The package list is a sweet shop window. Some of it is genuinely useful, some of it will eat your RAM and your weekend. Here is the honest shortlist.
Packages are how a good firewall becomes a tailored one - and how a stable firewall becomes a science project. This page gives the order that works for a small office: pfBlockerNG first for list-based blocking, intrusion detection later when you have time to tune it, and a clear-eyed skip for the rest, with the simple tests to judge any package yourself.
A summary verdict, not a benchmark - your office needs decide the final list.
The package system is pfSense's superpower: extra abilities installed from System - Package Manager. It is also the easiest way to destabilise a healthy firewall. Work like a professional: one package at a time, a configuration backup before each install, and a few days of watching before adding the next. A firewall with nine half-configured packages is worse than a firewall with none.
If you install one package, make it pfBlockerNG. It blocks by lists: known malicious and advertising domains at the DNS level, and known bad IP ranges at the firewall level. The office effect is real - a large share of junk and malicious lookups simply never resolve. Understand its limit honestly: it works on domain names, so it cannot remove ads that are served from inside the same domain as the content, like ads inside YouTube videos.
Snort and Suricata inspect traffic patterns and raise alerts - or block - when traffic looks like an attack. They are genuine security tools, and they are also hungry: meaningful RAM, real tuning time, and a stream of alerts someone must actually read. Installed carelessly, they block innocent traffic and teach staff to hate the firewall. Earn this one later, on a quiet weekend, in alert-only mode first.
Proxy add-ons once promised content filtering and caching. In the HTTPS era their honest value has collapsed: nearly all traffic is encrypted, so a proxy sees little, caches less, and true inspection means breaking encryption with your own certificates on every device - a heavy, fragile project. For website blocking in a small office, DNS filtering (pfBlockerNG, or policy on the resolver) is the practical route.
Reconnect a normal PC and do the boring checks: websites open, printer prints, shared folders answer, VPN still connects. Then look at the package's own status page and logs. Most package problems announce themselves in the first hour; the rest announce themselves at the worst possible moment, which is why the backup from step one exists.
Get the base firewall running with the setup video first - packages belong on a stable foundation.
Watch Full VideopfBlockerNG, for most small offices. It blocks known malicious and advertising domains and bad IP ranges using maintained lists, with a visible effect and modest demands. Install it on its own, back up first, and live with it for a few days before adding anything else.
No - and be suspicious of anything that promises it can at the firewall. pfBlockerNG blocks by domain name; YouTube serves its ads from the same domains as its videos, so domain blocking cannot separate them. It does remove a large amount of other ad and tracker traffic across the network.
Not on day one. Intrusion detection is powerful but needs RAM, tuning and someone who reads its alerts. A well-kept basic firewall plus updated PCs protects a small office better than an untuned IDS that everyone ignores - add it later, in alert-only mode, when you can give it attention.