Skip to content
SPECIFICTION
Get listed

PacketFence

packetfence.com

From $416.67/mo Free plan Open source WebWindowsmacOSLinuxiOSAndroid
Visit packetfence.com
Spec score 8.8 #1 of 24 in Network Provisioning Software

What it is

PacketFence is an enterprise network access control platform for organizations managing wired, wireless, and VPN access. It can enforce policy through SNMP or RADIUS, inline Layer 2 or Layer 3 deployment, VLAN assignment, and quarantine isolation. Authentication options include 802.1X/EAP, directory services, external RADIUS, OAuth2 social login, SAML 2.0, and PKI certificates. Guest workflows include self-registration, sponsored access, email or SMS confirmation, and CSV imports. Self-service provisioning can configure 802.1X profiles for iOS, Android, Windows, macOS, and ChromeOS. The platform checks antivirus, operating system patch level, and security-agent presence, and can quarantine devices that fail policy. Administrators get a web interface, command-line tools, REST API, customizable captive portals, and Perl extension points. The self-hosted Community Edition is GPL v2+ with unlimited devices and full source code. Its listed minimum requirements include Debian 12.x or RHEL 8.x, four CPU cores, 16 GB RAM, 200 GB disk, and a network interface. Paid plans include Starter at $5,000 /year for up to 250 registered devices.

