OPNsense vs pfSense 2026: Licensing and Firewall Hardware

pfSense CE and pfSense Plus

Netgate’s software types table (read October 11, 2026) lists pfSense CE at “No Charge” under an “Open Source” license. pfSense Plus is sold per instance per year: $129 with TAC Lite, $399 with TAC Pro, $799 with TAC Enterprise, all three under a EULA. TAC Lite support is “best effort” help getting a Plus instance and one client online; Pro and Enterprise add 24-hour and 4-hour response targets.

Netgate’s store page for the TAC Lite subscription describes it as a “Commercial license for one instance on a white box/DIY, or Virtual Machine”, keyed to a Netgate Device ID, and adds that “Business usage, production usage, MSP/CSP usage, etc requires a commercial pfSense+ license subject to the EULA.” The Plus FAQ confirms the route: Plus on third-party hardware comes “via a TAC LITE subscription using the Netgate Installer”, and going back to CE takes a reinstall.

The free Home+Lab tier is gone, and has been for three years. Netgate’s own posts give the dates. On October 26, 2023 it wrote that Home+Lab “is no longer available for free download”, recalled that the no-cost upgrade path had been announced on February 14, 2022, and blamed appliance vendors who were installing Home+Lab on boxes “which they then sell”. Four days later, on October 30, 2023, Netgate apologized (“we reacted too quickly”) and set TAC Lite at $129 a year. Existing Home+Lab users who do not buy it “will not receive updates”; new users install CE first and upgrade after buying.

OPNsense community edition and Business Edition

OPNsense’s 26.7 release notes (July 15, 2026) restate “clear and stable 2-Clause BSD licensing”. A business may run it in production without paying anyone. The Business Edition is for those who want “a more selective upgrade path (lags behind the community edition)” and commercial extras. Deciso’s shop, read October 11, 2026, prices it at €149 a year or €399 prepaid for three years, “valid for only one installation”, with GeoIP database access, an OVA image and plugins such as OPNcentral; the ET Pro ruleset is a separate product.

Netgate software types table, TAC Lite store page and Plus FAQ; Deciso’s OPNsense shop (euro prices as shown by default); all read October 11, 2026. Three-year column is our multiplication at today’s prices, which may change; the Deciso three-year price was marked as a sale.

Both free editions cost nothing; Plus starts at $387 for three years. Netgate and Deciso price pages, October 11, 2026.

One clause matters to buyers of used hardware: Netgate’s FAQ answers “Can I load and sell pfSense CE software?” with “No.” So no machine here ships with a firewall OS; you install it.

No. Netgate’s release history (updated August 24, 2026) shows pfSense CE 2.9.0 on August 20, 2026, built on the same FreeBSD 16.0-CURRENT snapshot as pfSense Plus 26.07, released a week earlier. Netgate’s announcement counts “over 150 new features, enhancements, and fixes”, including a WireGuard security fix.

The rumor has a real basis. CE 2.7.2 came out on December 7, 2023 and the next release, 2.8.0, on May 28, 2025: nearly 18 months. Netgate’s FAQ says it will keep releasing CE but that “the frequency and depth of this support will be evaluated on an ongoing basis”, and promises Plus “around three releases per year”. Since May 2025 CE has had three releases (2.8.0, 2.8.1, 2.9.0); Plus has had 25.07, 25.11, 26.03 and 26.07 plus point releases. Netgate’s supported-releases page lists CE 2.9.0 and 2.8.1. CE gets the same security fixes, later: advisory pfSense-SA-26_01 (April 1, 2026) was fixed in Plus 26.03, while CE 2.8.1 users could apply it from the System Patches package until 2.9.0 shipped in August.

OPNsense runs on a calendar. Its roadmap describes “a 6 months major release cycle with firm release dates”: 25.1 in January 2025, 25.7 in July 2025, 26.1 on January 28, 2026, 26.7 on July 15, 2026, and 27.1 planned for January 2027. Minor updates come in between; the community release list counts 354 releases since January 2015, the latest 26.7.7 of October 13, 2026.

The base systems differ. pfSense 2.9.0 and Plus 26.07 sit on a FreeBSD 16.0-CURRENT development snapshot; OPNsense 26.7 sits on FreeBSD 15.1-RELEASE. Either way, hardware support is FreeBSD’s. OPNsense’s hardware page says it outright: “All FreeBSD drivers are included in the OPNsense kernel, and the hardware compatibility is the same.”

