Why Kerio Control firewalls are so popular on Yachts
GFI KerioControl firewalls continue to be a default choice on yachts. The line-up has now moved on: the NG120, NG320, NG520, NG521 and NG720 replace the older NG110, NG310, NG510 and NG511 appliances.
A new generation: NG120, NG320, NG520, NG521 and NG720
The current GFI KerioControl hardware generation is the NG120, NG320, NG520, NG521 and NG720. They replace the NG110, NG310, NG510 and NG511 and bring newer Intel processors, more RAM, faster SSD storage and considerably higher throughput.
One important planning point: the new appliances ship with GFI KerioControl v10 preinstalled and require v10 because of updated network interface drivers. They will not run correctly on older 9.x images. Legacy appliances can continue on 9.x, so a hardware swap and a software upgrade should be planned together.
We hold stock and quote all current models on FUSE.
- NG120: entry appliance for small vessels and crew networks. Roughly 10 to 20 users and 50 to 100 devices, around 900 Mbps firewall and 460 Mbps UTM throughput, Intel Atom x7211RE, 8 GB RAM, 256 GB M.2 SSD, TPM 2.0.
- NG320: the mid-range step up from the NG310, for vessels that have outgrown the entry appliance but do not need a 1U rack unit.
- NG520: 1U appliance with Intel Core processors. 200 to 300 users, 1000 to 1500 devices, 2.1 Gbps firewall and 1.3 Gbps UTM throughput.
- NG521: same performance envelope as the NG520 in a 1U chassis with additional expansion options, for installations that need extra interface flexibility.
- NG720: the high-performance model, built on 14th Gen Intel Core. 250 users, 1250 devices, 250k to 300k concurrent connections, 8.5 Gbps firewall and 7.5 Gbps UTM throughput.
Why they stay popular on yachts
The appliances offer a mix of performance, security features and ease of use that suits owners, captains and ETOs who need a reliable and secure network at sea, often without a full-time IT specialist on board.
- Unified Threat Management: next-generation firewall and router, intrusion detection and prevention, gateway antivirus, VPN, and web content and application filtering in one box.
- User-friendly interface: crew and visiting engineers can configure and monitor the network without specialist training.
- Quick deployment: fast to commission, which keeps downtime short during a refit or a yard period.
- VLAN support: clean separation of guest, crew, AV and bridge systems on the same infrastructure.
- Flexible WAN: works well across Starlink, VSAT and 5G, with failover between them.
- Modular licensing: add features as the vessel needs them rather than paying for everything up front.
- Support everywhere: in most cruising locations there is someone who knows KerioControl, plus an active user community.
- Value: a full security suite at a competitive price, with a low total cost of ownership.
Cybersecurity is not optional any more
Regular firmware and security patching is what keeps any of this effective. Vessels that skip updates stay exposed to known threats and miss performance and feature improvements. Moving to v10 hardware is a good moment to put a patching routine in place.
Conclusion
If you are still running an NG110, NG310, NG510 or NG511, the NG120, NG320, NG520, NG521 and NG720 are the direct replacements, with the v10 requirement being the main thing to plan around. We can size the right model for the vessel, supply it and have it pre-configured before it reaches the yard.
Browse stock and pricing on the FUSE marketplace, or read more about our GFI Software distribution.