If you are buying a dedicated firewall appliance in 2026, your two real options are Protectli and Netgate. Both make fanless, x86-64, multi-NIC boxes purpose-built for firewall workloads. Both will run on the same Intel-grade NICs you actually want. The differences are in OS support, vendor relationship, and price-per-throughput.
This comparison draws on vendor specification pages and vendor documentation for representative models from each lineup, cited inline. Where a vendor publishes no figure, this page says so rather than filling the gap. Here is the breakdown.
Quick comparison
| Protectli VP2420e | Netgate 4200 | Protectli VP4670 | Netgate 6100 | |
|---|---|---|---|---|
| CPU | Celeron J6412 (4c @ 2.0GHz) | Atom C1110 (4c @ 2.1GHz, AVX2) | Core i7-10810U (6c/12t) | Atom C3558 (4c @ 2.2GHz, QAT) |
| RAM | Up to 32GB DDR4 | 4GB LPDDR5 | Up to 64GB DDR4 | 8GB DDR4, non-ECC |
| Storage | M.2 SATA SSD (NVMe not supported) | 128GB NVMe M.2 SSD | NVMe + SATA | 21.3GB eMMC + optional M.2 NVMe |
| NICs | 4×2.5GbE Intel I226-V | 4×2.5GbE RJ45, no SFP cages | 6×2.5GbE Intel I226-V | 2×1GbE RJ45/SFP combo + 4×2.5GbE + 2×10G SFP+ |
| Form factor | Fanless mini | Fanless desktop, wall-mount kit optional | Fanless desktop | Fanless desktop, 1U rack kit optional |
| OS support | OPNsense, pfSense CE, OpenWrt, anything Linux/BSD | pfSense Plus (preinstalled), pfSense CE, OPNsense* | OPNsense, pfSense CE, OpenWrt, anything | pfSense Plus, pfSense CE, OPNsense* |
| Vendor OS support | None — bring your own | pfSense Plus included | None | pfSense Plus included |
| Price (vendor store, Oct 2026) | $359 | $829 (MAX) | $659 | $1,499 (BASE) |
* OPNsense will install on Netgate hardware but Netgate does not officially support it; expect to be on your own for hardware-specific issues.
Netgate’s store notes that the 4200 and 6100 prices both include fluctuating memory and component costs, so expect them to move. The 4200 figure is for the MAX configuration, the one Netgate’s 4200 listing now offers (Netgate 4200, Netgate 6100). On the Protectli side, the VP2420 product page now marks that model as replaced by the VP2420e, which keeps the Celeron J6412 and four Intel I226-V ports, takes an M.2 SATA SSD rather than NVMe, and lists at $359 (VP2420e product page). The VP4670 lists at $659 on its product page.
A note on the Netgate 4100. Plenty of 2026 buying guides still name it. Netgate does not: its product lifecycle page records the 4100 as end-of-sale on 14 December 2023, replaced by the 4200, with end-of-life on 14 December 2026. Anything you buy new in that lineage today is a 4200, which is the model in the table above.
OS support is the real fork
The headline difference is what OS the vendor expects you to run.
- Protectli ships with your choice: blank, OPNsense, pfSense CE, or other. They are hardware-only — no OS support contract.
- Netgate ships pfSense Plus by default, and that’s the relationship they want with you. You can run OPNsense on Netgate hardware (the ARM-based 1100/2100 are trickier; the x86 models like 4200/6100 work fine) but you give up the support contract.
If you want OPNsense, buy Protectli. If you want pfSense Plus with vendor support, buy Netgate. Trying to use the “wrong” vendor for your OS works but defeats the point.
Performance: what the vendors actually publish
There is no clean head-to-head here, and it is worth saying why rather than papering over it. Netgate publishes throughput numbers for its appliances; Protectli does not publish equivalent figures on its product pages. This site does not run hardware benchmarks of its own, so the table below is Netgate’s own published data, measured under Netgate’s conditions, and it is not a comparison against Protectli.
| Netgate published throughput | Netgate 4200 | Netgate 6100 |
|---|---|---|
| L3 forwarding (iperf3 / IMIX) | 8.75 Gbps / 9.28 Gbps | 18.50 Gbps / 6.08 Gbps |
| Firewall, 10k ACLs (iperf3 / IMIX) | 8.61 Gbps / 3.21 Gbps | 9.93 Gbps / 2.73 Gbps |
| IPsec VPN, AES-GCM-128 (iperf3 / IMIX) | 3.2 Gbps / 1.05 Gbps | 1.77 Gbps / 552 Mbps |
Source: Netgate 4200 and Netgate 6100 store listings. Netgate quotes the 4200’s IPsec row with AES-NI and the 6100’s with QAT, so those two cells are not measuring the same acceleration path.
