The 9 Best Hardware Firewalls

For most homes and small offices, the TP-Link Omada ER707-M2 does the work of a real firewall for the price of a decent router. It filters traffic, blocks known attacks by matching them to a signature list, and keeps up with internet plans faster than a gigabit through its two quick ports. TP-Link backs it with a five-year warranty. The catch is setup: attack blocking and the deeper controls live in TP-Link's free Omada management software, which takes some learning.

Families who want parental controls and attack alerts on a phone get both from the Firewalla Purple SE, with no monthly fee. It sits in place of the router or beside it, watches every device from TVs to cameras, and can pause the kids' internet at bedtime. Setup happens in an app. Its scanning tops out around 500 megabits a second, so fast fiber plans outrun it, and it has no Wi-Fi of its own.

Anyone curious about how networks work can learn on the Netgate 1100, a small, silent box that runs pfSense Plus, the paid edition of a widely used open-source firewall. Netgate includes software updates for the life of the device, plus basic help from its support team. pfSense can do nearly anything a business firewall does, but its menus assume some networking know-how. Expect speeds to fall well below a gigabit once you pile on rules and add-ons.

Small offices that need a business-grade security box, and sometimes proof of one for an insurer or auditor, often start with the FortiGate 40F. A dedicated security chip lets it scan traffic for attacks at close to gigabit speed. This box comes without the yearly security subscription, though, and virus scanning, web filtering and attack blocking stay switched off until you buy one. Fortinet gear is a frequent target for attackers, so install updates as soon as they arrive.

The TP-Link ER605 is the low-cost way to put a business-style router in front of a home network. It can split the house into separate zones, block whole countries or websites, and connect to as many as three internet lines so one can back up another. It has been around for years and has a big following. It doesn't hunt for attacks the way a true security box does, and its VPN speeds are slow.

Remote workers who want a private tunnel back home, or a safe link out of a hotel, are the audience for the GL.iNet Brume 3. It runs OpenWrt, a free router system with thousands of add-ons, and the maker says its encrypted tunnels top a gigabit. Three fast ports let it juggle two internet lines at once. Its own security rules are basic, and it's a new model with a short track record.

Homes and offices on multi-gig fiber can keep pfSense Plus running at full speed with the Netgate 4200 MAX. Netgate's own tests show it filtering several gigabits a second, and each of its four ports handles links faster than a gigabit. It has no fan, and it carries the same lifetime software updates and basic support as smaller Netgate boxes. It's expensive, and most households on a gigabit plan or slower will never use its headroom.

A small office that wants a managed firewall without a big bill can look at the Zyxel USG FLEX 50H. It comes with a year of basic protection that screens out known bad sites and addresses, and Zyxel's cloud dashboard runs it from a browser. Full virus scanning, web filtering and attack blocking need a pricier yearly pack. It's a new model, so there's little owner history to judge it by yet.

Offices that have outgrown a handful of wired ports can step up to the FortiGate 60F. It adds a second internet connection for backup, a walled-off port for servers the public can reach, such as a mail server, and plenty of ports for desks and printers. Like other FortiGates sold this way, it ships without the security subscription, and those services stay off until one is bought. Plan on keeping its firmware current.