PacketFence

PacketFence is an enterprise network access control platform for organizations that need to govern access across wired, wireless, and VPN connections. It is best suited to IT and security teams with varied devices and compliance needs. Its breadth is a strength, but self-hosting takes meaningful infrastructure and administration capacity.

Overview

PacketFence combines authentication, network enforcement, device onboarding, and compliance controls. Organizations can run its GPL v2+ self-hosted edition or choose PacketFence Cloud, a managed service that needs no customer infrastructure. The Community Edition includes full source code and unlimited devices, making it an unusually flexible route for teams able to operate the software themselves.

That flexibility comes with a substantial baseline: self-hosting requires Debian 12.x or RHEL 8.x, four CPU cores, at least 16 GB RAM, 200 GB of disk, and a network interface. Teams without infrastructure and network administration capacity may be better served by the cloud option.

Key features

Enforcement and authentication

Policies can be enforced out of band through SNMP or RADIUS, or inline at Layer 2 or Layer 3. VLAN assignment and quarantine give administrators ways to restrict access without treating every device alike. Authentication spans 802.1X/EAP through FreeRADIUS, LDAP and Active Directory, external RADIUS, OAuth2 social login, SAML 2.0, and PKI certificates. That range suits organizations combining established identity systems with guest access; it also means the product is aimed at teams that need substantial control, not a lightweight access tool.

Guests, devices, and compliance

Guest workflows include self-registration, sponsored access, email or SMS confirmation, password-of-the-day, payment integrations, and CSV bulk import. Self-service onboarding can provision iOS, Android, Windows, macOS, and ChromeOS devices with automatic 802.1X profile configuration, reducing the manual steps involved in connecting managed devices.

PacketFence checks antivirus status, operating-system patch level, and security-agent presence, and can quarantine devices that fail policy. It can use compliance signals from FleetDM, osquery, SentinelOne, CrowdStrike, and Microsoft Defender, respond to Snort and Suricata alerts, and use Nessus, OpenVAS, or Rapid7 scan results to trigger violations and isolation. These controls are valuable where network access must reflect endpoint risk, but policy design and integrations add operational scope.

Administration and resilience

A web administration interface is complemented by command-line tools, a REST API, customizable captive portals, and Perl extension points. High availability uses active/active clustering, automatic failover, Galera synchronous multi-master replication, geographic distribution, and automatic recovery. These are meaningful capabilities for organizations that need resilient, tailored deployments, though they make PacketFence a more natural fit for experienced network teams than for small offices seeking a simple appliance.

Pricing

PacketFence uses a freemium model. Community Edition is free forever, self-hosted, GPL licensed, and has unlimited devices and full source code; it includes community forum support. It is the broadest device allowance, but organizations give up the business-hours or round-the-clock support bundled with paid options.

Starter costs $5,000 /year and covers up to 250 registered devices and 2,500 guest devices/year, with business-hours support and self-service onboarding. It fits smaller deployments that want paid support, but the device and guest caps matter. Professional costs $15,000 /year, raises those limits to 1,000 registered devices and 10,000 guest devices/year, and adds 24/7 Premium support and guided onboarding.

Premium Support costs $5,000 /server/year and provides 24/7 unlimited support, a 1-hour urgent response SLA, yearly version upgrades, and performance tuning. It is support for a deployment rather than a higher device-quota plan. Enterprise has custom pricing for 10,000+ registered devices, unlimited guest devices, 24/7 Elite support with a 1-hour response, and white-glove onboarding.

Professional Deployment starts at $20,000 once for architecture planning, production rollout assistance, legacy NAC migration, and knowledge transfer. Training Services has custom pricing, with Basic at $8,000, Standard at $18,000, and Advanced at $30,000; remote delivery is included. PacketFence Cloud uses usage-based pricing and includes a 99.99% uptime SLA and local RADIUS caching for internet outages.

Platforms

PacketFence supports Android, iOS, Linux, macOS, Windows, web, API, and self-hosted deployments. Its hybrid model accommodates self-managed infrastructure as well as managed cloud service. The product's device-limit fact is 250, while the Community Edition plan specifies unlimited devices and Starter caps registered devices at 250; buyers should distinguish the general limit from the plan-specific allowances when sizing a deployment.

Who it's for

PacketFence suits organizations that need one platform for network access policy, guest workflows, endpoint compliance, and security integrations across wired, wireless, or VPN access. The open-source edition is particularly compelling for teams that value source access and unlimited devices and can meet the system requirements. Smaller organizations with little network administration capacity, or deployments that need more than Starter's quotas with paid support, should weigh the operating burden and higher-tier pricing carefully.

Pros and cons

• Pros: Community Edition combines GPL v2+ source access with unlimited devices, giving capable teams room to operate without a device cap.
• Pros: Broad authentication, enforcement, onboarding, and compliance controls cover multiple network and endpoint needs in one platform.
• Pros: Active/active clustering, failover, replication, and geographic distribution support resilient deployments.
• Cons: Self-hosting requires at least four CPU cores, 16 GB RAM, and 200 GB disk, a significant baseline for smaller teams.
• Cons: Starter and Professional impose both registered-device and annual guest-device limits, while scaling to Enterprise brings custom pricing.
• Cons: The breadth of integrations and policy controls calls for teams able to administer complex network access requirements.

Alternatives

For a broader browse, see Network Access Control Software and Network Provisioning Software.

Arista NG Firewall is worth considering if a free plan for basic security and connectivity with limited capabilities is the priority. Arbiter and NACVIEW are freemium alternatives. SecureW2 Cloud NAC is a paid alternative with pricing requested through a quote form. Ivanti Neurons for Zero Trust Access is a paid alternative without a free plan. Portnox NAC offers a free trial but no free plan. Cloudi-Fi Cloud NAC and EasyNAC are paid alternatives.

Verdict

Choose PacketFence if your organization needs deep, flexible access enforcement and endpoint compliance controls, and has the capability to run or manage them. The strongest case is its unusually broad control set paired with an unlimited-device open-source edition. Look elsewhere if your team cannot support the infrastructure and administration burden or needs generous paid-plan quotas at a lower commitment.