By Zoha Ahmed · Nov 1, 2026
Ask r/sysadmin which firewall to buy and the thread turns into an argument. We read all 757 replies in 98 of those threads from the past year, mostly r/sysadmin and r/msp, counted one vote per person, and removed vendors posting about their own products.
The headline result is not who won but who lost: SonicWall drew three recommendations and forty-seven complaints. Every quote below links back to the comment it came from.
The ranking
| Tool | Recommend | Complain | Threads | |
|---|---|---|---|---|
| 1 | 73 | 54 | 27 | |
| 2 | 58 | 19 | 14 | |
| 3 | 43 | 5 | 22 | |
| 4 | 34 | 2 | 18 | |
| 5 | 31 | 0 | 36 | |
| 6 | 27 | 14 | 18 | |
| 7 | 26 | 10 | 11 | |
| 8 | 24 | 12 | 12 | |
| 9 | 20 | 11 | 15 | |
| 10 | 17 | 4 | 14 | |
| 11 | 17 | 22 | 11 | |
| 12 | 13 | 7 | 7 | |
| 13 | 8 | 0 | 11 | |
| 14 | 7 | 0 | 6 | |
| 15 | 7 | 0 | 9 |
"Recommend" and "Complain" count different people, not comments. Also mentioned, with too few opinions to rank: Juniper, MikroTik, Stormshield, Firewalla, Barracuda CloudGen and Perimeter 81.
1. Fortinet (FortiGate)
Fortinet (FortiGate)
Most used, most argued about
The most recommended firewall and also the second most complained about. Reddit argues about it constantly.
Why people recommend it
- Widely seen as a big step up from SonicWall
- Strong feature set for the price, with good partner margins
- Fleets of hundreds of sites run on it for years
Common complaints
- A steady stream of vulnerabilities, including exploited ones
- Firmware releases that introduce new bugs
- Slow or defensive disclosure, which several admins called out
What Redditors said
Fortigate is way ahead of Sonicwall.
All of our weird issues stopped.
A Fortigate firewall was compromised by a C2 that was successful implemented inside the FortiOs
Its about actual in the wild exploits affecting customers.
2. Ubiquiti UniFi
Ubiquiti UniFi
Best for small sites
Loved for small and mid-size sites, distrusted as a production firewall.
Why people recommend it
- No licensing, which makes the running cost obvious
- Teams run 80 to 120 sites on it without drama
- Simple enough to hand over to a non-specialist
Common complaints
- Several admins refuse to use it as a production firewall
- Support is slow and aimed at prosumers
- Hardware failures and lost configuration come up
What Redditors said
UniFi has been great.
Everyone is super happy.
I wouldn't use it in production.
their support has historically left a lot to be desired
3. Palo Alto Networks
Palo Alto Networks
Best if budget allows
The quality pick, recommended whenever budget is not the deciding factor.
Why people recommend it
- Generally treated as the best product in the category
- Strong application and category blocking
- Prisma covers SASE and SD-WAN for distributed teams
Common complaints
- Expensive, with licensing people find hard to justify
- Support can be slow to act on logs
- Its GlobalProtect VPN compares badly with newer tools
What Redditors said
If budget allows, Palo Alto
I like the block category on Palo Alto.
it still took me over a week to just get them to look over the logs
4. Cato Networks
Cato Networks
Best SASE
The SASE platform that wins most of the evaluations people describe, with very few complaints.
Why people recommend it
- Wins head-to-head client evaluations against bigger names
- One console for SD-WAN, security and remote access
- Years of zero-trust access with no complaints from remote staff
Common complaints
- MSPs report it can be difficult to work with as a partner
- The pricing model pushes some buyers to look elsewhere
What Redditors said
Cato wins most often.
Cato's AI inspection shows exactly what's being pasted into prompts
At least on the MSP side I can say they can be difficult to work with.
5. Tailscale
Tailscale
Best remote access
Named in more threads than almost anything else here, with zero complaints in our sample.
