I am sometimes asked for hardware recommendations for OPNsense and the question appears on Reddit frequently. So I thought it might be helpful to put together a list of products which should be able to run OPNsense well for home users. There are a number of devices that will run OPNsense, which is the great because you have many choices available to you. Depending on your needs and budget, you should be able to narrow down your selection to a few good choices.

For my recommendations, keep in mind that I have not used these devices personally except for one of them so I cannot fully endorse all of the options below, but I hope it will illustrate the types of available hardware which will run OPNsense. I suggest you further research the products below or ones not listed before making your final selection.

In an effort to minimize updates to this page, I am going to generalize the prices by grouping products by approximate cost ranges. Some products may increase or decrease in price over time. The price ranges should help you understand the gain in performance and features as the prices range increases. I will focus primarily on new products, but I will discuss some used hardware options as well. Since the availability of used products vary greatly depending what is currently available by sellers, it would be more difficult to keep such a list up to date. Prices may flucuate greatly in a used market as well. You may be able to find a rare deal if you are willing to actively search and wait for such a great deal.

New Hardware Options

There are many types of new hardware options available. New hardware is not often the affordable solution, but purchasing new hardware is both convenient (especially if the system is prebuilt) and may have a longer shelf life than older hardware. Old enterprise hardware may still have many years of life left, but it may be much less power efficient and noisier.

Desktop Hardware

Desktop Hardware

Desktop hardware is a good choice for new users to OPNsense since it offers a more affordable, quieter, and energy efficient solution. Desktop hardware can come in various form factors – from full towers to mini PCs. Some Mini PCs are designed to be network appliances that include multiple Ethernet ports (typically 2, 4, or 6 ports). The size and types of desktop hardware you wish to use may vary greatly depending on your needs, preferences, and budget. For new desktop hardware, I will be focusing primarily on mini PC appliances since they are best used for running software such as OPNsense.

< $200 USD

While it may be possible to purchase devices in this range, you likely will not be satisfied with the performance/features of the device. If your budget is below $200 USD and you want to run OPNsense, you may need to reuse existing hardware or buy used hardware.

$200-$300 USD

  • Qotom i5-4200U (8 GB) (affiliate link): This is the mini-PC I purchased in 2017 when I first started using OPNsense. Fast forward 4 years later and I am still using it. Apparently it is still for sale on Amazon! It has served me well over the years. I plan to upgrade eventually only because I would like to add some internal 10 Gbps links for my servers/PC to move data around my network more quickly. Due to my personal experience with Qotom, I would recommend Qotom for OPNsense especially for new users on a budget. They are a cheaper alternative to Protectli and often offer more performance and interfaces at the same price range of Protectli. I know some users have brand loyalty to Protectli since those boxes work well too. One possible difference which may be important to users is that Protectli boxes use coreboot so those systems may have a more secure, faster boot up than the Qotom boxes.

  • PCEngines apu4d4 (4 GB): Some users like to use PCEngines hardware for their router/firewall. Some of the components are under $200 USD, but by the time you purchase a case and other parts, you will likely spend over $200 USD. This option is a little more of a DIY system, but the necessary parts to put the system together into an enclosure can be purchased at the same time. The performance of the PCEngines hardware may be fine for most basic routing/firewall purposes for home usage, but if you plan to run other services in OPNsense such as intrusion detection with Suricata, Zenarmor, or a VPN, you will be more satisified purchasing a mini-PC such as the Qotom box listed above. You will have much more performance and will be able to support 8-16 GB of RAM depending on the system you purchase. I would recommend a minimum of 8 GB of RAM if you are running those heavier weight services. I really like the idea of PCEngines to build my own router/firewall at an affordable price in a nice energy efficient package, but the hardware is not quite capable enough to run the heavy weight services.

$300-400 USD

  • Protectli Vault FW2B (affiliate link): If you are interested in getting a Protectli, the Vault FW2B is one of the lowest priced boxes that is not a barebone system. You could save some money if you happen to have some extra RAM and disks laying around. However, these firewall appliances often use laptop SO-DIMM memory so you may not have any laying around unless you scavange it from an unused laptop. When you can get a good deal on the RAM and have an extra SSD laying around, getting the barebones system could save a little bit of money.

  • Qotom Intel i5-5200U (8 GB) (affiliate link): For about the same price as the Protectli Vault FW2B, you can have two extra interfaces which is definitley nice to have if you wish to create several internal networks and/or VLANs and you want to reduce bottlenecks in bandwidth. You can spread the bandwidth across the ports using link aggregation or by using different interfaces for separate networks/devices. The Qotom does have some WiFi options but I do not recommend getting a model with WiFi to use as a WiFi hotspot for your entire network. You will likely have much better WiFi performance and range by purchasing separate wireless access points such as ones from Ubiquiti (affiliate link).