Spec sheet

What it does
PacketFence is a network access control system for authenticating, profiling, onboarding, isolating and remediating devices on wired, wireless and VPN networks.Read 14 Oct 2026 · packetfence.com
License
The software repository identifies PacketFence as GPL-2.0 licensed open-source software.Read 14 Oct 2026 · github.com
Headquarters
Cambridge, Massachusetts, United StatesRead 28 Sep 2026 · packetfence.com
Founded
2005Read 28 Sep 2026 · packetfence.com
802.1X and EAP
The product includes FreeRADIUS-based 802.1X support with PEAP-TLS, EAP-TLS, EAP-PEAP and EAP-TTLS methods.Read 14 Oct 2026 · packetfence.com
Administration
The platform provides a web administration interface, command-line tools, a REST API, customizable captive portals, and Perl extension points.Read 1 Oct 2026 · packetfence.com
Android app purpose
The PacketFence Agent configures Android Wi-Fi profiles, including SSID, authentication method and trusted certificates, when the NAC PKI workflow is configured.Read 14 Oct 2026 · play.google.com
API and extensibility
PacketFence offers a REST API, command-line tools, customizable Template Toolkit portals and Perl extension points for authentication, VLAN logic and workflows.Read 14 Oct 2026 · packetfence.com
Authentication
Authentication includes 802.1X/EAP through FreeRADIUS, LDAP and Active Directory, external RADIUS, OAuth2 social login, SAML 2.0, and PKI certificates.Read 1 Oct 2026 · packetfence.com
Captive portal
It provides customizable captive portals for guest registration, remediation and sponsored access.Read 14 Oct 2026 · packetfence.com
Cloud architecture
PacketFence Cloud uses an on-premises connector with a secure tunnel and local RADIUS caching to continue serving cached decisions during internet loss.Read 14 Oct 2026 · packetfence.com
Cloud service
PacketFence Cloud is managed without customer infrastructure, offers a 99.99% uptime SLA, local RADIUS caching for internet outages, and usage-based pricing.Read 1 Oct 2026 · packetfence.com
Cloud SLA
The cloud offering advertises a 99.99% uptime SLA for Cloud RADIUS.Read 14 Oct 2026 · packetfence.com
Company facts
LinkedIn lists Inverse as a privately held Montreal company with 11–50 employees and a 1998 founding year.Read 14 Oct 2026 · ca.linkedin.com
Company legal history
Akamai announced acquisition of Inverse, the PacketFence developer, on February 1, 2021.Read 14 Oct 2026 · packetfence.com
Compliance controls
PacketFence checks antivirus status, OS patch level, and security-agent presence, and can quarantine devices that fail policy.Read 1 Oct 2026 · packetfence.com
Current owner facts
LinkedIn lists Akamai Technologies as a public company headquartered in Cambridge, Massachusetts with 5,001–10,000 employees.Read 14 Oct 2026 · linkedin.com
Deployment formats
Downloads include RHEL RPM packages, Debian packages and a bootable Debian-based ISO, while a ZEN virtual appliance is documented for VMware and Hyper-V.Read 14 Oct 2026 · packetfence.com
Deployment requirements
Self-hosted PacketFence lists Debian 12.x or RHEL 8.x, four CPU cores, 16 GB RAM minimum, 200 GB disk, and at least one network interface.Read 1 Oct 2026 · packetfence.com
Device onboarding
Self-service device provisioning supports iOS, Android, Windows, macOS, and ChromeOS with automatic 802.1X profile configuration.Read 1 Oct 2026 · packetfence.com
Device profiling
Fingerbank profiling classifies endpoints using DHCP fingerprints, user-agent data and network behavior.Read 14 Oct 2026 · packetfence.com
Documentation
Official documentation includes installation, upgrade, network-device configuration, clustering, developer and stable or development OpenAPI specifications.Read 14 Oct 2026 · packetfence.com
Enforcement
It supports out-of-band SNMP or RADIUS enforcement, inline Layer 2 or Layer 3 deployment, VLAN assignment, and quarantine isolation.Read 1 Oct 2026 · packetfence.com
Enterprise integrations
Listed integrations include Palo Alto, FortiGate, Check Point, Microsoft Intune, JAMF, Kandji, MobileIron, VMware Workspace ONE, Cisco, Aruba, Juniper, Meraki and Ruckus.Read 14 Oct 2026 · packetfence.com
Guest and BYOD
Guest workflows include self-registration, sponsored access, email or SMS confirmation, password-of-the-day, payment integrations, and CSV bulk import.Read 1 Oct 2026 · packetfence.com
High availability
High availability uses active/active clustering, automatic failover, Galera synchronous multi-master replication, geographic distribution, and automatic recovery.Read 1 Oct 2026 · packetfence.com
Identity integrations
Supported identity options include Active Directory, LDAP, external RADIUS, OAuth2 social login and SAML 2.0.Read 14 Oct 2026 · packetfence.com
Latest release
PacketFence 15.2.0 was released on August 25, 2026.Read 14 Oct 2026 · packetfence.com
Limit: community support
A SourceForge reviewer praised the software but asked for more community support beyond mailing lists.Read 14 Oct 2026 · sourceforge.net
Limit: early cloud maturity
An independent NAC directory describes PacketFence Cloud as early access and says the SaaS packaging launched on February 11, 2026.Read 14 Oct 2026 · networkaccesscontrol.org
Limit: operational complexity
Reddit discussion describes clustered failover as daunting and reports difficulty completing an Active Directory authentication setup.Read 14 Oct 2026 · reddit.com
Open source
The self-hosted edition is GPL v2+, has unlimited devices and full source code, and is developed and maintained by Akamai with community contributions.Read 1 Oct 2026 · packetfence.com
Posture assessment
PacketFence can check antivirus, patch and security-agent state before granting access.Read 14 Oct 2026 · packetfence.com
Praise: functionality
SourceForge reviewers repeatedly describe PacketFence as feature-rich, effective for network administration and reliable in operation.Read 14 Oct 2026 · sourceforge.net
Praise: school deployment
A Reddit user reported that PacketFence increased wireless security and convenience in a school-district deployment, while finding the documentation confusing initially.Read 14 Oct 2026 · reddit.com
Product type
PacketFence is an enterprise network access control platform that secures network access for organizations.Read 1 Oct 2026 · packetfence.com
Quarantine
Non-compliant or compromised endpoints can be moved to quarantine networks with self-service remediation instructions.Read 14 Oct 2026 · packetfence.com
Rating on Google Play
2.3 out of 5 from 14 reviewsRead 14 Oct 2026 · play.google.com
Rating on SourceForge
5.0 out of 5 from 8 reviewsRead 14 Oct 2026 · sourceforge.net
Rating on TrustRadius
0 out of 10 from 0 reviewsRead 14 Oct 2026 · trustradius.com
Security integrations
The feature set includes IDS/IPS response and vulnerability-scanner integrations such as Snort, Suricata, Nessus, OpenVAS and Rapid7.Read 14 Oct 2026 · packetfence.com
Security release
Version 15.2 removed the default admin password, added LDAP-injection protections, removed weak CBC/LUCKY13 ciphers and restricted unsafe deserialization.Read 14 Oct 2026 · packetfence.com
Self-hosted requirements
The current installation guide recommends four 3 GHz CPU cores, 16 GB RAM, 200 GB disk and one network interface, with Debian 12 or RHEL 8 on x86_64.Read 14 Oct 2026 · packetfence.org
VLAN enforcement
Policies can assign VLANs dynamically according to identity, device type, compliance state or custom logic.Read 14 Oct 2026 · packetfence.com
Vulnerability scanners
Scanner integrations include Nessus, OpenVAS, and Rapid7, with scan results able to trigger violations and device isolation.Read 1 Oct 2026 · packetfence.com

