I once tried out pfSense, about 8 years ago. I was looking for a VPN solution for a small startup. I had used pf on OpenBSD, and really liked it as a firewall, so having "pf" in the name made pfSense sound good to me. My hope was that pfSense would provide an easy out of the box VPN setup, without me having to configure a RADUIS server to talk to LDAP, and have easy user provisioning.

What I found was a mess of PHP and poor quality plugins. The init scripts were written in PHP, and the plugins modified the init scripts. So plugins could, and did, break the init process, preventing the firewall rules from loading.

I don't think people are using pfSense in production environments, I see this class of solution being used by IT at small companies. Think about big corporate networks, where you might have a device from Palo Alto Networks, or a Cisco ASA for a remote access VPN. Then imagine you are at a 20 person company, a decade ago before SaaS really took off, and you think you need a VPN, but can't afford something from a big company, and don't want to glue together a bunch of open source tools. I think that is when people reach for pfSense.

I don't think it makes much sense these days. Small companies can use much dumber (and better) gateway devices. With SaaS and things like Google IAP and Cloudflare Access there is little need for VPNs. As for IPS, I have trouble imagining IPS being needed or even working at a small company. Big companies can have sophisticated detection systems and teams to deal with them. Hopefully big companies were never using pfSense.