Open and closed, software and appliances: the firewalls people usually weigh against FreeSense. We only list what we could verify from a public source, and we say where others are the better fit.
Last reviewed 2026-10 · Sources
FreeSense stays in view while you filter. On small screens, swipe the table sideways.
| Feature | FreeSenseFreeSense project | pfSense CENetgate | pfSense PlusNetgate | OPNsenseDeciso | MikroTik RouterOSMikroTik | OpenWrtOpenWrt project | IPFireIPFire project | VyOSVyOS Networks | Sophos Firewall HomeSophos | UniFi GatewayUbiquiti | FortiGateFortinet |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Source model | Open source | Open source | Closed source | Open source | Closed source | Open source | Open source | Open source | Closed source | Closed source | Closed source |
| License | Apache-2.0 | Apache-2.0 | EULA | BSD-2-Clause | Per-device license levels | GPL and others | GPL | GPLv2 / LGPLv2 | Free home-use license | Proprietary | Proprietary |
| Base OS | FreeBSD 16 | FreeBSD | FreeBSD | FreeBSD (formerly HardenedBSD) | Linux-based | Linux | Linux | Linux (Debian) | — | — | FortiOS |
| Packet filter | pf | pf | pf | pf | RouterOS firewall | nftables (firewall4) | Linux netfilter | Linux netfilter | — | — | FortiOS |
| Cost | Free | Free | From $129 per instance per year on your own hardware; included with Netgate appliances | Free; optional Business Edition subscription | Included with MikroTik hardware; CHR VM: free tier capped at 1 Mbps upload, paid tiers $45–$250 | Free | Free | Rolling images free; LTS images by subscription | Free for home use; limited to 4 CPU cores | Hardware purchase | Appliance or VM license plus FortiGuard subscriptions |
| Vendor account needed | No | — | — | No | For CHR trials | No | No | For LTS images | — | — | FortiCare account for the VM trial |
| Runs on | Your x86-64 hardware, VMs, cloud images (arm64 in Development) | Your x86-64 hardware | Netgate appliances, your x86-64 hardware, AWS, Azure | Your x86-64 hardware, Deciso appliances | MikroTik hardware, Cloud Hosted Router (VM) | About 2,000 consumer routers, x86, ARM boards | Your x86-64 hardware, ARM boards | Your x86-64 hardware, VMs, cloud | A dedicated Intel-compatible PC | Ubiquiti gateways and consoles only | Fortinet appliances, VMs, cloud |
| REST API | Built in, with API Explorer | Third-party package | — | Built in | Built in (RouterOS v7) | — | — | Built in (HTTP API) | — | — | Built in |
| WireGuard | Package | Package | Package | Built in | Built in (RouterOS v7) | Package | Built in | Built in | — | Built in (server) | — |
| IDS / IPS | Suricata package | Snort / Suricata packages | Snort / Suricata packages | Suricata, built in | — | — | Suricata, built in | — | Built in | Built in | Built in (FortiGuard subscription) |
| High availability | CARP | CARP, two-node clusters | CARP, two-node clusters | CARP | VRRP | — | — | VRRP | — | — | Built in |
| Central management | Fleet (1.2 Development, experimental), free and built in | No (Nexus is for pfSense Plus) | Netgate Nexus, licensed per managed device | OPNcentral (Business Edition) | — | — | — | — | Sophos Central | UniFi Site Manager, no license fee | FortiManager / FortiManager Cloud |
| Central management runs | On a FreeSense system you run; no cloud service | — | Nexus controller on a pfSense Plus host (25.07 or later) | OPNcentral plugin on an OPNsense system | — | — | — | — | Sophos Central, hosted by Sophos; cannot run on-premises | UniFi Site Manager at unifi.ui.com, signed in with a UI account | FortiManager, or FortiManager Cloud through FortiCloud |
| Commercial support | Community only | Paid support is for Plus | Netgate TAC (Lite, Pro, Enterprise) | Deciso and partners | MikroTik and consultants | Community | Community | VyOS Networks subscriptions | Community forum only | Ubiquiti | Fortinet and partners |
| Public CI builds | Yes, public and signed | — | No | — | No | — | — | — | No | No | No |
No products in this filter.
What each central manager does today, from the vendors' own documentation. Fleet is experimental; the others are released products.