  • MOGINSOK 2.5 GbE Firewall Appliance (8 GB) (affiliate link): There are some 2.5 Gigabit Ethernet options emerging for the mini-PC firewall appliances at a budget friendly price (comparable to some of the 1 Gigabit options). If you are looking for increased bandwidth between some of your devices on your network, this may be an option. Keep in mind that you will need to pair this firewall with a network switch capable of 2.5 GbE and devices which have a 2.5 GbE interface to take full advantage of the increased speeds. Other considerations such as needing to use SSD/NVMe drives or traditional HDDs that use mirroring/RAID/ZFS, etc. are also important to for maximizing bandwidth for large data transfers. The great thing about the 2.5 GbE and 5 GbE standards is that you should be able to use existing Cat 5e cabling so you do not need to replace your Ethernet cables with higher quality cables (unless of course you are encountering issues).

  • HUNSN RS34g 2.5 GbE (8 GB) (affiliate link): Another 2.5 GbE option that you may want to consider. This box actually has Amazon reviews which is helpful because there are users which stated the box works for pfSense and OPNsense. The reason that is important is that 2.5 GbE is a relatively new addition to FreeBSD support so the latest versions of OPNsense should work (I have not personally verified that to be true). The $300-400 USD range is pretty reasonable because I paid around $350 USD for my mini-PC firewall appliance which only supports 1 GbE in 2017 before there were electronics shortages and inflated prices. If I were to buy a mini-PC firewall appliance today, I would certainly consider getting a box like this to take full advantage of greater than 1 Gigabit download speeds provided by my ISP.

  • Fitlet3: The Fitlet is a build to order device where you can customize the components that meet your needs. This may be a good option for you if you want a feature that may not be standard with other mini-PC/firewall appliances such as a fiber SFP+ port (although it only supports 1 GbE but that may be fine for many home users who do not need/want 10 Gbps interfaces). You can also get WiFi/cellular modules installed as well. If you start adding those sorts of modules, the price will be outside the $300-$400 price bracket.

$400-500 USD

  • Protectli Vault FW4B (4 GB) (affiliate link): You can get a non-barebones Protectli box with 4 interfaces under $400 USD if you are willing to have less ram and less SDD storage capacity. For OPNsense, a 32 GB SSD is likely ok unless you are doing a lot of logging or perhaps using a caching web proxy, but the 4 GB of RAM will be a limiting factor on how many heavy weight services you can run on the system.

  • Protectli Vault FW4B (8 GB) (affiliate link): When you bump up to 8 GB of RAM and a 120 GB SSD, it will push the price beyond $400 USD. However, you will be able to enjoy it for many years assuming you do not have other needs for your home network in the future such as adding 10 Gbps connections for your internal networks.

$500+ USD

  • Qotom Q555G6 i5-7200U (8 GB) (affiliate link): You may be able to get this Qotom which has 6 network interfaces for under $500 USD. When I first started writing, the price was slightly more than $500 USD. If you are looking for 6 network interfaces, this may be one of the most affordable options that would provide you with some extra bandwidth. Not all Qotoms are capable of having more than 8 GB of RAM, but this box supports up to 16 GB of RAM which is great if you want to run more services on your network in OPNsense.

  • Protectli Vault 6 (affiliate link): This Protectli with 6 interfaces is significantly more expensive than the Qotom with 6 interfaces. I am not sure why the price gap is larger between the two brands when bumping up to 6 interfaces. If you are willing to pay the price for this Protecli, you are in the price range of the most affordable, official OPNsense security appliance. The OPNsense DEC690 is actually a little cheaper than this Protectli box and you would be supporting OPNsense. However, it only has 4 network interfaces rather than 6.

  • OPNsense Desktop Security Appliance DEC690 (8 GB): This box is one of the most affordable firewall boxes OPNsense produces except for the 4 GB version, but as I have mentioned before, you will not be able to run as many heavy weight services in OPNsense. With that said, their hardware looks very nice and built with quality in mind. I love the dark gray and orange color scheme and the design of the chassis. I have seen some users choose to spend extra in order to support OPNsense to show appreciation for the free firewall software.

