and renewal quotes tend to climb as a unit ages, nudging you to re-buy. Netgate appliances receive pfSense Plus updates for the device's realistic service life.

Where FortiGate genuinely wins

Fairness matters, so: if you run dozens of sites with dedicated network staff, Fortinet's Security Fabric and FortiManager give you centralised, single-vendor orchestration that pfSense doesn't replicate at the same scale. Some enterprise compliance frameworks also specify certified commercial stacks. If that's your world, FortiGate is a rational choice. For one office, a few branches, or an MSP-managed SME — the scenarios we serve — you're paying enterprise-fabric money for capabilities you won't use.

Already on FortiGate? Switching is less painful than you think

The usual blocker isn't hardware cost — it's the fear of re-creating years of rules and VPNs. That's precisely what our migration service does: full config audit, every rule and tunnel translated and tested, out-of-hours cutover with a rollback plan, from £399 inc. VAT. Many customers time the switch to their next renewal quote: instead of paying another year's subscription, that money buys the replacement hardware outright.

Still not sure? Let us help — free

Two-minute quiz, or email us a quick description of your network and we'll give you an honest recommendation — even if it's the cheaper model.

Take the quiz → Ask us

Frequently asked questions

Is pfSense as secure as FortiGate?+
Both are mature, widely deployed firewall platforms. FortiGate bundles proprietary threat feeds through paid subscriptions; pfSense Plus achieves comparable protection for typical SME needs through included packages such as Suricata (IDS/IPS) and pfBlockerNG, without recurring fees. For most UK small businesses the practical security difference comes down to configuration quality, not brand.
What happens if I stop paying FortiGate renewals?+
The hardware keeps running but the security services that make a UTM worthwhile — threat intelligence updates, web filtering, antivirus signatures and often firmware entitlement — stop. With a Netgate appliance the software licence and updates are included for the life of the device; optional TAC support is exactly that, optional.
Can you migrate our FortiGate config to pfSense?+
Yes — that's one of our most requested services. We audit your existing rules, NAT and VPNs, re-create them in pfSense, and cut over out-of-hours with a tested rollback plan. Migration starts at £399 inc. VAT for a single site.
When would you actually recommend FortiGate over pfSense?+
If you're standardised on the Fortinet Security Fabric across many sites with dedicated staff managing FortiManager, or a compliance framework specifically mandates a particular certified vendor stack, staying with Fortinet can make sense. For a typical UK SME with one or a few sites, that machinery is usually cost without benefit.