Anyone who buys from Netgate will sooner or later face a question that hardly anyone answers in English: pfSense® Plus or TNSR®? Both run on the same hardware. Both come from Netgate. And yet, they are two fundamentally different products. This article explains when each is worthwhile – without marketing fog, using the figures that Netgate itself publishes.
The Core Difference in One Sentence
pfSense Plus is a firewall with a web interface. TNSR is a router for very high throughput, controlled via command line and API. You operate one, you automate the other.
Where the Difference Really Matters: Throughput
The point at which the two worlds diverge is performance on identical hardware. Two examples from Netgate's own product specifications:
| Appliance | with pfSense Plus | with TNSR |
|---|---|---|
| Netgate 8200 MAX | 18.6 Gbit/s Router · 18.5 Gbit/s Firewall · 3.24 Gbit/s IPsec | over 18 Gbit/s L3 Routing |
| Netgate 8300 | 36.7 Gbit/s Router · 26.8 Gbit/s Firewall · 14.6 Gbit/s IPsec | over 110 Gbit/s L3 Routing |
With the 8300, this is the jump that matters: from around 37 Gbit/s to over 110 Gbit/s – the same machine, different software. The reason lies in the architecture: TNSR processes packets not individually through the operating system stack, but bundled in user space.
For the 8200 and 6100, on the other hand, both lines are around 18 Gbit/s L3 routing. Here, TNSR is therefore not worthwhile for pure speed, but for the second argument.
The Second Argument: Automation
TNSR is configured via CLI and a RESTCONF API. This allows it to be integrated into Ansible®, SaltStack®, Puppet®, or Chef®. The device configuration exists as code – versionable, auditable, reproducible.
For you, this means specifically:
- One location: pfSense Plus. The web interface is quicker to use than writing a playbook.
- Five locations following the same pattern: Here, TNSR starts to pay off. One set of rules, rolled out everywhere.
- Fifty locations or a service provider network: TNSR, without a second thought.
What TNSR is not
Honesty is more important than selling here: TNSR is not a firewall in the sense of pfSense Plus. Netgate publishes only L3 routing values for TNSR – no firewall or VPN throughput figures.
What you get with TNSR are routing and access control features: BGP, OSPF, RIP, Policy-based Routing, ECMP, VRRP, BFD, VRF, NAT, and Access Control Lists on Layers 2 to 4.
What you do not get: the pfSense package world. No pfBlockerNG, no Snort or Suricata for IDS/IPS, no Squid proxy, no Captive Portal, no web interface. If you need ad blockers, web filters, and intrusion detection on one device, pfSense Plus is the right choice – regardless of budget.
The Price Difference
TNSR is licensed per instance per year. The first year is included with every appliance, including 24x7x365 TAC Professional Support. After that, the renewal costs €1,199 net (TAC Pro) or €1,799 net (TAC Enterprise) per instance per year.
With pfSense Plus, TAC Lite is included free of charge; TAC Professional and TAC Enterprise are optional. This is the honest part of the calculation: TNSR has ongoing costs that pfSense Plus does not have in this form. These costs must be justified by throughput or saved administration time.
The Quick Decision Aid
pfSense Plus, if: you want a firewall with a web interface · need IDS/IPS, web filters, or a Captive Portal · operate one to a few locations · stay below 10 Gbit/s.
TNSR, if: you need to route significantly over 20 Gbit/s · operate many instances following the same pattern · want to manage configuration as code · security functions are already located elsewhere in the network.
A Note on 1537 and 1541
If you still come across offers for the Netgate 1537 or 1541: Both models have reached End of Sale at Netgate. Netgate explicitly names the Netgate 8300 as the successor. We therefore deliberately no longer carry these two models.
Unsure? Ask Us.
We are an authorized Netgate partner from Cologne and supply both software lines on the same hardware. Tell us your number of locations, the required throughput, and your filtering requirements – then we'll tell you which line fits. Even if it's the cheaper one.
All performance data is from Netgate's official product pages (shop.netgate.com), as of August 2026. All prices net plus VAT.
Leave a comment
This site is protected by hCaptcha and the hCaptcha Privacy Policy and Terms of Service apply.