What hardware to buy for pfSense router in 2021

This article has been last updated on November 1, 2021

We sell quite a lot of open-source hardware. Most of our customers are fans of pfSense, the most popular open-source operating system for routers. The question we often get is "What hardware should I get for pfSense?". 

It's already 2021, so any hardware you get must be ready to support the next release of pfSense. The upcoming version 2.5 of pfSense has one key requirement that previous versions didn't. The CPU must support AES-NI, the native, hardware encryption instructions. Software encryption will no longer be supported, so you must make sure your CPU has AES-NI.

Update: pfSense has announced that version 2.5 will support hardware without AES-NI. It is still strongly recommended that your processor supports it, but it's not a strict requirement. For details, see the message from the pfSense team.

pfSense 2.5 hardware requirements

Not everyone is the same, but there are some common requirements that any hardware must fulfil. 

  • CPU should support AES-NI
  • CPU must be powerful enough to route your internet traffic
  • CPU should be x86 64bit Intel or AMD
  • RAM - you must have enough for the packages you want to run. 
  • NICs - LAN ports should be coming from Intel. pfSense still doesn't perform great with Realtec Network Interfaces.
  • WiFi - pfSense supports a very limited number of WiFi adapters. If you plan on using WiFi, make sure you get the right adapter. 

What is AES-NI?

AES-NI (AES New Instructions) is a new encryption instruction set, baked right into CPU that dramatically speeds up cryptography tasks such as encryption/decryption for VPN or SSL. AES-NI was initially developed by Intel, but most modern AMD CPUs also support it now. 

There are a lot of routers sold online that claim to be pfSense compatible and don't support AES-NI. This is theoretically true because pfSense 2.4 does not strictly require it. Once pfSense 2.5 will be released, their routers will be stuck with the old version of pfSense.

All hardware sold by TekLager has AES-NI support and Intel NICs.

pfSense firewall appliance recommendations

 

Cheap pfSense box - APU3D4

APU is a well known, reliable hardware manufactured by Swiss company PC Engines. APU2, APU3 and APU4 routers are the most popular hardware firewalls we sell at TekLager. This is the cheapest pfSense router we sell but don't be deceived, it's a very capable firewall for home or small office.

Tip: in most applications, this box will perform just as well as the more expensive versions.

  • CPU: 4 core, 1Ghz AMD GX-412TC (with AES-NI) 
  • RAM: 4GB ECC DDR3-1333 DRAM
  • NIC: 3x Gigabit Intel i211AT
  • Storage: 16GB mSata SSD
  • Routing throughput: 1Gbit on pfSense using multiple connections. 550Mbit/s using single connection.
  • VPN: 100Mbit over OpenVPN, ~500Mbit over WireGuard. 
  • Cooling: Passive, fanless cooling.
  • Power consumption: 6-10W - very low power consumption

See the full specification here: APU3D4 router 

This hardware is definitely good enough for home usage. It's passively cooled, so it's completely silent. 

Our favorite thing about APU routers is that they are 100% silent, cheap, powerful enough and super reliable. 

APU3D4_ROUTER

APU3D4 3x Gigabit LAN, Quad Core CPU, 16GB SSD, 4GB RAM

TekLager APU3D4 Router/Firewall. 3x Gigabit NIC, Quad Core CPU, 16GB SSD, 4GB RAM. Compatible with pfSense, IPFire, OPNSEnse and others.

2,638 SEK

(3,297.5 incl. SE 25% VAT)
2,638 SEK 2099-01-01

( about $309 USD)

 

TLSense J3160

For those who would like to have a bit better CPU or mote LAN ports, we recommend TLSense J3160, which is one step up from APU. It has 4x intel NICs, a more performant Intel Celeron 3160 CPU and 4GB of RAM.

  • CPU: 4 core, Intel J3160 Quad Core 2.24Ghz (with AES-NI)
  • RAM: 4GB DDR3-1333 DRAM (Max 8 GB)
  • NIC: 4x Intel i211AT
  • Storage: 16GB mSata SSD
  • Routing throughput: 1Gbit on pfSense using 1 or many connections.
  • VPN: ~100Mbit over OpenVPN, 700Mbit over WireGuard. 
  • Cooling: Passive, fanless cooling. 0 noise
  • Power consumption: ~7-10W - very low power consumption

See the full specification here: TLSense J3160:

This configuration is very popular. This CPU ensures that this hardware will last you for a long time.

TLSENSE-J3160-V2

TLSense J3160: 4x Gigabit LAN, Intel Celeron J3160,

TekLager TLSense J3160: 4x Gigabit LAN, Intel Celeron J3160, 4GB RAM

3,026 SEK

(3,782.5 incl. SE 25% VAT)
3,026 SEK 2099-01-01

( about $355 USD)

TLSense - the high-end performance

TLSense 8550U is a powerful box. It's great if you plan to use IDS/IPS packages such as Suricata or Snort for Intrusion detection and prevention. It's also a very good choice for a VPN gateway. This hardware is most often purchased by customers who have a Gigabit internet connection and want to utilize high-throughput OpenVPN connection. 

It has a powerful Intel i7 8550U CPU, 16GB of RAM, and 120GB SSD. It comes with 6 Gigabit Intel LAN ports and an HDMI port.

  • CPU: CPU: 8th generation Intel Core i7 8550U Quad-Core, 8 threads, Up To 4.0GHz
  • RAM: 16GB (2133/2400MHz)
  • NIC: 6x Gigabit Intel i211AT
  • Storage: 120GB mSata SSD installed (accepts regular SATA drives as well)
  • Routing throughput: 1 Gigabit on pfSense, and other operating systems
  • VPN: 1Gbit over OpenVPN, 1Gbit over WireGuard. 
  • Cooling: Passive, fanless cooling. 0 noise
TLSENSE-i7-8550U

TLSense 8550U: 6x Gigabit LAN, 8th gen i7 CPU,

TekLager TLSense 8550U: 6x Gigabit LAN, 8th gen i7 CPU, 128GB SSD, 16GB RAM

7,200 SEK

(9,000 incl. SE 25% VAT)
7,200 SEK 2099-01-01

( about $845 USD)

If you are looking for something else, see other models.

If you are looking for a pfSense WiFi router read this article we wrote about pfSense wireless support

Cheers!