Changing a gateway can disconnect everyone if NAT, VPN, or DNS behaves differently. For pfSense alternatives, build a lab that mirrors the important network segments.
- Recreate WAN, LAN, guest VLAN, DHCP, DNS, VPN, and port-forward rules.
- Test allowed and blocked flows from each segment, including IPv6 if used.
- Simulate WAN failure and reboot; verify recovery and rule persistence.
- Check logs, intrusion controls, backups, updates, and hardware support.
- Prepare a rollback configuration and a physical access plan for cutover.
Document every rule's purpose rather than translating syntax blindly. A firewall migration is complete only when both connectivity and isolation are verified.
Akousa