Why people recommend it
- The default answer for remote access instead of an SSL VPN
- Works for RDP, homelabs and company networks alike
- Identity-based access that ties into existing SSO
Common complaints
- None in our sample
What Redditors said
+1 for Wireguard, Tailscale
We use RDP over a TailScale VPN.
6. Zscaler
Zscaler
The enterprise default
The safe enterprise choice, and the one people complain about once they run it.
Why people recommend it
- The pick when a project has to move fast and defensibly
- Works well with a SIEM and a team to tune it
- TLS inspection that users cannot switch off
Common complaints
- Painful day-to-day management
- Traffic routing problems that slow users down
- Pushy sales and confusing licensing, and no quotes for small companies
What Redditors said
Today that can be said for Zscaler.
if you absolutely must rush this zscaler is good.
Don't fall into the trap of Zscaler.
very easy to slip into a topology where clients are hairpinning through
7. Sophos (XGS)
Sophos (XGS)
Best for MSPs
An MSP favourite that people say has improved a lot, with a buggy history they still remember.
Why people recommend it
- XGS has improved substantially over the last few years
- Good pricing and margins for MSPs
- Works well alongside the Sophos endpoint product
Common complaints
- A history of buggy firmware and reboots
- Clunky web interface and slow logs on entry-level hardware
- Weaker routing and SD-WAN than rivals
What Redditors said
I'd also check out Sophos XGS
Sophos XGS. Was the only thing I used in my MSP
idk what sophos is like now, but fuck they sucked for years.
buggy code from my experience
8. Cisco Meraki
Cisco Meraki
Easiest to manage at scale
The easiest to manage at scale, and the easiest to resent at renewal.
Why people recommend it
- Extremely stable, with fast support
- Simple to manage across many sites
- Straightforward VPN setup for remote offices
Common complaints
- Mandatory term licensing that several called a deal breaker
- Expensive, especially when resold through an ISP
- Throughput limits that surprise people
What Redditors said
Extremely capable, stable and good for managing at scale.
Never had an issue with a Meraki site since 2017.
We were a Cisco/Meraki shop for years and the switch to Unifi has made us more money and made it easier to manage everything.
billing you triple what licensing would cost
9. pfSense
pfSense
Best on a tight budget
The budget answer, with a trust problem among long-time users.
Why people recommend it
- Cheap, and it runs on hardware you already have
- Fine for small offices and simple VPN needs
- Netgate appliances add support if you want it
Common complaints
- Users distrust the company after the WireGuard episode
- Drifting away from open source, according to several
- A poor fit for regulated environments and deep inspection
What Redditors said
If budget is tight, go with PFsense.
their attitude to customers and especially software quality
Pfsense has gone further and further from open source.
10. Netskope
Netskope
Best for data controls
The data-control pick, praised by the admins who run it.
Why people recommend it
- Strong data loss prevention and browser controls
- Proxy-based design that a single admin can run
- Teams report replacing a VPN with it successfully
Common complaints
- Pricing compares badly with Cato for some buyers
- Tuning overhead is heavy
- Will not quote small companies
What Redditors said
Netskope is also fantastic.
we went with Netskope and been using it for about a year and a half.
I had issues getting zScaler or Netskope to quote for me
11. Check Point
Check Point
Best central management
The most polarised firewall here. People either run it for decades or refuse it outright.
Why people recommend it
- The best central management console in the category
- Very few vulnerabilities compared with rivals
- Long-term users report rock-solid operation and fast patching
Common complaints
- Expensive and complicated to get started with
- Support quality and product knowledge come up repeatedly
- Several admins dismiss it outright without elaborating
What Redditors said
SmartConsole makes policy management pretty straightforward once you're familiar with it
Their UTM stuff just works
Checkpoint for the garbage bin.
Checkpoint sucks, so just scratch them off your list immediately.
12. WatchGuard
WatchGuard
Best small-business support
A small-business favourite, known for support rather than features.
