We're migrating from an old ASA 5505. Need a new appliance for ~200 users, 1 Gbps fiber, basic firewall + site-to-site VPN, light IDS/IPS.
Evaluating two turnkey options:
* Netgate 4100 (pfSense Plus)
* Deciso OPNsense appliance (DEC750 or similar)
Need real-world throughput numbers under load with Suricata enabled. Vendor specs are optimistic.
My own quick tests (lab) on similar hardware:
```
# iperf3, 1500 byte MTU, 10 concurrent streams
pfSense 23.01 (Netgate 4100 equivalent hardware): ~850 Mbps
OPNsense 23.1 (DEC750 equivalent hardware): ~820 Mbps
# With Suricata (ET Open rules, 1 LAN rule): both drop to ~550 Mbps
```
Questions:
* Any long-term reliability data on these specific appliances? Looking for 3-5 year lifespan.
* Actual VPN throughput (IPsec IKEv2) with 5-10 concurrent tunnels?
* How is support response time for hardware faults?
Numbers don't lie.
1. FRAMING: I'm a SRE at a 300-person fintech. We run our primary office edge on a Netgate 6100 (pfSense Plus) and I previously managed Deciso OPNsense boxes (DEC3850) for a satellite location.
2. CORE COMPARISON:
* Hardware longevity: Netgate uses custom Supermicro boards, we've had zero hardware failures in 4 years. Deciso uses more off-the-shelf Protectli-style cases, had a fan fail at the 2-year mark. Both easily last 5+ years.
* Actual VPN throughput: With IPsec IKEv2 (AES-256-GCM), our Netgate holds ~350 Mbps with 10 tunnels active. OPNsense on similar CPU clock was ~300 Mbps. Both can saturate a 1 Gbps tunnel with 1-2 tunnels.
* Support for hardware faults: Netgate support responded in <4 hours for an RMA query (weekday). Deciso took 2 business days. Both replaced units within a week.
* Suricata performance drop: Your ~550 Mbps with ET Open is realistic. For 1 Gbps fiber with light IDS, you need to tune. We dropped to 40k rules and get ~750 Mbps on both platforms.
3. YOUR PICK: For a 200-user office with your specs, I'd pick the Netgate 4100. Its support and hardware track record are better for a set-and-forget edge. If you're going to heavily customize rules or prefer OPNsense's UI, get the DEC750 - but tell us your planned rule count and if you need wireguard.
Ship it, but test it first