pfSense is the firewall we install when a site needs proper rules, a VPN, and a box we can log into without a licence surprise. ECOMX deploys and looks after them for offices and hospitality sites. The brand on the website is written PFsense in a few older lines. It is the same product.
The failure mode we see is not 'no firewall'. It is a rulebase that grew one emergency at a time. Any-any rules left in after a vendor visit. A VPN that worked until the fibre session dropped and nobody noticed the tunnel stayed down. We clean that up.
Separate networks for staff, guests, cameras, tills and servers. Guest Wi-Fi does not share a flat LAN with the server.
VPN for the people who need it, not a tunnel that the whole internet can poke.
Logs that answer 'what happened at 14:10' without a three-hour export.
The failure mode we see is not 'no firewall'.
If we add a rule, the next person can see why.
A firewall that boots slower than the fibre ONT, or that does not reconnect the VPN on its own, looks like 'the internet is down' until someone walks to the rack. We pull the plug on purpose, on a quiet afternoon.
UniFi is excellent for the Wi-Fi and the switching when the design is done properly. It is not always the right place for the security policy of a multi-building site. Plenty of our networks are UniFi at the edge and pfSense at the gate. The VLAN numbers have to match. If they do not, the pretty controller screen is lying.
It is the firewall we know best and install most. If you already have something else that is supported and tidy, we will not swap it for sport.
Yes. We would rather give staff a VPN than expose remote desktop to the internet. The accounts and the offboarding have to be part of it.
Sometimes. Sometimes the UniFi gateway stays for a simple site and pfSense goes in where the policy is more serious. We say which after we see the site.
On a managed agreement, yes. A firewall nobody looks at becomes a rule dump. Monitoring and a human are different things, and you want both.