Best Hardware for OPNsense in 2026: Protectli and Mini-PCs

OPNsense runs on any x86-64 hardware with two NICs. The question is which hardware fits your throughput needs, noise tolerance, power budget, and expansion plans. This guide spans the full range, including used NUCs, rackmount servers, refurbished enterprise gear, and the current-generation mini PCs and purpose-built appliances worth buying in 2026.

At a glance

Read the table by column, not by row: NIC vendor decides whether inline IPS runs at all, cooling decides whether the box can live in a room you occupy, and the Suricata column is the number that actually separates the tiers. Everything below expands on those three.

The Suricata figures are planning estimates for a mid-sized ET Open ruleset, derived from CPU class and the published specifications listed under each box — not bench measurements, and not a promise. Ruleset size swings them by a wide margin: trimming to high-confidence categories can roughly double what a given box sustains, and turning on every category can halve it. Treat the column as tier ordering, and size with headroom.

How to size it (do this before buying)

Work backwards from three numbers:

1. WAN throughput. Match to your ISP plan, with headroom. Plain NAT routing is light — even low-power Atom-class CPUs route a gigabit. The cost explodes when you add inline IDS/IPS with Suricata, which is single-flow-CPU-bound and can cut usable throughput by half or more on a given box.
2. Feature load. Plain firewall + DHCP + DNS is trivial. Add inline Suricata, a VPN with many concurrent tunnels, traffic shaping, or Netflow/reporting, and CPU and RAM demands climb. Be honest about what you’ll actually enable.
3. Single-thread performance. OPNsense’s packet path and Suricata benefit more from strong single-thread performance and AES-NI than from many slow cores. A 4-core chip with good per-core speed beats an 8-core chip of weak cores for this workload.

A practical rule: size for the feature set you’ll enable within a year, not just today’s link speed. Under-provisioning shows up as latency under load and a saturated CPU exactly when you need the firewall most.

What OPNsense officially requires

OPNsense’s official hardware guidance sets three tiers. Read them as a floor, not a target: the “recommended” row is where a home build that runs IPS and a VPN should start.

Because Suricata is single-flow-CPU-bound, strong single-thread performance per core matters more than core count, and AES-NI stops being optional the moment you terminate WireGuard or OpenVPN.

NIC choice matters more than the CPU badge

Use Intel NICs (igb/em/ix drivers). Realtek NICs work for casual use but have a long history of throughput and stability issues under sustained load on FreeBSD, and inline Suricata (netmap/IPS) often won’t run on them. If a mini-PC only ships Realtek, budget for an Intel-based add-in or pick a different box. Confirm AES-NI is present (it is on essentially all modern Intel/AMD) for fast VPN. For the specific cards worth buying at each speed tier, see our best NIC for an OPNsense home firewall guide.

If the box you are adapting is a desktop or a server with a free PCIe x8 slot and you want 10GbE over copper, the Intel X550-T2 is the reference dual-port choice: a genuine Intel part on the mature ix driver, which is the difference between a NIC that FreeBSD treats as a first-class citizen and one that produces forum threads. It is the wrong purchase for a fanless appliance — there is no slot to put it in — and overkill if your LAN is gigabit end to end. For a 1 Gbps repurpose, any Intel igb-class dual or quad card does the job for a fraction of the price.

Tier 1: Entry-level (sub-$200, up to ~500 Mbps IDS-off)

Protectli FW4B (~$180–220 used)

• CPU: Intel J3160 (quad-core, 1.6 GHz, 6W TDP)
• NICs: 4×Intel GbE
• RAM: 4–8 GB DDR3L
• Storage: mSATA SSD slot
• Fan: Fanless
• Verdict: Best entry point. Runs cool and quiet. IDS/IPS (Suricata) will saturate the CPU around 250 Mbps on ET Open rules. Fine for <500 Mbps WAN without IPS.

Used Intel Celeron NUC (Gen 7–9) (~$80–150)

• Works but requires an external USB NIC or PCIe NIC adapter. More I/O hassle than a purpose-built device.

Tier 2: Mid-range (200–400, up to ~940 Mbps IDS-off, ~600 Mbps IDS-on)

Protectli VP2420 (~$350 new)

• CPU: Intel Celeron J6412 (quad-core, 2.0 GHz, 10W TDP)
• NICs: 4×Intel 2.5GbE (i225)
• RAM: one DDR4 SO-DIMM slot, up to 32 GB
• Storage: M.2 SATA (no NVMe support) + internal 2.5” SATA bay
• Verdict: Significant leap from the J3160. 2.5GbE on all ports future-proofs for multi-gig WAN. Suricata ET Open handles ~600 Mbps comfortably.

Topton/Cwwk N5105 mini-PC (~$200–260)

• Intel N5105, 4×Intel GbE or 2.5GbE, fan-cooled but quiet.
• Slightly louder than Protectli but significantly cheaper for equivalent throughput.

Tier 3: High-end (500+, 1 Gbps+ with IDS, 10GbE inter-VLAN)

Protectli VP4630 (~$600+)

• CPU: Intel Core i3-10110U (dual-core, 4.1 GHz Turbo)
• NICs: 6×Intel 2.5GbE
• RAM: up to 64 GB DDR4
• Storage: one M.2 2280 slot (SATA or NVMe) + internal 2.5” SATA bay, plus 16 GB of onboard eMMC
• Verdict: Handles 1 Gbps IDS/IPS throughput. Overkill for most homes; appropriate for a power homelab or small office.