On history: OPNsense first shipped in January 2015 (15.1); Netgate dates Plus, formerly Factory Edition, alongside CE to 2014. OPNsense’s account of the fork says “less than 10% of the original legacy code base remains”; that is one side’s story.

Both do stateful filtering, NAT, VLANs, IPsec, OpenVPN, WireGuard and high availability. Five differences change what you buy or how you run it.

1. Crypto acceleration. Netgate’s cryptographic accelerator page (updated December 16, 2025) marks Intel QAT and IPsec-MB “[Plus only]”; AES-NI works on both editions. Netgate calls QAT “currently the fastest acceleration option for compatible algorithms” and says IPsec-MB, which uses the CPU’s SSE, AVX2 and AVX-512 instructions, “can even meet or exceed the performance of dedicated acceleration hardware such as QAT on current versions”. OPNsense’s free edition added a QAT crypto-module selector in 22.1.2 (March 1, 2022).

2. IDS/IPS. pfSense’s package list carries both Snort and Suricata, plus pfBlockerNG. OPNsense builds its IPS into the core: its IPS manual says it “is based on Suricata and utilizes Netmap”; we found no Snort in OPNsense’s core documentation. Netgate says Suricata can use netmap “for inline IPS on compatible hardware”; OPNsense offers a “Netmap (IPS)” mode and a “Divert (IPS)” mode that redirects packets through firewall rules. OPNsense’s instruction for IPS mode: “make sure all hardware offloading features are disabled.”

3. WireGuard. In OPNsense it has been part of the core since 24.1 (January 2024). In pfSense you “install the WireGuard package from the Package Manager”, and it runs in the kernel, per Netgate’s WireGuard docs.

4. Installation. The Netgate Installer is “the only available method for installing pfSense software on all devices”; it “fetches them over the Internet” and checks whether the system is eligible for Plus. The image comes from the Netgate Store with a store account; the installer itself is free. OPNsense offers ISO, VGA, serial and nano images from public mirrors, no account.

5. ISP gateway bypass. Some fiber providers, AT&T the example Netgate names, authenticate the line through their own gateway. Netgate’s 802.1X bridging recipe warns that in IP-passthrough mode the ISP modem “may still track states” and some have “a hard limit on the number of states”. Its alternative needs “a firewall with at least three unique, discrete interfaces” and options “only present on pfSense Plus software version 23.05-RELEASE and later”. We make no claim about an OPNsense equivalent.

High availability is not a differentiator: pfSense pairs CARP, pfsync and XMLRPC sync in an active/passive cluster, and OPNsense uses CARP with state and configuration sync too. It costs more than a second box: Netgate wants three IP addresses in each subnet, a /29 or larger per WAN “for an optimal configuration”, and its state sync page calls identical hardware on both nodes “always the best practice”.

Netgate documentation (release history updated August 24, 2026; accelerators December 16, 2025; packages December 19, 2025; 802.1X recipe August 21, 2025); OPNsense release notes 22.1, 24.1 and 26.7, IPS and HA manuals, read October 11, 2026.

Less than most people buy. Netgate’s minimum requirements (updated August 26, 2025) are a 64-bit x86 CPU, 1 GB of RAM, an 8 GB disk and “one or more compatible network interface cards”, with the warning that minimums “are not suitable for all environments”. OPNsense’s sizing page sets a minimum of a 1 GHz dual-core with 3 GB, and recommends a 1.5 GHz multi-core, 8 GB of RAM and a 120 GB SSD. Its throughput table, which pairs that spec with “350-750+ Mbps”, cites a 2015 source; read it as history, not a benchmark.

Memory goes to states, IPS and caches. Netgate’s sizing guide (updated December 16, 2025): “Each state takes approximately 1 KB of RAM”, each connection uses two, and a million states take about 976 MB, plus 175–256 MB for the OS and services. For Snort or Suricata, “1 GB should be considered a minimum, but some configurations may need 2 GB or more”. OPNsense’s 3 GB minimum, sized for an SD or CF card, leaves out features that write to disk, such as “a caching proxy (cache) or intrusion detection”. Every VEP4600 and the R630 we recommend below have at least 32 GB, more than ten times OPNsense’s minimum.

The CPU is the first bottleneck, and the NIC decides how much CPU each packet costs. The same Netgate page: “Inexpensive, low-end cards consume significantly more CPU than better quality cards such as Intel. The first bottleneck with firewall throughput is the CPU.” Firewalls are limited in packets per second, so a throughput figure means nothing without a packet size:

Netgate, “Hardware Sizing Guidance”, updated December 16, 2025. The same packet rate is 23 times more bandwidth at 1,500-byte frames than at 64-byte frames.

