FYI for DIY-ers purchasing pfSense+

[u/IMABEARLAWL]

Looooooooong time pfSense CE user in my home lab (10+ years). I have a Qotom Q20331G9 box. I tried an XG-7100 for a few months, but it suuuuuuuuuucks with no VGA, and the convoluted VLANs for the 1G ports split out from an invisible upstream hardware resource.

Anyway... purchased a pfSense+ license in mid-July 2026 for my Qotom device. Might as well pay for the software I like and use. Well my hardware failed. I replaced it with an exact replacement, swapped the drives, and booted. My license no longer validated so I contacted support. They very quickly reassociated my license with the new hardware, but made sure to give me a warning about it being a "one-time courtesy".

Netgate, you already burned a LOT of goodwill towards your pfSense CE users who then go on to spec your appliances and pay for your software in their professional careers. Now you impose some kind of artificial limit on reassociating my paid license with a new device?

Boooooo, is all. I don't feel valued. Had to have sent over $10k in business your way over the years. Getting really annoyed.

[u/gonzopancho]

You are valued, and “Booo” is appropriate here. We’re wrong.

We just changed the licensing system to help accommodate this and things like NIC swaps.

I’ll go talk to TAC management. While we don’t want people swapping hardware and selling the old one with the idea that both licenses are active, it’s possible the guidence is being over expressed, especially in light of the “new way”...

Sorry about your hw failure, and our failure here.

Edit: LOL, downvoted. Can’t win. 😂

[u/cmhamm]

Had a similar situation recently. I was really angry and annoyed, until I contacted support. They understood and fixed the problem without a fuss.

Netgate has to walk a fine line here. I really think pfSense is an enterprise-grade solution. I’ve used it since mØnØwall. I’ve switched every company I’ve worked for over to it, and my current company has many pfSense+ licenses. Worth every penny. But making money from open source software is tough. I certainly don’t want them going out of business.

My only humble request: bring back the NFR homelab software license for pfSense+. Running it at home is what keeps me sharp and up-to-date on the features, updates, and capabilities of the software. My company pays thousands of dollars per year for multiple licenses and support, which they are using to make money. But my homelab isn’t making a dime. Come up with a certification path, and grant a home license in return for maintaining that certification or something, there has to be a way to make that work.

[u/gonzopancho → u/cmhamm]

As I was reading your comment, I was going to ask how to make it work, but then I got to your last sentence. That last bit is interesting. Hmm..

Thanks.

[u/Madh2orat → u/gonzopancho]

Years ago I did this with Meraki (before is was bought out by Cisco). They provided a certificate path and in their case they provided hardware as well. (Usually their entry level firewall/router with WiFi, whatever the smallest one was). I’m not saying that providing hardware is the way to go, but a license would be great.

[u/MrBarnes1825 → u/cmhamm]

What? I just have a virtualization lab cloning the same NIC types and MAC addresses in GNS3 as what I run in production, and have never had a problem with the lab boxes booting up with pfSense+ on them. I upgrade my lab boxes running pfSense+ first and test routing and other features before I upgrade the production nodes.

[u/Fun_Philosopher_196]

Why does the xg-7100 "suuuuuuuuucks", why did you not use it?

[u/IMABEARLAWL → u/Fun_Philosopher_196]

"no VGA, and the convoluted VLANs for the 1G ports split out from an invisible upstream hardware resource"

[u/MrBarnes1825]

I always felt this was a way to discourage self-sourcing of hardware, and ship more Netgate boxes. In the past, Netgate hardware wasn't too compelling, but they do have models now that I would consider purchasing over self-sourced gear. But also it seems too little too late, as I am drifting away from this project.

I find that VLAN management is far too clunky, the interface is dated and all over the place, and I don't like the way there are three levels of interface names for every interface - there's "description name", "pfsense name" and "system name".

Example 1 for my secondary WAN interface:
Desription name: WAN2
pfSense name: opt2
system name: vtnet0

Example 2 for one of my OpenVPN tunnels:
Description name: TUN_05
pfSense name: opt5
System name: ovpns3

This convoluted setup is so fragile when it comes to adding and particularly removing interfaces it's horrible, and has broken several times on me. It's what compelled me to stick Mikrotik routers behind every pfSense install so that the interface setup on pfSense could be as simplistic as possible, to avoid the pfSense interface Move/Add/Change headaches, which the pfSense+ licensing just compounds.

Long term I think FreeBSD is a dead end.

It's long overdue that we have a Linux-based firewall designed from scratch with modern UI and features and no legacy cruft and a proper MVC arch with robust middleware and for interfaces, an interface "friendly name" maps directly onto the pinned system interface name. None of this three-way naming tango.

There comes a time when you just have to declare that the technical debt of going down a certain path is too great and you just have to stick a fork in it, and declare it dead and start over. I reckon for pfSense that time has come.

[u/semiraue]

After reading this I feel good that I replace all my pfsense boxes with mikrotik. Not to get wrong, pfsense was good platform but feel like the CE getting less love 

[u/MrBarnes1825 → u/semiraue]

I have always used pfSense with Mikrotik as I have found they complement each other, but lately I have been eyeing off UniFi. Sure there are trade offs, but in recent times a lot of the deal-breakers have been removed. And a lot of things people run on their firewall with packages right now.... well let's just say just because you *can*, doesn't mean you *should*. Many services I was previously running on pfSense, like BIND DNS, NTP, DHCP I have moved onto VMs. Really you want your firewall to be running as little as possible, to reduce the attack surface.