Note how far the firewall and IPsec IMIX figures fall below their iperf3 counterparts on the same box. IMIX is a mixed packet-size profile closer to real internet traffic, so it is the number to plan around; a headline iperf3 result on any vendor’s page is a best case. The 4200’s L3 row runs the other way, IMIX above iperf3, which is a useful reminder that these are vendor-run tests under vendor conditions rather than a controlled like-for-like benchmark.
With no published Protectli numbers to sit beside those, the honest comparison is silicon rather than throughput. The VP2420e’s Celeron J6412 is a four-core part at 2.0 GHz base. The Netgate 4200’s Atom C1110 is a four-core part at 2.1 GHz with AVX2. Core counts are level, so the structural gap that used to favour Protectli for multithreaded inspection such as Suricata is much narrower than it was against the two-core 4100 the 4200 replaced. What you are really choosing between is a supported software stack on the Netgate side and RAM and storage headroom on the Protectli side, since the 4200 ships a fixed 4 GB. Neither is a substitute for testing on your own link, and anyone quoting exact Mbps for these boxes without naming a published test should be read skeptically.
NIC quality and SFP+
Both vendors use Intel-grade NICs, which is non-negotiable for a serious firewall. Realtek NICs (common in cheap Chinese mini-PCs on Amazon) are not acceptable for production firewalls — they have flaky FreeBSD driver support and you will spend weekends debugging.
Only the Netgate 6100 has 10G SFP+ ports, two of them. The Netgate 4200 has no SFP cages at all: Netgate documents four RJ45 ports, every one of them 2.5 Gbps (Netgate 4200 I/O ports), so 2.5GbE copper is its ceiling. If you have a 10 Gbps WAN handoff or a 10G internal backbone, that single difference decides the model for you. The VP2420e also tops out at 2.5GbE across all four ports; on the Protectli side, 10G means stepping up to one of their higher-tier Vault models.
Build quality
Both lines are fanless, which is the relevant engineering fact: no moving part in the airflow path to seize, and no dust-clogged intake to service. Heat leaves through the chassis instead, so both vendors use metal enclosures rather than plastic. Netgate’s are the heavier and more rack-oriented of the two, with wall-mount and rack kits sold as options; Protectli’s are shaped for desk and shelf placement. Neither runs hot enough to need active cooling at these TDPs: Netgate documents roughly 13W idle draw for the 4200 (I/O ports documentation).
Value verdict
| Use case | Pick |
|---|---|
| OPNsense + 1 Gbps WAN, homelab/SMB | Protectli VP2420e: best price/performance |
| pfSense Plus + vendor support | Netgate 4200: included Plus license and TAC Lite support |
| OPNsense + 10 Gbps WAN | Protectli VP6650 (~$749), two Intel 10GbE SFP+ plus four 2.5GbE copper |
| pfSense Plus + 10 Gbps WAN | Netgate 6100: best-supported high-end option |
| Cheapest “real” appliance with Intel NICs | Protectli VP2410 ($299 list, four 1GbE Intel ports; out of stock at the vendor when checked) |
| Budget Netgate option | Netgate 1100, the cheapest in the line, but ARM-based with limited package support |
Where to buy
- Protectli: Direct from protectli.com, and also through Amazon. Protectli’s about page lists Amazon storefronts in the US, Canada, Australia, and six European markets, while noting that its own site carries the complete range. Ships with your OS preinstalled if you ask, otherwise blank.
- Netgate: Direct from netgate.com. Sometimes available on Amazon but at marked-up prices.
This site’s only affiliate relationship is Amazon Associates, and no link on this page is monetised. Other articles do link to general Amazon hardware such as mini-PCs, NIC cards and SFP+ modules; those are affiliate links and carry a disclosure at the top of the article they appear in.
Further reading
- OPNsense vs pfSense 2026 head-to-head
- Best homelab firewall in 2026
- pfSense alternatives: seven platforms compared
- Firewalla vs pfSense: appliance or DIY
- UniFi Dream Machine Pro vs pfSense: hardware and cost
- Best hardware for OPNsense on opnsenselab.com
- Celeron, N100 and i5 firewall tiers
- Firewall comparison: 8 platforms side by side
Related across the network
- i226-V Link Drops: Fix 2.5GbE Flapping on OPNsense — n100firewall.com
- Best OPNsense Appliance for Home: Protectli and Deciso — opnsenselab.com
- OPNsense Initial Setup: Complete Installation Guide (2026) — opnsenselab.com
