TNSR

TNSR is a high-throughput Linux software router and VPN concentrator for organizations running demanding network infrastructure. It fits businesses, ISPs, hosting and managed-service providers that need advanced routing with programmable operations. The trade-off is that its security role is narrower than a full firewall appliance.

Overview

Netgate positions TNSR for routing and VPN workloads from 1 Gbps to 1000 Gbps and beyond, using Vector Packet Processing on commercial off-the-shelf hardware. It can run self-hosted on Linux, in hybrid deployments, through AWS or Azure marketplaces on Intel and ARM64 instances, and on Netgate 6100, 8200 and 8300 appliances. That range gives infrastructure teams freedom to match deployment to hardware, cloud or appliance requirements.

The product is built around network transport rather than an all-in-one security gateway. Netgate explicitly says its firewall capabilities are limited compared with what customers may expect from pfSense Plus. Choose TNSR when routing scale, VPN concentration and automation matter most; do not make it the default choice for a perimeter appliance whose primary job is broad firewall protection.

Key features

Routing and traffic control

TNSR supports BGP, OSPF, static and dynamic routing, policy-based routing, carrier-grade NAT and equal-cost multipath. These options suit multi-path, provider and large-site designs where route selection and failover need more control than simple static routing. Advanced outbound control and rules in both directions let administrators shape traffic policies across the network.

Vector Packet Processing is the foundation for the stated 1-to-1000-Gbps-plus scale. That headline is most relevant to teams able to provide suitable hardware and tune the deployment for their workload; it should not be read as a guaranteed throughput level for every installation.

VPN and administration

Routed site-to-site IPsec and WireGuard support covers common inter-site connectivity patterns, with both IKEv1 and IKEv2 available for IPsec deployments. TNSR also includes access-control lists, packet filtering, password- or key-based authentication, RADIUS and role-based access control. Intrusion prevention is supported, but the product’s overall security posture remains network-focused rather than firewall-centric.

Operations teams can use the CLI, RESTCONF API or NETCONF. SNMP monitoring and a Prometheus exporter expose dataplane statistics, making the platform a better fit for organizations that already automate configuration and feed infrastructure metrics into monitoring systems. Netgate says subscriptions include 24x7 TAC support, with access to support veterans, professional services and training. It also provides a vulnerability-reporting process and security advisories.

Pricing

TNSR AWS/Azure proof of concept

This plan costs free and covers TNSR software costs for up to 30 days. Cloud-provider charges are separate, so it is useful for a time-limited evaluation but is not a zero-cost production deployment.

TNSR software

The production software plan uses custom pricing, billed per instance annually, and includes 24x7 TAC Pro Support. No bandwidth, feature, traffic-type or connection limits are stated. Organizations should request a quote that matches their instance count and deployment model, then budget for any underlying appliance or cloud consumption.

There is no free plan. The proof of concept is the practical entry point for validating routing and VPN architecture, while the annual per-instance subscription is aimed at teams that need supported production operation.

Platforms

TNSR supports Linux, API-based administration and self-hosted operation. AWS and Azure marketplace availability adds cloud deployment, including Intel and ARM64 options. Netgate’s 6100, 8200 and 8300 appliances provide a hardware path for teams that prefer an integrated platform.

Who it's for

TNSR is suited to businesses with demanding inter-site routing, ISPs, internet telephone providers, hosting companies, managed service providers and SaaS operators. It is particularly compelling where BGP or OSPF, carrier-grade NAT, equal-cost paths, site-to-site VPNs and infrastructure-as-code management are central requirements.

It is a poor fit for a small office seeking a conventional, broadly featured firewall appliance, or for buyers who want transparent fixed pricing without a sales process. Teams that depend on pfSense Plus-style firewall breadth should evaluate that requirement before selecting TNSR.

Pros and cons

Pros

• High stated throughput ceiling: Vector Packet Processing is designed for 1 to 1000 Gbps and beyond on suitable commodity hardware.
• Deep routing coverage: BGP, OSPF, policy routing, carrier-grade NAT and equal-cost multipath address complex network topologies.
• Automation-ready operations: CLI, RESTCONF, NETCONF, SNMP and Prometheus integration fit managed infrastructure environments.
• Flexible deployment: Linux, self-hosted, AWS, Azure and Netgate appliances cover cloud and on-premises choices.
• Supported production use: Annual software subscriptions include 24x7 TAC Pro Support.

Cons

• Not a full firewall replacement: Netgate warns that expected pfSense Plus firewall features may be absent.
• Custom production pricing: Buyers must request a quote, and cloud provider charges remain additional.
• Hardware-dependent performance: The 1-to-1000-Gbps-plus design range depends on the selected hardware and workload.

Alternatives

Choose NethSecurity instead if you want a freemium, 100% open-source Linux/self-hosted firewall with web management.

pfSense is the stronger alternative when a free community edition or a more firewall-centered software option is the priority.

Pick Arista NG Firewall for a web-based freemium firewall, including a free tier with basic security and connectivity features.

Endian Firewall Community suits buyers wanting a free open-source Linux firewall without professional support.

Choose IPFire for a free, open-source firewall operating system with no licence renewals.

OPNsense offers free and paid editions for self-hosted, API-capable firewall deployments.

OpenWrt is the fit for free Linux-based networking with no subscription or licensing fees.

Oracle Cloud Infrastructure Secret Management addresses cloud secret storage rather than routing or VPN concentration.

For a broader category comparison, see Network Firewall Software.

Verdict

Choose TNSR if you operate a business or service-provider network that needs high-speed routing, site-to-site VPNs and API-driven management with enterprise support. Its main advantage is the combination of advanced routing and a throughput-oriented architecture across cloud, appliance and self-hosted deployments. Look elsewhere if comprehensive firewall functionality or predictable published pricing is the deciding requirement.