Top picks by use case
| Use case | Recommended | Why |
|---|---|---|
| Small office, hands-off, vendor support | Fortinet FortiGate or Meraki MX | Subscription + 24/7 support; well-known |
| Small business, technical staff | OPNsense or pfSense Plus | Hardware-only cost; full features |
| Multi-site retail / branch | Meraki MX or Fortinet FortiGate | SD-WAN, cloud-managed multi-site |
| Compliance-driven (PCI, HIPAA, etc.) | Fortinet, Palo Alto, or Cisco | Vendor accreditations + documentation |
| Prosumer / home-office | Ubiquiti UDM or OPNsense on mini PC | Right-sized; affordable |
| Maximum threat-prevention budget | Palo Alto PA-series | Industry-leading ML threat detection |
The main contenders
The most-deployed SMB firewall family worldwide. Strong UTM (IPS, AV, web filtering, sandboxing), SD-WAN, mature centralized management (FortiManager). Subscriptions for security services are required to get the value, but pricing is competitive vs Palo Alto. Hardware acceleration on dedicated SoCs delivers excellent throughput per dollar.
Best for: SMBs and mid-market wanting a single-vendor security platform with strong threat prevention.
Mature SD-WAN, polished cloud dashboard, excellent for organizations with many small sites. License-required (annual). Hardware is more expensive than competitors. The "easy button" of the SMB firewall world — at a price.
Best for: distributed SMBs (retail, hospitality, branch offices) wanting one pane of glass and no on-site network engineer.
Full-featured firewall on FreeBSD, runs on any hardware (off-the-shelf mini PC or vendor appliance from Netgate, Deciso, Protectli). No license cost. IDS/IPS via Suricata, VPN via WireGuard and OpenVPN, captive portal, HA pair, all included. Trade-off: you maintain it.
Best for: small businesses with technical staff, prosumers, and budget-conscious deployments.
Industry-leading threat prevention with ML-based detection (App-ID, Threat Prevention, WildFire sandboxing). Most expensive in this list and most complex to operate. Right for organizations where compromise risk is the dominant cost.
Best for: compliance-heavy SMBs and mid-market where best-in-class threat prevention matters more than price.
All-in-one gateway with full UniFi ecosystem integration. Built-in IDS/IPS (no subscription). Excellent UI. Suits offices up to ~50 users. Not as deep on UTM features as commercial firewalls; not officially positioned as a security appliance, but works very well for small offices.
Best for: prosumer offices, small businesses already in the UniFi ecosystem.
What actually matters
- Throughput with security services enabled. Vendors quote "firewall throughput" (high) and "threat-prevention throughput" (much lower). The number that matters is the latter — what you actually get with IPS, AV, and SSL inspection turned on.
- Subscription model. Almost all commercial vendors require annual security-service subscriptions to keep signature databases current. Plan for the recurring cost; it often exceeds the hardware cost over 5 years.
- SD-WAN and multi-site. Critical for distributed organizations; nice-to-have for single-site. Meraki and Fortinet are strongest here.
- SSL/TLS inspection. Required to inspect modern encrypted traffic. CPU-intensive. Verify your firewall can do it at your link speed before assuming yes.
- VPN throughput. Site-to-site VPN performance varies widely by vendor and protocol. Test with your actual traffic patterns.
- Vendor lock-in. Commercial vendors lock you to their licensing, hardware refresh cycles, and feature roadmap. Open-source frees you from that but requires expertise to operate.
What doesn't matter as much
- "Next-gen" buzzwords: every vendor calls their product "next-generation." Look at actual feature lists and benchmarks.
- Wi-Fi built-in (consumer firewalls): a business firewall should be a firewall; deploy proper APs separately.
- Maximum claimed firewall throughput: rarely the bottleneck in practice; threat-prevention throughput is the real number.
Open-source vs commercial — when each makes sense
Pick open-source (OPNsense / pfSense) when:
- You or your team can confidently administer Linux/FreeBSD networking.
- You're cost-sensitive and the security feature set in open-source is enough.
- You value vendor independence and avoiding subscription lock-in.
- The business doesn't have specific compliance requirements that demand a named vendor.
Pick commercial (Fortinet, Palo Alto, Meraki, SonicWall) when:
- You need 24/7 vendor support with SLAs.
- You need centralized multi-site management out of the box.
- Compliance frameworks expect a "named vendor" with certifications.
- The team's time is more valuable than the recurring license cost.
Sizing your firewall
Three numbers determine sizing:
- Internet link speed (1 Gbps fiber means you need a firewall that does 1 Gbps with security services on).
- Number of concurrent users (translates to concurrent sessions).
- VPN load (number and bandwidth of site-to-site or client VPN connections).
Vendor sizing guides exist for each line. Undersizing means dropped packets and broken security inspection; oversizing wastes money. For SMBs the sweet spot is usually the second or third SKU up from entry-level.
Frequently Asked Questions
Do small businesses really need an enterprise firewall?
For any business with regulatory obligations (PCI, HIPAA, financial-services), yes. For others, a properly configured open-source firewall covers the security basics. The question is mostly about who you want to call when something breaks.
Is the subscription model worth it?
For commercial firewalls, the subscription is essentially required — without it, you don't get current threat intelligence and the firewall degrades to basic packet filtering. Budget for the subscription as part of the firewall, not as an optional add-on.
Can I use a consumer router as a business firewall?
Avoid. Consumer routers don't get the patching cadence, lack auditable security inspection, have weaker enterprise features (VLANs, IDS/IPS, VPN scale), and are not built for business uptime requirements.
What about WatchGuard, SonicWall, Check Point?
WatchGuard and SonicWall are solid mid-market firewalls. Check Point is enterprise-grade. All three have their place; for new SMB deployments Fortinet and Palo Alto more commonly come up first.
How long do business firewalls last?
Commercial appliances typically have 5-7 year useful lives before they're out of vendor support and need replacement. Open-source firewalls on commodity hardware can last as long as the hardware does.
Should I run a UTM on the firewall or use separate tools?
For SMB, an all-in-one UTM (firewall + IPS + AV + web filtering) is usually more cost-effective and easier to manage than separate boxes for each function. At enterprise scale, separate best-of-breed tools may make more sense.