Neither project publishes throughput for white-box hardware; Netgate calls estimating it “difficult and inaccurate”. We have no measured figure for the machines below, and will not invent one.

VPN is where the CPU features count. Netgate: “IPsec will nearly always be faster than OpenVPN”, and “AES-GCM is accelerated by AES-NI”. Its ranking, fastest first: Plus on hardware with QAT; then a CPU with the instructions IPsec-MB uses; then AES-NI with AES-GCM in IPsec. WireGuard uses ChaCha20-Poly1305, not AES: AES-NI does nothing for it, Netgate names QAT for IPsec and OpenVPN DCO, and only Plus’s IPsec-MB lists WireGuard.

AES-NI is not required, and never shipped as a requirement. Netgate announced on May 1, 2017 that pfSense 2.5 would require it; the same post now carries a note that on March 18, 2019 “AES-NI is no longer a requirement for pfSense 2.5.0.” The 2.5.0 release notes say CE 2.5.0 and Plus 21.02 “DO NOT require AES-NI”, and the current minimums do not mention it. It is a speed feature for AES VPNs, shipped by Intel since Westmere in 2010 per the same post; every VEP4600 CPU has it per Intel, and the R630’s Xeon E5 v3 and v4 are later generations.

OPNsense’s sizing page says Intel NICs “are reliable, fast and not error-prone” and “deliver higher throughput at a reduced CPU load”. FreeBSD’s man pages explain why that matters most for IPS. netmap(4) in FreeBSD 15.1 “natively supports” cxgbe (Chelsio), em, igb, ix, ixl (Intel), re (Realtek) and vtnet (VirtIO), plus iflib(4), the framework igb and em are built on. Other NICs work “through emulation”, and “performance is inferior to native netmap mode”. OPNsense documents the switch: set dev.netmap.admode to 2 when the card is not fully supported.

So for inline IPS the documented families are Intel, Chelsio, VirtIO and the older Realtek chips re(4) covers. The Broadcom 57412 and 57416 driver, bnxt(4), is also built on iflib, whose source attaches netmap to every iflib driver, but netmap(4) does not name it and we have not tested it. Older Broadcom (bxe, bge), QLogic (qlnxe) and Mellanox (mlx5en) cards have FreeBSD drivers, but not native netmap.

Realtek is the usual mini-PC trap. FreeBSD 15.1’s re(4) lists chips from the RTL8139C+ to the RTL8111, and no RTL8125 2.5 GbE; FreeBSD’s development branch has an rge(4) driver for it, 15.1 does not. OPNsense ships a realtek-re plugin, Realtek’s own driver, for when the built-in one gives “watchdog timeouts” or does not support the card.

Intel optics locks differ by driver. ix(4), covering X520, X540 and X550, has a tunable, hw.ix.allow_unsupported_sfp, to “Allow unsupported small form-factor pluggable (SFP) modules. Use at your own risk.” ixl(4), covering the 700 series including X710 and X722, says most adapters require Intel-qualified modules and “This qualification check cannot be disabled by the driver.” It names the Intel-coded FTLX8571D3BCV-IT among qualified SFP+ modules; we list that part (Dell XYD50) at $9.79, 14 units, as of October 14, 2026. Module coding is covered in our optics guide; we have no DAC cables.

Form factor comes before chipset. Server network cards are often not PCIe cards. Our cheapest listing titled “I350-T4”, at $14.99, is a mezzanine card for Dell M-series blades; it fits neither a VEP, an R630 nor a desktop. The quad-port X710-DA4 at $19.24 is a Dell rack daughter card, and the QLE41164 quad SFP+ at $29.99 is listed as a mezzanine card with no bracket. Intel quad-port gigabit cards with a bracket are down to single units: a Dell-branded Intel I350-T4 (0NWK2) and an HPE NC365T (Intel 82580, also on igb) at $16.21, one unit, both full height. These are the bracketed cards in our network cards category that suit a firewall:

PCSP catalog, October 14, 2026, bracket from each listing’s catalog fields; stock is thin and moves daily. Netmap and drivers: FreeBSD 15.1 netmap(4), the drivers’ own man pages and the iflib source, read October 11, 2026; bnxt untested by us.