Plans and prices

Community Edition Free free forever unlimited devices · full source code · community forum support · core NAC features · self-hosted Read 14 Oct 2026 · packetfence.com
Premium Support $5,000 a year per server/year 24/7 unlimited support · one-hour urgent-response SLA · yearly upgrades · performance tuning Read 14 Oct 2026 · packetfence.com
Starter $5,000 a year annual up to 250 registered devices · 2,500 guest devices/year · business-hours support · self-service onboarding Read 14 Oct 2026 · packetfence.com
Professional $15,000 a year annual up to 1,000 registered devices · 10,000 guest devices/year · 24/7 premium support · guided onboarding Read 14 Oct 2026 · packetfence.com
Professional Deployment $20,000, paid once starting price architecture planning · production rollout assistance · legacy NAC migration · knowledge transfer Read 14 Oct 2026 · packetfence.com
Enterprise Priced on request custom pricing 10,000+ registered devices · unlimited guest devices · 24/7 elite support · white-glove onboarding Read 14 Oct 2026 · packetfence.com
Training Services Price not published Starting prices Basic $8,000 · Standard $18,000 · Advanced $30,000 · Remote delivery included Read 1 Oct 2026 · packetfence.com

Every PacketFence plan and price →

Strong points and limits

Strong points

  • Community Edition is free with unlimited devices
  • Supports 802.1X/EAP and multiple authentication methods
  • Can quarantine devices that fail policy
  • REST API and web administration interface

Limits

  • Self-hosted minimum is 16 GB RAM
  • Starter costs $5,000 /year
  • Starter is limited to 250 registered devices

Who it suits

PacketFence suits organizations that need to control network access and apply device security policies across wired, wireless, or VPN connections. The self-hosted edition is relevant to teams able to provide the listed server resources.

PacketFence in depth

Read the full write-up

PacketFence is an enterprise network access control platform for organizations that need to govern wired, wireless, and VPN access across varied devices. It suits network and security teams with complex onboarding and compliance needs. Its breadth is a strength, but the self-hosted edition carries substantial infrastructure demands.

Overview

PacketFence combines network access enforcement, authentication, device onboarding, and compliance checks in one platform. Organizations can self-host its GPL v2+ edition, with full source code and unlimited devices in the Community Edition, or choose the managed PacketFence Cloud service, which requires no customer infrastructure. The project dates to 2005 and is maintained by Akamai with community contributions.

Key features

Access and identity controls

Enforcement can run out of band through SNMP or RADIUS, or inline at Layer 2 or Layer 3. VLAN assignment and quarantine give administrators ways to apply different access policies or isolate devices. Authentication covers 802.1X/EAP through FreeRADIUS, LDAP and Active Directory, external RADIUS, OAuth2 social login, SAML 2.0, and PKI certificates. That range makes PacketFence a plausible fit for organizations with mixed network environments and existing identity systems; teams seeking a narrow, simple deployment may find the breadth harder to justify.

Guests, devices, and compliance

Guest workflows include self-registration, sponsored access, email or SMS confirmation, password-of-the-day, payment integrations, and CSV bulk import. Self-service provisioning supports iOS, Android, Windows, macOS, and ChromeOS, with automatic 802.1X profile configuration. These capabilities can reduce manual work for guest access and device enrollment, though paid tiers impose annual guest-device quotas.

Policy checks cover antivirus status, OS patch level, and security-agent presence, with quarantine for devices that fail policy. Integrations with FleetDM, osquery, SentinelOne, CrowdStrike, and Microsoft Defender bring in compliance signals; Snort and Suricata alerts can also trigger responses. Nessus, OpenVAS, and Rapid7 scan results can trigger violations and isolation. The broad integrations make PacketFence more compelling for teams coordinating access control with existing security tools than for buyers who need only basic network admission.