Why people recommend it
- Support that long-time customers rate highly
- Easy interface and flexible for small sites
- Reasonable feature set for the price
Common complaints
- Falling behind FortiGate on capability
- Repeated security incidents, including VPN vulnerabilities
- Some teams needed frequent support calls
What Redditors said
I would go WatchGuard
Another watchguard Fanboy here
WatchGuard firewalls are so far behind FortiGate.
Lightning does strike twice as recently shown by WatchGuard
13. Cloudflare Zero Trust
Cloudflare Zero Trust
Best free tier
The free tier people reach for to replace exposed RDP and VPNs. No complaints in our sample.
Why people recommend it
- Free for up to 50 users
- Tunnels remove the need to expose anything publicly
- Clients move onto it without new hardware
Common complaints
- None in our sample
What Redditors said
Cloudflare Zero Trust has a free tier up to 50 users
Cloudflare One is pretty good.
14. OPNsense
OPNsense
The pfSense people switched to
Where the unhappy pfSense users went. No complaints in our sample.
Why people recommend it
- Users say they are happier with it than with pfSense
- Easier to get community help
- Genuinely open source
Common complaints
- None in our sample
What Redditors said
I'd consider Opnsense instead of PFSense.
your ability to get help if something does go awry is much higher with OpnSense
15. Twingate
Twingate
Best simple zero trust
The simple zero-trust access tool people pair with or prefer to Tailscale. No complaints in our sample.
Why people recommend it
- Quick to set up and expand
- Identity-based access with existing SSO
- A straight replacement for an SSL VPN
Common complaints
- None in our sample
What Redditors said
ZTNA - Twingate.
I highly recommend TwinGate.
The one Reddit warns about
No tool in any of our rankings has a worse ratio. SonicWall still appears in buying threads, almost always as the thing someone is replacing.
SonicWall
SonicWall
The one Reddit warns about
The most one-sided result in our data. Three people recommended it; forty-seven complained.
Why people recommend it
- A handful of long-time users say it has been fine for them
Common complaints
- A breach that exposed customer cloud backup configuration
- A steady stream of vulnerabilities
- Support quality, including an abruptly cancelled product line
- Repeatedly named as the thing people replaced with FortiGate
What Redditors said
Everyone seems to hate them but for our ~100 person company, it has been fine.
Fortigate is way ahead of Sonicwall.
Sonicwall getting owned and leaking all their customers cloud backup configs was pretty bad
How we built this ranking
We pulled every Reddit thread from the past 12 months in IT and security subreddits, then kept the threads about firewalls, VPNs, zero trust and SASE. An AI model read each comment that named a product and labelled it as a recommendation, a complaint or a neutral mention, and we checked that every quote appears word for word in the original comment. Mentions of the same vendors' other products, such as endpoint or email security, were removed. We refresh the data regularly.
Sell network security?
Your buyers are in these threads right now, arguing about which firewall to replace. We run Reddit ads that put your brand in front of them.
See how Reddit ads work for SaaSNetwork security FAQ
What is the best firewall according to Reddit?
Fortinet was recommended by the most people (73), but it also drew 54 complaints, mostly about vulnerabilities. Palo Alto had a far better ratio (43 recommendations against 5) and is the pick whenever budget allows.
Why does Reddit warn about SonicWall?
In our sample only 3 people recommended SonicWall against 47 complaints, the worst ratio of any tool we ranked. The complaints centre on a breach that exposed customer backup configuration, repeated vulnerabilities and support quality.
Is UniFi good enough to use as a business firewall?
Opinions split. 58 people recommended it, often running dozens of sites on it, while others refuse to use it as a production firewall and point at support and hardware reliability. The pattern is that small and simple sites are happy, regulated or complex ones are not.
What are people using instead of a VPN?
Tailscale, by a distance. It was named in 36 threads with 31 recommendations and no complaints at all. Twingate and Cloudflare Zero Trust came up as the other replacements for an SSL VPN.