| Capability | FreeSense FleetFreeSense project | Netgate NexusNetgate, pfSense Plus | OPNcentralDeciso, OPNsense | Sophos CentralSophos | UniFi Site ManagerUbiquiti |
|---|---|---|---|---|---|
| Status today | Experimental: in Development 1.2, not in Stable 1.1 | Documented by Netgate; the controller needs pfSense Plus 25.07 or later | Business Edition plugin | Released; Sophos says it has since evolved into Sophos Fusion | Released |
| Where it runs | A FreeSense system you run: your network, your server, or your own cloud image | On a pfSense Plus host | A plugin on an OPNsense system | Hosted by Sophos; it cannot be adapted for on-premises use | Ubiquiti's Site Manager at unifi.ui.com |
| Vendor account or cloud needed | No. Fleet makes no connection to FreeSense servers | — | — | Yes, it is a hosted service | Yes, you sign in with a UI account |
| Cost | Free | Licensed; see Netgate's Nexus licensing | Business Edition subscription | Free for XG Firewall customers; longer report history is a planned paid tier | No license fee |
| Manage many firewalls in one place | Yes, with groups | Yes, multi-instance management through a GUI and an API | Yes, remote firewalls over an encrypted connection | Yes, in custom groups | Yes, all the sites you administer |
| Update many at once | Yes: rings, maintenance windows and rolling reboots | — | Yes, one or more firewalls at once | One-click firmware updates; scheduled updates were planned | Yes, through Update Manager |
| Push configuration and policy | Templates, plus policies that audit, remediate or lock settings, with commit-confirm on rules | Instance configuration from one GUI | — | Group policy: changes go to every firewall in the group | — |
| Central backups | Yes, kept on the controller | — | — | Yes, configuration backup storage | — |
| Monitoring and reporting | Live dashboard, alerts, internet quality and a wall-screen view | — | Connection status and firmware version | Reports, graphs and log search; about seven days free | — |
| Set up HA pairs from the controller | Yes: a CARP pair guide for two firewalls | — | — | — | — |
| Zero-touch joining | Yes: a seed on USB or in cloud-init | — | — | Yes, a USB drive | — |
“—” means the sources below do not say, not that the feature is missing. FortiManager and the other products in the table above are not repeated here because we could not verify the same detail for them.
Every option here is a good choice for someone. An honest summary of each:
Choose FreeSense if you want a fully open pf firewall with no accounts or telemetry and builds you can trace to source, you want to bring an existing pfSense CE or OPNsense configuration with you (OPNsense in part), and you can live with a new project that has community support only.
Choose pfSense CE if you want the most widely documented pf firewall, with years of guides, forum answers and packages. FreeSense started from it.
Choose pfSense Plus if you want pfSense with a vendor behind it: tested appliances, newer features first and paid support with response times.
Choose OPNsense if you want a mature, fully open pf firewall with a large plugin set, built-in WireGuard and Suricata, and a company offering commercial support.
Choose MikroTik RouterOS if you want inexpensive, capable routing hardware with deep routing features (BGP, OSPF, MPLS) and are comfortable with its own CLI and configuration model.
Choose OpenWrt if you want to give an existing home router or small ARM board open firmware, often with Wi-Fi built in.
Choose IPFire if you prefer a Linux-based firewall with a long track record, a built-in Suricata IPS and frequent core updates.
Choose VyOS if you think in routers more than firewalls: CLI-first, scriptable, strong on BGP and VPN, and comfortable building LTS from source or subscribing.
Choose Sophos Firewall Home if you want a commercial next-gen firewall feature set (web filtering, IPS, anti-malware) at home for free, within its core limit.
Choose UniFi Gateway if you already run UniFi switches and access points and want one polished controller for the whole network.
Choose FortiGate if you need an enterprise firewall with dedicated security hardware, central management and a large vendor support organisation.
Untangle NG Firewall is now Arista Edge Threat Management. Arista ended sales of its Q-series NG Firewall appliances on 30 June 2026 and points customers to software editions or VeloCloud Edge, so it is not in the table.
FreeSense started from pfSense CE and is rebuilt from source on FreeBSD 16. Vendor registration, telemetry and upsell prompts were removed, and the WebUI, REST API and package manager are being rebuilt. Both share the pf packet filter.
Choose it if you value a fully open build you can trace from source to signed image, with no vendor account. If you need commercial support, a long track record or a large plugin catalogue today, OPNsense and pfSense Plus are more mature choices.
Yes, FreeSense imports both. During installation choose Import config, or restore the file under Diagnostics → Backup & Restore on a running system. A pfSense CE configuration is kept whole, because the format is shared. An OPNsense configuration is converted: system settings, interfaces, VLANs, gateways, routes, DHCP, users and certificates carry over, while firewall rules, NAT, VPNs and plugin settings have to be set up again. Installed packages and plugins are mapped to FreeSense packages. Test the import on a VM before you move production. Read the migration guide.
Stable releases are amd64. ARM64 builds, including Raspberry Pi, are in Development only. FreeSense runs on your own hardware, VMs and clouds; it does not sell appliances.
We could not verify it from a public source when we reviewed the page. It does not mean the product lacks the feature. Corrections with a source are welcome on GitHub.
Fleet is part of FreeSense 1.2 and is planned for early 2027. You can try it in Development builds today, where it is experimental; it will not come to Stable 1.1.
No. Fleet is self-hosted by design: the controller is a FreeSense system you run, and nothing is sent to FreeSense. You can still run the controller on a server or cloud account that you own, from a FreeSense cloud image, and manage your firewalls from there.
Reviewed 2026-10. Products change; if something here is out of date, please open an issue with a source.
pfSense and Netgate are trademarks of Rubicon Communications, LLC (Netgate). OPNsense is a trademark of Deciso B.V. MikroTik and RouterOS, OpenWrt, IPFire, VyOS, Sophos, Ubiquiti and UniFi, Fortinet, FortiGate and FortiOS, and Arista are trademarks of their respective owners. Names are used only to identify the products compared; FreeSense is not affiliated with or endorsed by any of them.
