Netgate 3100 with pfSense® Plus Software - Network Security Firewall Appliance and VPN Router for Home Pro, Branch, Small/Medium Businesses

I selected the 3100 after considering a number of competing products from Cisco, Ubiquity, Fortnet, etc. for a SOHO small office home office application. I like the open source pfsense as opposed to proprietary software. Open source is more secure and does not have back doors and is otherwise vetted. Note that Ubiquity firewall has a phone home feature that was not announced to users and cannot be turned off. The Netgate 3100 undergoes final assembly in Texas, which I appreciate particularly from a security standpoint.After speaking with the sales rep at Netgate, I selected the 3100 instead of the 1100 because the 3100 is more powerful machine that can accommodate gigabit internet (which I do not presently have). The 1100 would probably be sufficient.You do have to have some minimal technical ability to use this - basic familiarity with computers, networks, etc but you do not need to be a total nerd. Initial set up was pretty easy. Pro tips: 1) turn off your vpn, antivirus, etc. 2)reboot your cable modem after connecting the box.The rest is pretty straight forward.After initial set up, the 3100 needs to be configured, packages uploaded, and so forth. I followed the YouTube videos from Lawrence Systems that are very detailed and well done. Kudos to them. Netgate also has instructional videos but I have not explored these in any great detail. Feel like I have secured my network.Currently running Snort and pfBlocker among other packages. Very easy install and does not tax this machine at all.Be cautioned that this device is not plug it in and forget it. It does take some time and effort to work through configurations in order to get the most out of this device. Really a whole world if one were to delve into it in a sophisticated fashion. Again, depending upon one's skills, a consultant such as a Netgate engineer may be needed to set this up particularly in more complex use cases.Learn to use the terminal interface. I managed to brick this a couple of times playing with it during set up and revived it by using the USB connector and accessing it using the terminal on my mac.FYI I use a Zyxel wireless access point. Both the Netgate 3100 and the Zyxel AP are connected to an Eaton backup power supply that, in turn, is connected to a SurgeX surge protector. You should have a backup power supply as you don't just unplug this (or just unplug the Zyxel AP).All in all the 3100 is a sophisticated machine that will handle small to medium sized offices and equivalent. An industrial/commercial class device - not some consumer grade junk. Has all sorts of capabilities for more sophisticated users and more complex use cases. Buy it. Take your time and set it up correctly and completely.I have been using this for a couple of months now and have had no issues.

[Update 11-12-19: After tuning Snort (see Snort documentation) I was able to get over 700Mb/s running Snort. WAN connection is 1Gb/s.]Original review:I am a long time user of pfSense and a network engineer for the past 40 years.Pros:* Hardware works well.* Compact package.* Very flexible switch providing lots of ports (However read the documentation carefully).* pfSense is a powerful and flexible platform.* Excellent customer support and documentation.Caveats:* The software is proprietary to Netgate. It will not run public distro of pfSense. You will need to contact support if you need a reinstall image.* The embedded eMMC flash is slow! If you are doing anything disk intensive plan to buy a M.2 SSD. If you are only using it as a basic firewall with no packages, eMMC is fine. Note: Installation of an SSD requires reinstall.* Only 2 GB RAM - only matters with certain packages.* Snort users: don't expect to get 1Gb/s throughput. Something more like 300 - 500 Mb/s is probably the limit.[Update 11-12-19: After tuning Snort (see snort documentation) I was able to get over 700Mb/s running Snort.]* Runs warm but Netgate says it's normal.Even with these caveats I rate it five stars.

I bought this device to replace my previous Netgate router when I was fortune enough to be upgraded to gigabit fiber at my home. I chose this device specifically because I believed it would be able to accommodate the 940mbit transfer speed that my phone company had promised me. The Netgate SG-3100 was capable of hitting these speeds while it was installed downstream of the Centurylink modem but when I removed the modem from the configuration and connected the Netgate SG-3100 directly to the fiber ONT, my speeds dropped to around 700mbit. This is because the pfsense implementation of PPPoE, which is required to connect with the phone company equipment, is limited by the speed of the CPU.I am disappointed that the SG-3100 is unable to give me gigabit speeds when it promises speeds even faster than that. I want to make any potential buyers who are required to use PPPoE aware of this shortcoming.That said, I am generally happy with the device. My prior router was a much older Netgate box and it only took a few minutes to bring over my configuration and swap out the routers. I would happily recommend this device to anyone who is already familiar with pfSense.

The SG-3100 runs too hot. Often would quit working. Will not run Suricata or pfblockerNG or ntoping without overheating unit to point of failure. Took out of service after 6 months of trying. Instead, Built home router from old computer & pfsense. It works very well and runs cool.Taking SG-3100 apart and seeing if heat shield can be better attached to improve cooling. Would like to use it in my test lab.

I should have built my own hardware. The 2GB limit and lack of upgrade make this router useless unless you are planning on only doing out-of-the-box tasks. For example, there are limits with pfBlockerNG, Snort, and probably Squid/SquidGuard. You can expand the swap, but you cannot expand the RAM. Regardless of the reasoning behind this decision, I'm just not happy with It. I'll definitely look for those details in the future and not assume I can upgrade as well as not buy any other netgate products.