A full-height quad card suits a tower or desktop you already own. The cheapest complete four-port Intel gigabit firewall we can sell is a whole machine: an R630 with Dell’s I350 rack daughter card, or a VEP4600.

The VEP4600 is the closest thing to a firewall appliance on our shelf. Dell’s spec sheet (March 2022) calls it a platform for virtual network functions “like routing, firewall or deep-packet inspection”. It is a 1U box with a Xeon D-2100 of 4, 8 or 16 cores, four 1 GbE and two 10 GbE SFP+ ports, separate management ports for the CPU and the BMC, serial consoles, TPM 2.0, two M.2 SATA slots and four DIMM slots.

Dell does not name the network chips; ServeTheHome’s press review of July 29, 2026 identifies the SFP+ ports as Intel X722 inside the Xeon D and the gigabit ports as an Intel I350-AM4. If that holds, the onboard ports use ixl and igb, both native in netmap, and the X722’s SFP+ cages likely carry the optics check that ixl cannot disable.

As of October 14, 2026 we have 35 VEP4600 listings, one unit each, from $384.99 to $1,749.99. They sit in our network switches category, and a search for VEP4600 lists all of them.

CPU data: Intel ARK for the D-2123IT, D-2145NT and D-2187NT, read October 11, 2026. Power: Dell VEP4600 spec sheet, March 2022 (4- and 8-core with four fans, 16-core with five). Listings and prices: PCSP catalog, October 11, 2026, one unit each; floor per core = cheapest listing (32 GB, 256 GB SSD) ÷ cores.

Four times the cores for $175.00 more. PCSP catalog, October 11, 2026, one unit per listing.

On price, the extra cores are cheap: at 32 GB and a 256 GB SSD, going from 4 to 8 cores costs $70.00 and from 8 to 16 another $105.00. All three turbo to 3.00 GHz, so by our reading of Intel’s figures one connection runs about as fast on any of them; extra cores help IPS and parallel VPN tunnels. Memory and SSD move the price more: the 16-core box runs from $559.99 to $1,749.99 on RAM and SSD alone, and the 480 GB listings cost more than their 1 TB twins in all six pairs we can compare.

QAT: the 4-core model has none. Intel ARK lists “Intel QuickAssist Technology: No” for the D-2123IT, and Dell’s spec sheet says “QAT: Yes (except for 4 core)”. QAT comes only with the 8-core D-2145NT and the 16-core D-2187NT, and even there is a second catch: FreeBSD 15.1’s qat(4) names C62x chipsets, Atom C3000 and P5300, QAT adapters and the 4xxx series, not Xeon D-2100. We have not tested whether pfSense Plus or OPNsense uses the engine on this box. Netgate says IPsec-MB can match QAT, and all three CPUs have AVX-512, but in pfSense that too is Plus only.

Operating system: Dell lists no FreeBSD. Dell’s technology guide (Rev. A06, July 2020) lists Ubuntu, Red Hat/CentOS, VMware ESXi, Versa OS and ADVA, and names VeloCloud, Versa, ESXi and ADVA Ensemble as validated. We found no Dell, Netgate, OPNsense or press source showing either firewall installed directly on a VEP4600. Every NIC chip our listings name has a FreeBSD driver, but BIOS, BMC and console behavior under FreeBSD are untested by us. The documented route is a VM, on the hypervisor the box ships with or on Proxmox.

What it ships with. Twenty of our listings come with VMware ESXi 7.0 Update 2 installed, the other fifteen with Ubuntu; where a configuration exists with both, the price is the same. Broadcom ended general support for vSphere 7 on October 2, 2025: no patches, no support. Do not put an out-of-support hypervisor under your firewall; what a supported ESXi costs now is in our hypervisor licensing comparison. Intel also ended servicing updates for all three CPUs on December 31, 2023, per ARK.

More ports: buy them installed. Dell’s installation guide (May 2019) warns: “Customers are not to attempt installing Virtual Edge Platform (VEP) 4600 expansion cards. A Dell EMC Certified technician must perform this installation.” The two expansion slots take Dell modules, not PCIe cards. Six of our 16-core listings already carry one: three with an Intel X550 plus I350 card (two 10GBase-T and two gigabit ports, drivers ix and igb) and three with a Broadcom 57412 card (two SFP+ and two gigabit, driver bnxt). The card adds $105.00 at 32 GB and 64 GB, and $140.00 at 128 GB. For inline IPS, the Intel one is the documented choice.

