pfSense runs on almost anything - which is exactly why people buy the wrong things for it. What actually matters is short, and it is not a big CPU.
Vendors love selling firewall hardware with scary specifications. The truth is calmer: for a small office, pfSense hardware requirements are modest, and the money is better spent on two good network ports than on a powerful processor. This page separates the one hard requirement from the nice-to-haves, and grades the three common choices - old PC, mini PC and Netgate appliance - honestly.
A relative view, not a benchmark - ports and card quality matter more than raw power for a small office.
Everything else is negotiable; this is not. pfSense needs a WAN port facing the internet and a LAN port facing your office. A PC with one port needs a second network card added, which is cheap and easy on a desktop. Single-port mini PCs and laptops can work through a managed switch with VLANs, but that is an advanced layout - a beginner setup should have two real ports.
One honest warning about USB network adapters: many people try them for the second port, and many regret it. They can be unstable under load and may disappear after a reboot. For a learning VM they are fine; for the office firewall, use proper built-in or PCIe network cards.
Plain routing and firewalling for a small office is light work - almost any 64-bit CPU from the last decade handles it without sweating. The load grows when you add jobs: VPN traffic must be encrypted and decrypted packet by packet, and intrusion detection inspects traffic deeply. If you plan a busy VPN for remote staff, a CPU with AES-NI encryption support helps honestly and noticeably.
The firewall itself is modest: a couple of GB of RAM and a small SSD are a comfortable home for a basic install, and pfSense will run in less for a test. The exception is packages. Snort or Suricata (intrusion detection) and large blocking lists eat memory for breakfast - if those are in your future, give the box more RAM now instead of upgrading a live firewall later.
Experienced pfSense users repeat one lesson: a slightly slower PC with good Intel network chips runs more reliably than a fast PC with bargain network cards. Cheap cards are a classic source of random drops and freezes under load. If you are buying a card for the second port, buy a known Intel-based one - it is the cheapest stability you can purchase.
All three run the same firewall. Choose with your eyes open about power and support, not about fear.
The video shows pfSense inside VMware, and for learning that is the best route - free, safe, easy to delete and retry. The VM needs two virtual network adapters mapped to the two sides. Just carry the honest condition into production: the firewall is now a guest on a host, and every host reboot is an office internet outage. Dedicated hardware removes that link.
See the install itself, on real hardware and inside VMware, in the full setup video.
Watch Full VideoTechnically yes, using a VLAN-capable managed switch to split WAN and LAN over one cable (router on a stick). It works, but it is an advanced configuration and a confusing first project. For a first build, two physical ports will save you hours.
Not for basic firewall and routing work in a small office - a modest 64-bit CPU is enough. You need more power when you add heavy jobs: fast site-to-site VPN, gigabit internet with intrusion detection, or many packages at once.
You can for testing, and the built-in screen and battery are oddly convenient. As a permanent office firewall a laptop is awkward - usually one network port, heat in a closed lid, and it is the first thing borrowed for other work. A small dedicated PC is a better home.