SG-3100 Security Gateway Appliance with pfSense Plus Software

[Update 11-12-19: After tuning Snort (see Snort documentation) I was able to get over 700Mb/s running Snort. WAN connection is 1Gb/s.]Original review:I am a long time user of pfSense and a network engineer for the past 40 years.Pros:* Hardware works well.* Compact package.* Very flexible switch providing lots of ports (However read the documentation carefully).* pfSense is a powerful and flexible platform.* Excellent customer support and documentation.Caveats:* The software is proprietary to Netgate. It will not run public distro of pfSense. You will need to contact support if you need a reinstall image.* The embedded eMMC flash is slow! If you are doing anything disk intensive plan to buy a M.2 SSD. If you are only using it as a basic firewall with no packages, eMMC is fine. Note: Installation of an SSD requires reinstall.* Only 2 GB RAM - only matters with certain packages.* Snort users: don't expect to get 1Gb/s throughput. Something more like 300 - 500 Mb/s is probably the limit.[Update 11-12-19: After tuning Snort (see snort documentation) I was able to get over 700Mb/s running Snort.]* Runs warm but Netgate says it's normal.Even with these caveats I rate it five stars.

I have been using dd-wrt on mainstream routers for years because of the stability and advanced features. But recently became concerned with security exploits. I found pfSense and the Netgate devices and decided to move over to an SG-3100. Active updates and Gigibit throughput (for VLAN routing) was a primary motivation. This device works great. pfsense is easy to manage and has plenty of internet resources for configuration.The 4 port switch, in the SG-3100, is a managed switch and does support VLAN tagging.The only bug I have found so far is firewall aliases with fqdn don't always resolve and sometimes those rules are just not functional. The solution is to only use IP addresses in firewall aliases. There has been an update since I have noticed this issue so hopefully (maybe) it have been resolved.

I bought this device to replace my previous Netgate router when I was fortune enough to be upgraded to gigabit fiber at my home. I chose this device specifically because I believed it would be able to accommodate the 940mbit transfer speed that my phone company had promised me. The Netgate SG-3100 was capable of hitting these speeds while it was installed downstream of the Centurylink modem but when I removed the modem from the configuration and connected the Netgate SG-3100 directly to the fiber ONT, my speeds dropped to around 700mbit. This is because the pfsense implementation of PPPoE, which is required to connect with the phone company equipment, is limited by the speed of the CPU.I am disappointed that the SG-3100 is unable to give me gigabit speeds when it promises speeds even faster than that. I want to make any potential buyers who are required to use PPPoE aware of this shortcoming.That said, I am generally happy with the device. My prior router was a much older Netgate box and it only took a few minutes to bring over my configuration and swap out the routers. I would happily recommend this device to anyone who is already familiar with pfSense.

The SG-3100 runs too hot. Often would quit working. Will not run Suricata or pfblockerNG or ntoping without overheating unit to point of failure. Took out of service after 6 months of trying. Instead, Built home router from old computer & pfsense. It works very well and runs cool.Taking SG-3100 apart and seeing if heat shield can be better attached to improve cooling. Would like to use it in my test lab.

I should have built my own hardware. The 2GB limit and lack of upgrade make this router useless unless you are planning on only doing out-of-the-box tasks. For example, there are limits with pfBlockerNG, Snort, and probably Squid/SquidGuard. You can expand the swap, but you cannot expand the RAM. Regardless of the reasoning behind this decision, I'm just not happy with It. I'll definitely look for those details in the future and not assume I can upgrade as well as not buy any other netgate products.