Protectli vs Netgate 2026: Which Firewall Hardware Wins?

If you are buying a dedicated firewall appliance in 2026, your two real options are Protectli and Netgate. Both make fanless, x86-64, multi-NIC boxes purpose-built for firewall workloads. Both will run on the same Intel-grade NICs you actually want. The differences are in OS support, vendor relationship, and price-per-throughput.

This comparison draws on vendor specification pages and vendor documentation for representative models from each lineup, cited inline. Where a vendor publishes no figure, this page says so rather than filling the gap. Here is the breakdown.

Quick comparison

	Protectli VP2420	Netgate 4100	Protectli VP4670	Netgate 6100
CPU	Celeron J6412 (4c @ 2.0GHz)	Atom C3338R (2c @ 1.8GHz, QAT)	Core i7-10810U (6c/12t)	Atom C3558 (4c @ 2.2GHz, QAT)
RAM	Up to 32GB DDR4	4GB DDR4, non-ECC	Up to 64GB DDR4	8GB DDR4, non-ECC
Storage	16GB eMMC + M.2 SATA + 2.5in SATA	16GB eMMC + optional M.2 NVMe	NVMe + SATA	21.3GB eMMC + optional M.2 NVMe
NICs	4×2.5GbE Intel I226-V	2×1GbE RJ45/SFP combo + 4×2.5GbE	6×2.5GbE Intel I226-V	2×1GbE RJ45/SFP combo + 4×2.5GbE + 2×10G SFP+
Form factor	Fanless mini	Fanless rackmount option	Fanless mid-tower	Rackmount
OS support	OPNsense, pfSense CE, OpenWrt, anything Linux/BSD	pfSense Plus (preinstalled), pfSense CE, OPNsense*	OPNsense, pfSense CE, OpenWrt, anything	pfSense Plus, pfSense CE, OPNsense*
Vendor OS support	None — bring your own	pfSense Plus included	None	pfSense Plus included
Base price (vendor store, Aug 2026)	$369	$599	$659	$899

* OPNsense will install on Netgate hardware but Netgate does not officially support it; expect to be on your own for hardware-specific issues.

OS support is the real fork

The headline difference is what OS the vendor expects you to run.

• Protectli ships with your choice: blank, OPNsense, pfSense CE, or other. They are hardware-only — no OS support contract.
• Netgate ships pfSense Plus by default, and that’s the relationship they want with you. You can run OPNsense on Netgate hardware (the ARM-based 1100/2100 are trickier; the x86 models like 4100/6100 work fine) but you give up the support contract.

If you want OPNsense, buy Protectli. If you want pfSense Plus with vendor support, buy Netgate. Trying to use the “wrong” vendor for your OS works but defeats the point.

Performance: what the vendors actually publish

There is no clean head-to-head here, and it is worth saying why rather than papering over it. Netgate publishes throughput numbers for its appliances; Protectli does not publish equivalent figures on its product pages. This site does not run hardware benchmarks of its own, so the table below is Netgate’s own published data, measured under Netgate’s conditions, and it is not a comparison against Protectli.

Netgate published throughput	Netgate 4100	Netgate 6100
L3 forwarding (iperf3 / IMIX)	8.15 Gbps / 3.24 Gbps	18.50 Gbps / 6.08 Gbps
Firewall, 10k ACLs (iperf3 / IMIX)	4.09 Gbps / 1.40 Gbps	9.93 Gbps / 2.73 Gbps
IPsec VPN, AES-GCM-128 with QAT (iperf3 / IMIX)	960 Mbps / 312 Mbps	1.77 Gbps / 552 Mbps

Source: Netgate 4100 and Netgate 6100 store listings. Note how far IMIX figures fall below iperf3 figures on the same box. IMIX is a mixed packet-size profile closer to real internet traffic, so it is the number to plan around; a headline iperf3 result on any vendor’s page is a best case.

With no published Protectli numbers to sit beside those, the honest comparison is silicon rather than throughput. The VP2420’s Celeron J6412 is a four-core part at 2.0 GHz base. The Netgate 4100’s Atom C3338R is a two-core Denverton part at 1.8 GHz with QAT crypto offload. More general-purpose cores favor multithreaded inspection such as Suricata, which is where the VP2420 has the structural advantage. QAT favors IPsec, which is exactly the workload Netgate quotes its own numbers for. Neither of those is a substitute for testing on your own link, and anyone quoting exact Mbps for these boxes without naming a published test should be read skeptically.

NIC quality and SFP+

Both vendors use Intel-grade NICs, which is non-negotiable for a serious firewall. Realtek NICs (common in cheap Chinese mini-PCs on Amazon) are not acceptable for production firewalls — they have flaky FreeBSD driver support and you will spend weekends debugging.

Only the Netgate 6100 has 10G SFP+ ports, two of them. The Netgate 4100’s SFP connectors are not 10G: they are 1 Gbps combo ports shared with two of its RJ45 WAN ports, so its fastest interfaces are its four 2.5GbE LAN ports. If you have a 10 Gbps WAN handoff or a 10G internal backbone, that single difference decides the model for you. The VP2420 tops out at 2.5GbE across all four ports; on the Protectli side, 10G means stepping up to one of their higher-tier Vault models.

Build quality

Both are fanless, both are well-built, both will run silently for years. Long-term owner reports describe Netgate 2100s deployed since 2021 and Protectli VP2410s from 2022 still running fine. The Netgate units are generally regarded as a touch more “datacenter-grade” (heavier metal chassis, easier to rackmount). Protectli units are sleeker for desk placement.

Value verdict

Use case	Pick
OPNsense + 1 Gbps WAN, homelab/SMB	Protectli VP2420 — best price/performance
pfSense Plus + vendor support	Netgate 4100 — included Plus license and support
OPNsense + 10 Gbps WAN	Protectli VP6650 (~$749), two Intel 10GbE SFP+ plus four 2.5GbE copper
pfSense Plus + 10 Gbps WAN	Netgate 6100 — best-supported high-end option
Cheapest “real” appliance with Intel NICs	Protectli VP2410 (~$280)
Budget Netgate option	Netgate 1100 (~$199) but ARM-based, limited package support

Where to buy

• Protectli: Direct from protectli.com (no Amazon retail). Ships with your OS preinstalled if you ask, otherwise blank. ~2 week lead times.
• Netgate: Direct from netgate.com. Sometimes available on Amazon but at marked-up prices.

This site has no affiliate relationship with either Protectli or Netgate, as neither runs an affiliate program, and nothing on this page is a monetised link. Other articles do link to general Amazon hardware such as mini-PCs, NIC cards and SFP+ modules; those are affiliate links and carry a disclosure at the top of the article they appear in.

Further reading

• OPNsense vs pfSense 2026 head-to-head
• Best homelab firewall in 2026
• pfSense alternatives: seven platforms compared
• Firewalla vs pfSense: appliance or DIY
• Best hardware for OPNsense on opnsenselab.com

Related across the network

• i226-V Link Drops: Fix 2.5GbE Flapping on OPNsense — n100firewall.com
• Best OPNsense Appliance for Home: Protectli and Deciso — opnsenselab.com