Rackmount Hardware

Rackmount Server

If you have a rack, you may want rack mounted hardware so there are less devices sitting on a shelf on your rack. I know I personally would love to rack “all the things”. I have a shelf in the middle of my rack for all my random boxes that are not rackmount. Rackmount hardware starts at a higher cost than the desktop hardware since the hardware (especially as price increases) offers greater performance and is considered more enterprise level (at least for a smaller-sized business). Medium to large businesses would like want better, more specialized equipment than anything on this list. For home networks, small to medium business grade equipment is more than enough for most users (unless you are wanting to learn how to use the more expensive enterprise gear at home).

$400-600 USD

  • HUNSN 1U Firewall Appliance (8GB) (affiliate link): This style of rackmount is likely one of the cheapeast you will find new on Amazon. They look cheap, but the specs may be good enough to run OPNsense just fine for a home network. You may want to research these boxes more before proceeding, but I wanted to include them in the last at the bottom end of the rackmount hardware that is available as new hardware.

$600-800 USD

  • HUNSN 1U Firewall Appliance (8 GB) (affiliate link): This is yet another cheap 1U server but this one has 8 LAN interfaces. If you need a lot of interfaces and you are on a budget, you may want a device such as this. It is possible that this device will last many users in a home environment even though it is cheap. After all, I am still using my Qotom after 4 years with no issues and it is probably a cheap brand like this 1U firewall appliance. I wish I had some feedback on these devices so I could know if they are worth mentioning or not.

  • Supermicro A1SRi-2558F Intel Atom C2558 (8 GB, No HDD) (affiliate link): This Supermicro only has 4 interfaces that are 1 Gbps and the processor may be a bit weak for any CPU intensive tasks. However, it is likely more power efficient than the RS-SMX10TP4F-FIO model. A storage device needs to be added to this 1U server for it to be complete.

$800-1,000 USD

  • OPNsense Desktop Security Appliance DEC2680: The DEC2680 is the most affordable rackmount server that is produced by OPNsense. It should offer plenty of performance for home usage but there are no 10 Gbit interfaces at this price point. As with the desktop version, the aesthetics are quite nice. I would love to have a OPNsense branded rackmount device, but the 10 Gbit rackmount is beyond the price I would like to pay to get started with 10 Gbit for home usage.

$1,000+ USD

On the high end of $1,000+ USD, you will find more 10 Gbit options as it is almost standard to have at least 1-2 10 Gbit interfaces. If you wish to have 10 Gbit, purchasing new is likely the most expensive option. You could probably build or buy a used system which has 10 Gbit for much cheaper than new hardware. I have included these higher end options for those who want to purchase new hardware and have larger budgets.

  • OPNsense Desktop Security Appliance DEC2750: The most affordable 10 Gbit rackmount option from OPNsense is the DEC2750. If you want 10 Gbps and want to support OPNsense, this is the option for you unless you have a “money is no object” type of budget.

  • Supermicro SuperServer 5018D-FN8T Xeon D (affiliate link): This is another 10 Gbit option from Supermicro. At this price point, it is more expensive than the OPNsense appliance, but it does have a lot more RAM and double the disk storage. There is also more network interfaces available. You could also possibly repurpose this server as a small application server if you decide to retire it later.

Build Your Own

Build Your Own

In addition to all of the prebuilt systems mentioned above, you also have the option to build your own router with new hardware. You can build either a desktop or rackmount system depending on the chassis and parts you buy. One nice thing about this option is that you can customize the hardware to your needs. You could install a 2.5 Gbps card (affiliate link) if you have faster than 1 Gbps Internet and a 10 Gbps or higher card for your internal networks (although 2.5 Gbps NIC support may be limited in FreeBSD/OPNsense at this time). You may be able to build a system in this manner for cheaper than some of the prebuilt systems. Even if this option may be more expensive than some prebuilt solutions or used solutions, the extra cost could be justified. The nice thing is that you can always repurpose your custom built system for other needs as well.

Depending on the parts selected, this option may not be very energy efficient especially if you are using desktop/server hardware. There are some lower cost, energy efficent hardware you could purchase. Often times that hardware is not as performant, but for a router/firewall, they often provide enough power especially for home usage. Energy use is important to consider for a device such as a router which runs 24/7 unless money is no object when it comes to your power bill.

Used Hardware Options

Used Hardware

When on a budget, purchasing used and/or reusing existing hardware may be the best option. Depending on the hardware, it may not be the most power efficient or the quietest option, but it will certainly get the job done. One risk with used hardware is longevity. Enterprise-grade hardware may last longer than consumer-grade hardware but there are pros and cons to use either type of hardware especially when it is used. However, if you may be able to save enough money that it is worth the investment even if you have to buy replacement parts later.