Refurbished Supermicro SuperServer (used)

• Overkill in power draw (35–65W idle) but gives you 10GbE SFP+ and ECC RAM. Worth it if you’re also running pfSense BGP/OSPF experiments.

Current 2026 boxes and purpose-built appliances

The tiers above are the shape of the decision; these are the specific boxes worth knowing this year, from cheapest mini PC to reference appliance.

Mini PCs. The Beelink EQ14 (Intel N150, two onboard Intel i226-V 2.5GbE ports, 16 GB RAM, ~6W idle) is the most common home OPNsense box in 2026: no USB adapter and no Realtek in the path, with enough headroom for roughly 400–600 Mbps of Suricata-inspected throughput on a mid-sized ruleset. Need four physical ports for WAN plus IoT, guest, and management segments without a trunk? A CWWK N100 quad-i226-V barebones does that under 10W. At the top, the Minisforum MS-01 (Core i9-12900H, dual 10GbE SFP+, a PCIe x4 slot) is overbuilt for a single WAN but earns its 25–40W draw on multi-gig links or when it doubles as a dedicated IDS sensor.

One NIC caveat spans all of them: early Intel i226-V firmware dropped link under Energy Efficient Ethernet. Current units ship corrected, and disabling EEE in the interface settings is a ten-second fix if you ever hit it.

Purpose-built appliances. A Protectli VP2420e (Celeron J6412, 4× Intel i226-V, fanless, 24W max) buys a chassis engineered to shed heat around the clock, a named Intel chipset instead of a listing you have to decode, and optional factory coreboot firmware. The VP2430 swaps in an N150 and adds an optional Wi-Fi 6/6E/7 card for a combined router-and-AP box, though a dedicated access point still gives better wireless. For the reference option, Deciso’s DEC740 — from the company that develops OPNsense — pairs an AMD Ryzen Embedded platform with 3× 2.5GbE and 2× 10G SFP+, is rated at 10 Gbps firewall throughput, and bundles a year of OPNsense Business Edition. The SFP+ pair and the vendor’s own integration testing are what justify its premium over a mini PC.

Whichever class you land on, the NIC rule from the sizing section still governs: use Intel on any interface that will ever carry inline IPS.

Key buying criteria

The power number nobody checks

A firewall runs every hour of every day, so idle draw is the spec that compounds. A fanless 10W appliance costs roughly a fifth of what a 50W refurbished server costs to run, and over a five-year life that gap can exceed the price difference between the two boxes. Vendor “TDP” figures describe the CPU, not the system, and say nothing about the PSU’s efficiency at the 10–20% load a router actually sits at.

The honest way to settle it on hardware you already own is to measure at the wall with a plug-in meter such as the Kill A Watt P3 P4400, which reports watts and accumulated kWh so you can convert directly against your utility rate. Measure the candidate box idle, then again with Suricata enabled and traffic flowing — the delta between those two numbers is what enabling IPS actually costs you per year, and it is usually smaller than people expect on modern silicon.

RAM and storage guidance

• RAM: 4 GB is a workable floor for routing + basic services. Run Suricata, Zenarmor, or heavy reporting and you want 8 GB; 16 GB is comfortable headroom and cheap. If you use the ZFS install (recommended for boot environments/rollback), give it more RAM rather than less.
• Storage: use a real SSD (SATA or NVMe), not a USB stick or low-endurance SD card. Suricata, Netflow, and the reporting database write continuously and will wear out cheap flash. 20 GB+ is sensible if you enable logging/reporting; the OS itself is small. ZFS on a single SSD is fine and gives you snapshot/rollback before firmware updates.

Buying used safely

Used Protectli/mini-PC boxes are the best value in homelab firewalls. A quick checklist:

• Confirm the exact NIC chipset (ask the seller or check the model spec) — you want Intel, not Realtek.
• Verify the unit accepts the RAM/storage you plan to add (DDR generation, M.2 vs mSATA, SATA bay).
• Check it has the port count for future VLAN/DMZ growth — adding a NIC later is often impossible in a fanless case. A trunk to a managed switch is the alternative, and the OPNsense VLAN configuration guide covers what that costs you in tagging complexity.
• Factory-reset and re-flash OPNsense yourself; never trust a pre-installed firewall image from a stranger.

When this is the wrong purchase

Don’t buy a high-end 6-NIC box “to be safe” if you have a 300 Mbps connection and won’t run IPS — a quiet fanless dual/quad-core unit will idle near silent, sip power 24/7, and do the job. Conversely, don’t try to run inline Suricata at multi-gig on an entry Atom box; it will be the bottleneck and you’ll blame the software. And if you only need basic routing for a small flat network, repurposing an existing low-power PC with an Intel dual-NIC card is often the most economical path — buy purpose-built hardware when fanless operation, low idle power, port density, or appliance form factor genuinely matter to you. If that spare machine already runs a hypervisor, you can skip dedicated hardware for now and run it as a VM: install OPNsense on Proxmox. One repurpose that does not work is the ARM single-board computer sitting in a drawer: OPNsense publishes amd64 images only, and what a Raspberry Pi can and cannot do for an OPNsense build covers the supporting roles it still fills.

One adjacent decision worth settling before you spend anything: if the platform itself is still open, OPNsense vs pfSense for homelab is the decision to make first, because it changes which hardware compatibility lists apply to you.

Comparing OPNsense vs pfSense hardware compatibility? FirewallCompare hardware guide has side-by-side appliance spec sheets.

Related on this site

• How to Install OPNsense on Proxmox VE: Step-by-Step Guide