www.it-connect.fr
pfSense 26.10 Unifies CE and Plus, Making All Features Free
Do you run pfSense CE on your own hardware? With version 26.10, Netgate is merging CE and Plus into a single free edition. Here’s what’s changing.
The pfSense firewall is celebrating its 20th anniversary, and Netgate has decided to mark the occasion. In a recently published article on the Netgate blog, Jim Thompson announces that starting with version 26.10, there will only be one edition of pfSense. In other words, there will no longer be any distinction between pfSense CE (Community Edition) and pfSense Plus. This new version is expected before the end of November.
As a reminder, Netgate launched pfSense Plus in 2021. Since then, some features were reserved for this Plus edition (paid for business use), while the CE edition followed a separate release cycle. The free Home+Lab edition of pfSense Plus even disappeared at the end of October 2023, with Netgate then steering individuals toward the $129 per year TAC Lite subscription. In the end, pfSense now acknowledges that these two editions mainly created frustration and uncertainty, especially with too many questions about which version to install. Add to that the complexity of managing two codebases and two release cycles.
pfSense 26.10: the Plus feature set for everyone
For many of you, pfSense is the firewall in your homelab. And when it isn’t, it’s often OPNsense. Now, let’s look at what version 26.10 will bring to every installation:
- All features, no payment required: on any amd64 machine, with no account or registration. This includes Snort 3 with Intel Hyperscan and ThreatGate with Zero Trust Egress (ZTE).
- The new interface and full API: the built-in API becomes the official path for automation, replacing third-party API packages. Its documentation is published on GitHub.
- Free, in-line security fixes: whether pfSense runs on a Netgate appliance or on your hardware.
- The return of the offline installer: for deploying pfSense on a network that is never connected to the Internet.
CE users will also get features that were previously reserved for Plus: OpenVPN DCO and Intel IPsec Multi-Buffer to accelerate VPNs. Also worth noting are Intel QuickAssist (on compatible hardware), ZFS boot environments, unicast CARP (useful on hypervisors and in the cloud), Layer 2 filtering, native NetFlow and IPFIX export, and even 802.1X authentication bridging on the WAN. It’s a real party!
The move from pfSense CE 2.9 to version 26.10 is free and performed in place, while keeping the configuration intact. Current packages, especially HAProxy, FRR and ACME, remain compatible, while pfBlockerNG will continue to work in the old interface as long as it exists. In reality, ThreatGate is presented as its successor for DNS-based blocking.
Another major change: the base system is becoming package-based. Netgate will be able to deliver a fix for a single component (OpenSSL, etc.) without waiting for a new pfSense release. This is especially interesting in today’s environment, where AI tools are now quickly discovering bugs in open source code. Later on, Netgate will tackle a major task: the complete removal of the old PHP-based interface.
And this new interface was rewritten from scratch in Go by Netgate and launched in August 2026 with pfSense Plus 26.07, under the name Netgate Nexus. It is enabled from the System > Advanced menu and runs on port 8443 on the firewall. The old PHP interface remains available in parallel during the transition, while all functions are being migrated.
What remains paid
Netgate considers that what you pay for is convenience and support, especially technical support. "We do not charge for security.", Jim Thompson summarizes.
After version 26.10, security fixes will continue to be distributed for free, and Netgate specifies that they are intended for the current version (what about earlier versions?). To move to the next version without a subscription, you will need to reinstall from the installer, which backs up and restores the configuration. But be careful: a Netgate employee clarified on the forum that the installer reformats the disk, so previously created ZFS boot environments are lost. On a homelab firewall, that is perfectly manageable. On a dozen firewalls spread across customer sites, that is a different story... If you pay, you get online upgrades without reinstalling.
In general, if you are already paying, not much changes. In fact, Plus subscribers (TAC Lite, TAC Pro and TAC Enterprise) keep their subscription and online upgrades, with no action required on their part. Owners of a Netgate appliance keep access to upgrades for the entire lifetime of the device, with no subscription required.
What do you think?