Noise and power: not a cupboard box. Dell’s technology guide gives ISO 7779 sound levels of 48.7–56.2 dBA around a four-fan unit and 49.8–57.7 dBA around the five-fan 16-core, loudest at the back. Dell’s R630 papers, quoted in our home lab guide, put a minimal R630 at 25 dBA idle; the test setups differ, so read that as a direction, not a precise gap. Dell’s “typical” draw is 160 to 206.5 W; ServeTheHome measured 65–70 W at idle on a 16-core unit with two quad-port X710 modules. At the $1.61 per watt-year of that home lab guide, 65–70 W around the clock is $104.65–$112.70 a year, and Dell’s typical figure would be $257.60–$332.47.

A Dell PowerEdge R630 brings its network on a rack daughter card in its own slot, so its PCIe slots stay free. Most complete R630s we list ship with Dell’s I350 card: four Intel gigabit RJ-45 ports on the igb driver, native in netmap.

As of October 14, 2026, the cheapest such listing on our PowerEdge R630 page is $385.91, two identical listings of 5 units each: two 10-core Xeon E5-2660 v3, 32 GB of DDR4, an H730 controller and the I350, with no drives. A firewall needs a boot drive on top; OPNsense recommends a 120 GB SSD. The $119.99 floor of that category is the build-your-own starting price before CPU, memory, controller and power supply, not a machine. Our cheapest complete R630 overall is $275.93, with 16 GB and “No NIC” in its title, so we leave it out here.

Adding a card: check the slot height. Dell’s R630 owner’s manual (June 2022) lists low-profile slots in every riser layout, and one full-height slot only in the two-card layout. Our R630 listings do not state the riser layout, so assume low profile: the I350-T2, X540-T2, 57810 and 57412 in the table above fit; the full-height I350-T4, X550-T2 and X710-T4 may not.

R630 or VEP4600? The R630 is the cheaper way to four Intel gigabit ports and takes ordinary PCIe cards, which the VEP does not. The VEP has 10 GbE SFP+ built in, QAT on 8- and 16-core models, and console ports meant for appliance work. Neither is quiet. We have no measured idle figure for an R630 in a firewall role; the home lab guide’s measured numbers are for R730-family builds. For a higher-ceiling 1U, our PowerEdge R640 complete listings start at $544.37, also with an I350 and no drives.

A firewall VM lets one used server route and host other workloads, and on a VEP4600 it is the route the documents support: Dell’s spec sheet lists ESXi and KVM, and both firewalls document VM installs. Netgate’s Proxmox recipe (updated December 19, 2025) has one hard rule: with VirtIO interfaces, hardware checksum offloading must be disabled; current pfSense versions try to do it automatically, and “Do not skip this step, otherwise the virtual machine will not properly pass traffic.” VirtIO’s vtnet driver is native in netmap, so Suricata IPS inside the VM has driver support; passthrough versus a bridge is your call, and we have not benchmarked either. On VMware, OPNsense’s virtual install notes list “Traffic Shaper does not work on VMware” and suggest switching VMXNET3 to E1000. What else to run on the host is in our Proxmox workloads guide.

Where our hardware is the wrong answer, box to box with the license included:

Netgate store pages for the 4200 MAX, 6100 MAX and 8200 MAX, read October 11, 2026; Netgate includes Plus with complimentary TAC Lite for the life of its appliances. PCSP catalog, October 14, 2026 (VEP: one unit; R630: two listings, 10 units). VEP power and noise: Dell spec sheet and technology guide. TAC Lite at $129 a year, today’s price.

With Plus, our used boxes cost about what a 4200 MAX does; with CE or OPNsense, $385.91 to $454.99. Netgate store and PCSP catalog, October 11, 2026.

A quiet home network without IPS. The Netgate 4200 MAX costs $829 with Plus and TAC Lite for the life of the appliance. Netgate’s store page calls it a “silent desktop form factor” on a 60 W power brick, with four 2.5 GbE ports, and publishes 3.2 Gbps of IPsec with AES-GCM in iperf3 and 1.05 Gbps on its IMIX mix, measured by Netgate on Plus 23.09.1. Any 1U from us is louder, can draw more at idle than that brick’s 60 W rating (ServeTheHome measured 65–70 W on a VEP), and needs a rack or a shelf away from people. If the box lives in a living room, buy the fanless one.

