Pfsense Firewall

Canada only - $400 CAD

Not used but without box.

Does anyone know if Netgate appliances support RFC 7383 for IKE fragmentation? Their chatbot couldnt help, and I can't open a ticket because I dont have TAC yet. Still evaluating.

Our company purchased an 8200 in December 2025 for a project that never moved forward and we are well past the return window. The unit was used once for testing and that's it. Asking $1500. Local pickup in NYC metro area or shipping within the US.

Mods please remove the post if it's not allowed.

Is there an expected timeline for non Netgate appliance support for this? As in, we have probably a dozen virtual pfsense machines that we'd like to be able to connect. Or is this going to be an only pfSense+ module? I get the marketing emails, but no additional details on this. Posting here, as a response would help a lot of other people too.

Hello,

I have SSL offloading running in HAProxy and a port 80 redirect to 443.

When I run ACME renew, naturally it cannot receive because of the port 80 redirect.

What is the best way to get around this problem ?

I tried creating an ACL for the path /.acme etc and then forward for that and local for not, but I didn't succeed. Needless to say, I am a brand new pfSense user, and chatGPT has given me 10 wrong solutions or so by now...

Thanks for any help 👍

For the past couple of days I've been try to register with for the Netgate forums. It doesn't matter which browser I try, what username I pick, whether I'm trying to do it from a work computer or home computer or with a VPN turned on or off, I keep getting the following message:

Anyone else having issues, or is it just me?

When I bought a 4200, I intended to use one port for WAN and the three others for the same LAN.

I was advised to rather use only one port and connect it to a switch, so that the 4200 got less work. Is that really a problem?

If I do want to use all 3 ports for the same LAN, do I need to make a bridge or what is the best approach?

I will use one of the ports for a switch, but prioritize another one for a server.

Thanks for your advice.

I just bought a 4200 Max, but received:

Labeled as 4200-S-USA with serial 2005xxxxxx. The USA has been hidden with a marker and EU added by hand, so it seems it was originally for the US market. The label also has: pfSense 25.11

Any concerns? Is it a refurbished?

I read somewhere that Max models start with 2008xxxxxx

And I read that older models have AMI firmware and newer have SBL.

I haven't tried to switch it on, so I have no idea if it has NVMe disk onboard.

What do you think, should I accept or return?

I used to run a Netgate 2100 at home. I loved it, but it couldn't handle routing gigabit WAN.

About two years ago I swapped it for a janky x86 mini PC as a stopgap router, waiting for Netgate to release something with the power of a 4200 combined with something like 5GbE RJ45 or a SFP+ slot.

Unfortunately it's been quiet in the sub-800$ category since the 4200 came out, so I was starting to wonder if there are any hardware plans at this moment in or near this category?

I got a netgate 8200 for a really good deal, anyone got any good services to run on it?

Today, Netgate^® is pleased to announce the release of pfSense^® Plus software version 26.03. This regularly scheduled update brings over 40 improvements, bug fixes, and enhancements. We strongly encourage all pfSense Plus customers to upgrade to the latest version.

Some new features include:

• WebGUI Optimizations - The WebGUI code has been optimized. Users may experience a dramatic increase in GUI performance.
• System Patches Package - All installations now include it by default.
• SSH Algorithms - Increase security by including post-quantum key exchange algorithms and by removing older and weaker algorithms.
• TLS Certificate Strength - Weak (<2048 bits) TLS Server Certificates have been deprecated. This version checks the GUI certificate during the upgrade process and will re-generate a new GUI certificate if the current certificate is invalid, expired, or weak.
• TLS Certificate Auto-Renew - This version automatically renews TLS server certificates, whether self-signed or signed by an internal CA configured in pfSense Plus.

Note: There is a special message about the exciting future of pfSense software development in the official blog post.

Blog Post:
https://www.netgate.com/blog/netgate-releases-pfsense-plus-software-version-26.03

Release Notes:
https://docs.netgate.com/pfsense/en/latest/releases/26-03.html

This is the main router in my system ,whilst I do have a spare, I am considering the recommended replacement - SG2100 which is a totally different beast internally. Would be grateful for any insights here Neil

Question for anyone still selling. As a partner, I see a lot of "Out of Stock" or "Back-ordered" for the past 6-8 months. Is the old logistics manager from Ubiquiti running the orders? Haven't seen a vendor this under-supplied since the 2020 pandemic. I get zero communications from Netgate, unless it is the usual price hike due to low supply/high demand of parts like memory and such, which I understand.

