PacketFence

Overview

PacketFence brings authentication, access enforcement, device onboarding, and compliance checks together. Organizations can run the GPL v2+ self-hosted edition or use PacketFence Cloud, a managed service that requires no customer infrastructure. The self-hosted Community Edition has unlimited devices and full source code; paid plans add device and guest quotas, support, or deployment services.

Self-hosting calls for Debian 12.x or RHEL 8.x, at least four CPU cores, 16 GB of RAM, 200 GB of disk, and one network interface. That is a meaningful operational commitment, particularly for smaller teams without network administration capacity.

Key features

Access control and authentication

Enforcement can run out of band through SNMP or RADIUS, or inline at Layer 2 or Layer 3. Administrators can assign VLANs or quarantine devices. Authentication supports 802.1X/EAP through FreeRADIUS, LDAP and Active Directory, external RADIUS, OAuth2 social login, SAML 2.0, and PKI certificates. This range makes PacketFence a strong fit for organizations combining different network types and identity sources, though configuring that breadth is likely to demand specialist ownership.

Guest access and device onboarding

Guest workflows include self-registration, sponsored access, email or SMS confirmation, password-of-the-day, payment integrations, and CSV bulk import. Self-service provisioning supports iOS, Android, Windows, macOS, and ChromeOS, with automatic 802.1X profile configuration. Together these capabilities reduce the need to handle guest and device setup entirely by hand.

Compliance and security integrations

PacketFence checks antivirus status, operating-system patch level, and security-agent presence, and can quarantine devices that fail policy. It can use compliance signals from FleetDM, osquery, SentinelOne, CrowdStrike, and Microsoft Defender, react to Snort and Suricata alerts, and use Nessus, OpenVAS, and Rapid7 scan results to trigger violations and isolation. It also lists integrations with major firewall, endpoint-management, and network vendors. That makes it more than a connection gate: organizations can tie access decisions to device posture and security signals.

Administration and resilience

A web administration interface, command-line tools, REST API, customizable captive portals, and Perl extension points give teams several ways to manage and extend the platform. High availability includes active/active clustering, automatic failover, Galera synchronous multi-master replication, geographic distribution, and automatic recovery. These are substantial capabilities for large or distributed environments, but they come with infrastructure and administration complexity.

Cloud service

PacketFence Cloud removes the need to maintain customer infrastructure, offers a 99.99% uptime SLA, and provides local RADIUS caching during internet outages. Its usage-based pricing may suit organizations that prefer managed operations, though costs will depend on usage.

Pricing

PacketFence uses a freemium model, with a 30-day trial and paid plans starting at $5,000 /year. The free Community Edition is billed Free forever and is GPL licensed; it includes unlimited devices, full source code, community forum support, and self-hosted deployment. It is the most flexible choice on device count, but organizations must operate the infrastructure themselves and do not get paid-plan support.

• Starter — $5,000 /year: Up to 250 registered devices, 2,500 guest devices/year, business-hours support, and self-service onboarding. It suits smaller deployments that can work within firm device and guest quotas.
• Premium Support — $5,000 /year per server: 24/7 unlimited support, a 1-hour urgent response SLA, yearly version upgrades, and performance tuning. This adds support and maintenance rather than a stated device allowance; the per-server billing matters when budgeting for multiple servers.
• Professional — $15,000 /year: Up to 1,000 registered devices, 10,000 guest devices/year, 24/7 Premium support, and guided onboarding. It is the clearer fit for organizations beyond Starter's limits that want support and implementation guidance.
• Professional Deployment — starting at $20,000 once: Architecture design and planning, production rollout assistance, legacy NAC migration, and knowledge transfer. This is a one-time services option for teams that need help implementing or replacing a system, not a recurring subscription.
• Training Services — custom pricing: Starting prices are Basic $8,000, Standard $18,000, and Advanced $30,000; remote delivery is included. The tiered starting costs make this a substantial separate budget item.
• Enterprise — custom pricing: For 10,000+ registered devices, it includes unlimited guest devices, 24/7 Elite support with a 1-hour response, and white-glove onboarding. It targets large deployments beyond the stated Professional allowance.

The device limit shown for the product is 250 devices, matching Starter's registered-device cap; the Community Edition is explicitly unlimited, while higher paid tiers state their own allowances. PacketFence Cloud uses usage-based pricing.

Platforms

PacketFence supports Android, iOS, Linux, macOS, Windows, web, API, and self-hosted environments. Its hybrid deployment model offers a choice between operating the platform yourself and using the managed cloud service.

Who it's for

PacketFence is best suited to organizations that need granular control across wired, wireless, and VPN access, and want to connect authentication, guest onboarding, compliance, and security signals. The unlimited-device open-source edition is particularly relevant where source access and control matter and a team can manage the infrastructure. Organizations wanting a managed service can consider PacketFence Cloud; teams with limited network expertise or modest needs may find the self-hosted requirements and configuration scope excessive.

Pros and cons

• Pros: The GPL v2+ Community Edition has unlimited devices and full source code, avoiding a device cap for teams able to self-host.
• Pros: Broad authentication, guest access, and onboarding options cover varied identities and common device platforms.
• Pros: Compliance checks, scanner integrations, and alert-driven quarantine connect network access to security posture.
• Pros: Cloud service includes a 99.99% uptime SLA and local RADIUS caching for internet outages.
• Cons: Self-hosting requires at least 16 GB RAM, four CPU cores, and 200 GB disk, before accounting for the effort of operating NAC.
• Cons: Starter limits registered devices to 250 and guest devices to 2,500 per year; growing deployments need a higher tier.
• Cons: The listed support plan is $5,000 /year per server, so support costs can rise with server count.

Alternatives

Consider SecureW2 Cloud NAC if you want to compare another paid NAC option with Android, iOS, Linux, macOS, web, and Windows platforms; its pricing is requested through a quote form.

Ivanti Neurons for Zero Trust Access is worth considering if you prefer paid named-user licensing and a SaaS option alongside self-hosted deployment.

Portnox NAC is another option if you want to assess a paid NAC product with a free trial and continuous risk assessment and remediation.

Genian NAC offers both cloud-managed and on-premises NAC options for organizations comparing deployment approaches.

Arista NG Firewall may suit readers seeking a freemium security and connectivity product rather than PacketFence's broad NAC platform.

Arbiter and NACVIEW are other freemium options to compare.

HPE Aruba Networking Fabric Composer is a paid option for readers focused on network fabric and device management.

Browse Network Access Control Software or Network Provisioning Software for more options.

Verdict

Choose PacketFence if your organization needs a highly configurable NAC platform that ties network access to identity, device posture, guest workflows, and security alerts—and has the team to run it or the budget for managed service. Its unlimited-device, full-source Community Edition is a standout for capable self-hosting teams. Look elsewhere if you need a low-maintenance setup or cannot work within the paid tiers' device and guest quotas.