Administration and resilience

Administration is available through a web interface, command-line tools, a REST API, customizable captive portals, and Perl extension points. High availability includes active/active clustering, automatic failover, Galera synchronous multi-master replication, geographic distribution, and automatic recovery. These options suit organizations that need to adapt workflows and preserve service across failures, but they also point to a platform intended for capable network operations teams.

Pricing

The Community Edition is free forever, GPL licensed, self-hosted, and unlimited in devices; support is through the community forum. It is the clearest choice for organizations able to operate the software themselves and accept community support. Self-hosting requires Debian 12.x or RHEL 8.x, four CPU cores, 16 GB RAM minimum, 200 GB disk, and at least one network interface.

Starter costs $5,000 /year and includes up to 250 registered devices, 2,500 guest devices per year, business-hours support, and self-service onboarding. It fits smaller deployments that can stay within those caps, but the paid device limit is tighter than the Community Edition's unlimited-device allowance. Professional costs $15,000 /year, raises the caps to 1,000 registered devices and 10,000 guest devices per year, and adds 24/7 Premium support and guided onboarding.

Premium Support costs $5,000 per server per year and adds 24/7 unlimited support, a one-hour urgent response SLA, yearly version upgrades, and performance tuning. It is a support option rather than a device-quota tier. Enterprise has custom pricing for 10,000+ registered devices, unlimited guest devices, 24/7 Elite support with a one-hour response, and white-glove onboarding.

Professional Deployment starts at $20,000 once and covers architecture planning, production rollout assistance, legacy NAC migration, and knowledge transfer. Training Services has custom pricing, with Basic at $8,000, Standard at $18,000, and Advanced at $30,000; remote delivery is included. PacketFence Cloud uses usage-based pricing, offers a 99.99% uptime SLA, and includes local RADIUS caching for internet outages. A 30-day trial is available.

Platforms

PacketFence supports Android, iOS, Linux, macOS, Windows, web, API, and self-hosted deployment. Its device onboarding also supports ChromeOS. Hybrid deployment gives organizations a choice between operating the platform themselves and using the managed cloud service.

Who it's for

PacketFence is best suited to organizations that need centralized control across wired, wireless, and VPN access, along with guest workflows, device compliance checks, security integrations, or high availability. The Community Edition can suit teams with the infrastructure and expertise to self-host; Starter and Professional offer defined support and quotas for smaller managed deployments. Smaller teams without network administration capacity, or buyers who need minimal setup rather than extensive policy control, should look elsewhere.

Pros and cons

Pros: Broad enforcement and authentication options cover varied network types and identity systems.

Pros: Guest access, self-service onboarding, compliance checks, and security integrations extend beyond basic access control.

Pros: The GPL self-hosted Community Edition has full source code and unlimited devices.

Cons: Self-hosting requires substantial server resources and a supported Linux environment.

Cons: Starter and Professional impose registered-device and annual guest-device caps.

Cons: Paid support, deployment, and training can add significant costs alongside the core access-control offering.

Alternatives

UniFi Network is worth considering for a free network software option with a self-hosted or UniFi-hardware server choice. TP-Link Omada SDN may fit buyers who want free centralized management for up to 1,500 devices, with capacity dependent on server hardware. Portnox NAC is another NAC option with a free trial and paid plans. RUCKUS Cloudpath Enrollment System uses user-based licensing with one-, three-, or five-year subscriptions. Arista NG Firewall offers a free plan with limited basic security and connectivity features. HPE Morpheus VM Essentials Software is an alternative. SecureW2 JoinNow offers custom pricing tailored to organization requirements and device count. BlueCat Horizon is a subscription product licensed by unique active IP.

For broader browsing, see Network Access Control Software and Network Provisioning Software.

Verdict

Choose PacketFence if your organization needs flexible access enforcement, device onboarding, and policy-driven quarantine across wired, wireless, and VPN networks—and has the team to operate it or budget for a managed deployment. Its defining advantage is the combination of broad controls and an unlimited-device open-source edition; its main drawback is the operational and paid-tier cost of putting that breadth to work.

Verdict

PacketFence offers broad access-control and device-policy options, with both self-hosted and managed cloud deployment listed. Check the device limits, server requirements, and support level attached to the plan you need.

Where Specifiction places it

Alternatives to PacketFenceAll alternatives →