So I have a NG6100 with LAN-LAN4 all bridged together. LAN goes to a switch, on that switch is the vast majority of the network, including the DHCP server (we are not using the NetGate for DHCP, we have a Windows Server doing this). Everything on the switch seems to work fine, but we are trying to test an issue with their IP Phones and the phone vendor wants us to eliminate the switch as a possible issue and so is asking us to plug a phone directly into the router.

When plugging the phone (or any other device) into LAN2-4, they don't get an IP address. When a manual address is assigned it works though.

So it seems that DHCP traffic isn't working? Do I need to set DHCP relay or something? Again, all 4 LAN ports are bridged together under OPT7, so they aren't on different network segments, they're all together, and the DHCP server is on that same network.

I didn't realize how big of a problem this was when I purchased these devices several years ago. A THIRD died tonight while trying to update to the newest version. The first one died about a month ago, then another a few weeks later. I emailed Netgate support and their actual solution is "next time buy a 2100 because you can install and SSD when the emmc dies". and sent a link to the store. What a fucking response. And of course this failure NEVER happens while it's still under warranty.

I love pfsense, but I'm disgusted with Netgate right now.. The fact that they knew about this issue for so long and it took YEARS to come up with a fix is crazy to me. Over $600 worth of dead devices and they tell me to buy a more expensive device that has replaceable storage for the next time this happens, which makes me wonder if the fix is really a fix.. Has anyone tried to replace the emmc chip? I don't want to accept that I've got 3 paperweights on my desk... Hell even if they'd just send me 3 new emmc chips I could swap them out myself and that would be fine with me. But no... Just a cold response telling me to spend more money..

Hi folks, we have a 1537 with the add on card. I need to set up a pair of Cisco Firepower appliances but the last four available ports are 4,5,6 and 7. 6 and 7 are sfp ports. We are trying to go Cisco->Cat6->sfp but the transceivers so far are throwing the ‘Unsupported SFP+ module type was detected” from within pfsense. These were FS.com Cisco compat, second pair was Intel compat. I’ve now ordered a pair from NetGate themselves, probably should have done that to begin with.

Am I doing something incorrectly? Is there a cmd within pfsense that I can issue a command like Cisco has (service unsupported-transceivers).

Sorry, I don’t know much about these things.

Thanks for your time.

This started with not being able to install any packages, so I tried updaing, but it kept telling me that I was up to date on v2.7.0. That led me to this post:

https://www.reddit.com/r/PFSENSE/comments/18er398/issue_unable_to_install_packages_via_the_package/

I followed the instructions in that post, which then seems to put the firewall through the motions of upgrading, but once it reboots, it is still on 2.7.0 and same issues with no packages, etc. Below is the end of the output from the upgrade:

Installed packages to be UPGRADED:

`pfSense-kernel-pfSense: 2.7.0 -> 2.7.2 [pfSense-core]`

Number of packages to be upgraded: 1

The process will require 2 MiB more space.

[1/1] Upgrading pfSense-kernel-pfSense from 2.7.0 to 2.7.2...

[1/1] Extracting pfSense-kernel-pfSense-2.7.2: .......... done

===> Keeping a copy of current kernel in /boot/kernel.old

>>> Removing unnecessary packages... done.

>>> Activating boot environment default... done.

System is going to be upgraded. Rebooting in 10 seconds.

Success

But, once it reboots, it is still at 2.7.0.

I am hoping to find a solution other than backup and reinstall, since this firewall is in a remote location and I will have to travel there to perform the re-install. Thanks.

A new public Release Candidate for pfSense® Plus 26.03 is now available for testing!

Thank you to all users willing to test this Release Candidate. Your involvement is essential to making Netgate® 's pfSense Plus product a stronger solution for everyone. 

This Release Candidate includes over 40 updates, bug fixes, and enhancements. 