A multi-gig LAN. None of the cards we stock is 2.5 GbE, and the VEP and R630 have gigabit and 10 GbE ports only. If your switch and ISP run 2.5 GbE, a 2.5 GbE appliance fits better than our hardware.

Vendor support for the firewall on this hardware. On a VEP4600 neither Dell nor Netgate lists the combination. If an auditor or insurer wants one vendor behind both hardware and firewall software, buy a Netgate or Deciso appliance.

Inline IPS on the wrong NIC. On a Broadcom 57810, QLogic or Mellanox card, Suricata’s netmap mode runs emulated; the Broadcom-card VEP’s bnxt is unnamed in netmap(4) and untested by us. If IPS is the point, choose Intel ports, which on our shelf means the base VEP ports, the Intel-card VEP or an R630 with its I350.

Where we do win: the 8-core VEP4600 at $454.99 has the same two 10 GbE SFP+ ports as the 6100 MAX, QAT on paper and 32 GB of memory against its 8 GB, and costs $1,144.01 less than the 6100 MAX with OPNsense or pfSense CE, or $757.01 less with three years of Plus. At ServeTheHome’s idle figure for a 16-core unit, the VEP’s power is about $105–$113 a year, so the gap survives three years of electricity, before counting the Netgate’s own draw, which Netgate does not publish. It does not buy silence.

Is pfSense still free?

pfSense CE is free and open source; version 2.9.0 shipped on August 20, 2026. pfSense Plus is free only on Netgate appliances. On your own hardware or a VM it requires a TAC Lite subscription at $129 per instance per year, which Netgate describes as a commercial license. The free Home+Lab edition of Plus ran from February 14, 2022 until Netgate withdrew it on October 26, 2023.

Is OPNsense free for business use?

Yes. OPNsense’s community edition is released under the 2-clause BSD license, with no restriction on commercial use. Deciso sells an optional Business Edition at €149 a year per installation, with a slower, more selective upgrade path that lags the community edition, plus GeoIP access and some commercial plugins.

OPNsense vs pfSense: which should I choose?

Both run on FreeBSD, so hardware support is largely shared, though pfSense sits on a FreeBSD development snapshot and OPNsense on 15.1. Choose OPNsense for a free license with no commercial-use limit, built-in WireGuard and Suricata, six-month releases and offline installers. Choose pfSense CE if you want Snort as well as Suricata at no cost, or Plus at $129 a year for QAT and IPsec-MB acceleration, best-effort Netgate support and the 802.1X ISP bypass recipe.

Does pfSense require AES-NI?

No. Netgate announced in 2017 that pfSense 2.5 would require AES-NI, dropped the plan by March 2019, and the 2.5.0 release notes say CE 2.5.0 and Plus 21.02 do not require it. It speeds up AES VPNs such as IPsec with AES-GCM.

What hardware does OPNsense need?

OPNsense’s documentation sets a minimum of a 1 GHz dual-core x86-64 CPU with 3 GB of RAM, and recommends a 1.5 GHz multi-core CPU, 8 GB of RAM and a 120 GB SSD. Netgate’s sizing guide adds 1 GB minimum for IDS/IPS, 2 GB or more for some configurations, and about 1 KB per firewall state.

Which network cards work best with pfSense and OPNsense?

Intel cards on FreeBSD’s igb, ix and ixl drivers, Chelsio cards and VirtIO in a VM. Both projects recommend Intel, and FreeBSD’s netmap supports these natively, which Suricata’s inline netmap mode relies on. Older Broadcom, QLogic and Mellanox cards have FreeBSD drivers but use emulated netmap. FreeBSD 15.1’s Realtek driver does not list the RTL8125 2.5 GbE chip. Most Intel 700-series SFP+ cards accept only Intel-qualified optics.

Can a Dell VEP4600 run pfSense or OPNsense?

As a virtual machine, yes: the VEP4600 ships with VMware ESXi or Ubuntu, and both firewalls run as VMs on ESXi or KVM-based hosts such as Proxmox. Bare metal is unverified. Dell lists Linux, ESXi and several SD-WAN systems, no FreeBSD, and we found no source showing either firewall installed directly on one. The 4-core model has no QAT.

Is pfSense CE abandoned?

No. Netgate released pfSense CE 2.9.0 on August 20, 2026 on the same FreeBSD base as pfSense Plus 26.07, after 2.8.0 in May 2025 and 2.8.1 in September 2025. The rumor comes from a gap of nearly 18 months between 2.7.2 in December 2023 and 2.8.0.