Repurpose Existing PC/Laptop

Repurposing existing hardware is likely the most affordable option of all options since you already have all or most of the hardware in hand.

  • The main thing you will likely need to purchase is additional network card or adapter such as an Intel 4 port Gigabit Ethernet card (affiliate link) since you will want more than one Ethernet interface on your system.

  • For additional bandwidth if you plan to utilize 10 Gbps or higher, you can purchase various network cards (affiliate link). Many of them may be pulled from used servers which makes them more affordable than purchasing the hardware new. I have noticed that SFP+ network cards can often be cheaper than 10 Gbps Ethernet cards so if you have all your equipment near each other especially in the same rack, you could purchase SFP+ cards to connect to your servers and switches. You can either purchase short fiber optic cables (affiliate link) or direct attached copper cables (affiliate link). For longer runs in your house when you do not have fiber optic cable installed, you can use 10 Gbps Ethernet cards for those devices.

  • The advantages of using an old laptop are that it is quiet, power efficient, and has a built-in backup battery. The disadvantage is that options are more limited for adding additional network interfaces. You will need to purchase a USB Ethernet adapter (affiliate link). Performance may be lacking especially if using slower USB ports, but in theory, a USB 3.0 port should be sufficient for 1 Gbps Ethernet. Using a laptop may or may not be more unsightly than a small mini-PC network appliance especially if you have USB adapter(s) hanging off the side of the laptop. A laptop can work in a pinch or if you like the novelty of using an old laptop, but it is likely not a good solution for many users.

Old Enterprise Hardware

Many homelabbers love to get used enterprise gear because you an get an older generation server that is still pretty fast for a fraction of the original price.

  • Most standard 1U servers can be used as firewall appliances if they have multiple network interfaces. However, they may have a deeper footprint in your rack, be more power hungry, and can be much noiser than alternatives. A general purpose 1U server could possibly provide much greater performance than a lower power alternative, but at the expense of the cost of electricity, noise, etc.

  • The 1U appliances which work best as a firewall appliance running 24/7 are typically half depth, lower power, and lower noise servers, which is perfect for most home lab usage. If you have a sealed off room or power and noise levels do not bother you, a standard 1U rackmount server may be a fine option since they are more powerful and possibly cheaper than the smaller 1U servers that are more tailored to be network/firewall appliances.

  • There are lots of old, used enterprise hardware on sites such as Ebay. There are sites which specialize in selling used hardware such as Server Monkey.

How to Choose the Appropriate Firewall Hardware?

How to Select Firewall

If you are new to running more advanced routing/firewall software such as OPNsense, you may not know which is the best device to purchase for your home network. There are a number of considerations you must take into account in order to be satisfied with your hardware selection. To help guide you with your decision keep in mind the following bullet points below when determining your hardware requirements.

Services which Require Minimal Hardware Resources:

  • Routing (inter-VLAN 1 Gbps)
  • Firewall
  • DNS
  • mDNS Repeater
  • DHCP
  • Dynamic DNS
  • NTP
  • Monit
  • SSH

Services which Require a Significant Amount of Memory:

  • Zenarmor (if running Elasticsearch on the OPNsense box)
  • Intrusion Detection (Suricata)

Services which Require a Significant Amount of CPU:

  • Routing (inter-VLAN for multiple Gbps)
  • Intrusion Detection (Suricata)
  • VPN services (especially if hardware does not support AES-NI)

If you only want to run the basic router/firewall services, nearly all lower end hardware will be sufficient especially if you only plan to have a 1 Gbps network. You can use a minimal dual/quad core system with a low amount of RAM (1-4 GB). This is the most budget friendly option, of course. However, if you plan to run more resource intensive services, you will need a faster CPU and likely a minimum of 8 GB of RAM (you can run both Zenarmor with Elasticsearch and Suricata with 8 GB of RAM). If you like to tinker, you may want to purchase hardware which has more resources than you need now so you can have it available later when you need it. Ihof you plan to have a 10 Gbps internal network, you may need a faster CPU if you are doing inter-VLAN routing since that routing is done via software rather than hardware like network switches so it is not nearly as efficient with routing beyond several gigabits per second.

Conclusion

I hope this relatively short list gives you a good starting point of hardware that is available for purchase at various price ranges. Since it is impossible to create a list containing all possible hardware options for OPNsense, I tried to provide a few from each price range and category. I am certain I have not covered other good options as well. If you have some interesting options that I have not covered, please list them in the comments below, and I may add them to this list above since it may help others find hardware that meets their home networking needs.

comments powered by Disqus