Some new features include:

• WebGUI Optimizations - The WebGUI code has been optimized. Users may experience a dramatic increase in GUI performance.
• System Patches Package: All installations now include it by default.
• SSH Algorithms - Increase security by including post-quantum key exchange algorithms and by removing older and weaker algorithms.
• TLS Certificate Strength - Weak (<2048 bits) TLS Server Certificates have been deprecated. This version checks the GUI certificate during the upgrade process and will re-generate a new GUI certificate if the current certificate is invalid, expired, or weak.
• TLS Certificate Auto-Renew - This version automatically renews TLS server certificates, whether self-signed or signed by an internal CA stored in the pfSense software configuration.

Release Notes: https://docs.netgate.com/pfsense/en/latest/releases/26-03.html

Per Title.

Like, say I have a local network of 10.0.0.0/24, and remote network of 10.69.84.0/24

I want to set up the IPSec VPN so that only traffic meant to go to the 10.69.84.0/24 network actually goes through the tunnel and all other traffic goes out the WAN without using the tunnel.

I cannot use separate interfaces to do this, I cannot use VLANs, the devices being used need to be able to "just connect"

EDIT: For example, with a SonicWall, which is what I'm used to, there's a radio button selector where I can tell it to route ALL traffic through the VPN, or only things meant for a specific remote network (I can then select that network from a dropdown listing all the Network Address Objects listed).

So how do I set it up to be similar to the second option?

We’re excited to announce the release of Netgate^® TNSR^® 26.02, our latest update packed with powerful new features, expanded capabilities, and over 30 bug fixes and enhancements.

What’s New in version 26.02?

VPF High Availability State Synchronization
Allows peers to automatically re-synchronize connection data when they restart

VPF Statistics Output Filters
Users can now filter VPF connection statistics output by connection type. This makes troubleshooting and gathering NAT statistics simpler and easier to read.

Dynamic Routing Prefix-List Sequence Numbers
Input validation no longer allows sequence numbers to start at 0. Upgrading TNSR will renumber entries in the prefix list starting at 1

Release Notes: https://docs.netgate.com/tnsr/en/latest/releases/release-notes-26.02.html
Blog Post: https://www.netgate.com/blog/netgate-releases-tnsr-software-version-26.02
Learn More: https://www.netgate.com/tnsr

1. Environment

• pfSense Version: 2.8.1-RELEASE (AMD64)
• Tailscale Package Version: 0.1.8
• Hardware: 4-port Mini PC (Intel Pentium N4200 @ 1.10GHz)
• Topology:
  • Local pfSense Network: 192.168.33.0/24
  • Remote Network (Site-to-Site): 192.168.30.0/24

2. The Problem: Boot Loop & Instability

After a fresh reinstall and configuration restore, I am facing two primary issues:

A. Boot Hang / Lockup

To apply specific NAT rules, I attempted to assign the tailscale0 interface via Interfaces > Assignments. When assigned, the system hangs during reboot or displays the following error:

"Warning: configuration refers to interfaces that do not exist: tailscale0"

It appears the system attempts to load firewall rules before the Tailscale daemon initializes the tunnel device, causing a mismatch. I am forced to use the console (Option 1) to unassign the interface just to successfully boot.

B. Connectivity Loss

If I leave the interface unassigned, the system boots correctly, but the Tailscale connection becomes unstable over time. It works initially after restarting the service, but eventually, I lose access from my mobile device or the remote network.

3. NAT Configuration & Troubleshooting Steps

My goal is to configure Outbound NAT so that clients on my LAN can route traffic out through the Tailscale node. I have attempted to use Hybrid Outbound NAT.

Because I cannot stably assign the tailscale0 interface (due to the boot hang), it does not appear in the Transalation "Interface adress" dropdown menu, preventing me from selecting it for network translation.

I tried creating an IP Alias using the pfSense Tailscale IP to use in rules, but results have been inconsistent.

What am I doing wrong? Is anyone else experiencing the same thing?

I have a Netgate 4100 which has it's EOL coming soon. What exactly does this mean from a cyber security standpoint? Will I miss security updates pto any CVE that may be found.