Search for the best NIC for OPNsense home firewall duty and the answer compresses twenty years of FreeBSD driver history into one word: Intel. For a gigabit WAN, a used Intel i210 or i350-T2 server card. For 2.5GbE, anything built on the Intel i226-V. For a 10G storage or inter-VLAN backbone, a secondhand Intel X520-DA2 with SFP+ DACs. Realtek is the qualified exception, not the rule. The rest of this post is the reasoning, because the reasoning is what keeps you from buying the wrong card in a different form next year.
Why Intel silicon wins on FreeBSD
OPNsense is FreeBSD under the hood, so NIC support is decided by FreeBSD kernel drivers, not by what Windows or Linux thinks of the card. The official OPNsense hardware guidance is unusually blunt for vendor documentation: Intel NICs “are reliable, fast and not error-prone,” and Intel chipsets “deliver higher throughput at a reduced CPU load.” All FreeBSD drivers ship in the OPNsense kernel, so FreeBSD’s hardware notes translate directly.
That CPU-load point matters more on a firewall than on a desktop. Every packet your WAN moves is also a packet your router’s CPU touches for NAT, firewall states, and, if you run Suricata, inspection. A NIC that does real work in hardware leaves headroom for the IDS/IPS you actually bought the box for. The igc(4) driver behind the i225/i226 family supports transmit/receive checksum offload, TSO, MSI-X interrupts, RSS to spread load across cores, VLAN hardware tag insertion and extraction, and jumbo frames to 9216 bytes. That VLAN line is not trivia: if your OPNsense box trunks three or four VLANs over one physical port, hardware 802.1Q handling is doing work on every frame. Our VLAN configuration guide assumes a NIC that does this properly.
The shortlist, by build
Gigabit WAN: Intel i210-T1 or i350-T2 or T4
If your WAN is 1 Gbps or slower, the boring answer is a used server pull. The i210 (single port) and i350 (dual or quad) run FreeBSD’s mature igb driver, are stocked by every enterprise recycler, and counterfeits aside, there is nothing left to debug in them. A quad i350-T4 also solves the “my mini-PC only has two ports” problem without a switch.
Multi-gig: Intel i226-V, full stop
The i226-V is the current revision of Intel’s Foxville 2.5GbE controller and the default NIC in nearly every fanless firewall box sold today. Per Intel’s ARK listing it launched Q2 2022, draws 1.3 W TDP, and hangs off a single PCIe 3.1 lane, which is why vendors can put six of them on one N100 board. The earlier i225 had a bumpy launch across its silicon steppings; the i226 is the version to buy in 2026. ServeTheHome’s review of a fanless N5105 box with four i226-V ports is representative of the category: priced at roughly $306 to $312 configured when that review ran in 2022, shipped with OPNsense preinstalled (reinstall it yourself; never trust a preloaded OS image on a firewall), and unremarkable in the way firewall hardware should be. If you are choosing the whole box rather than just the card, start with our OPNsense hardware guide.
10G: Intel X520 or X710, SFP+ over copper
For a 10G LAN-side backbone, the used-market kings are the Intel X520-DA2 (82599 controller) and the newer X710-DA2. The FreeBSD ix(4) driver covers the 82598/82599 through X540, X550, X552/X553, and the current E610 series, so an X520 pulled from a decommissioned server drops straight in. Prefer SFP+ with DACs or fiber over 10GBASE-T: less power, less heat, and no negotiation arguments with a switch. One caveat on the X520: it is fussy about which SFP+ modules it accepts, so buy Intel-coded optics or DACs. Chelsio’s T520 series is the other FreeBSD-native 10G choice and worth grabbing when it is cheaper.
The Realtek question
Realtek onboard NICs (RTL8111/8168 and the 2.5G RTL8125) are why the cheapest boxes are cheap. FreeBSD’s in-kernel re(4) driver covers the older chips, and its own man page points to the vendor’s updated driver in ports (net/realtek-re-kmod) for when the built-in one misbehaves; OPNsense packages that vendor driver as the os-realtek-re plugin. Installed, Realtek is workable for a sub-500 Mbps WAN. But “install a plugin so the NIC works right, and re-check it after every major upgrade” is exactly the maintenance surface you do not want on the box that stands between your network and the internet. Firewall NIC advisories and driver regressions do surface in general security news; a feed like techsentinel.news is a reasonable way to catch them, but the better fix is silicon that never makes the news.
Skip USB Ethernet adapters entirely for firewall duty. A WAN port that can re-enumerate on a power blip is not a WAN port.
Things to test before you call it done
Verify, don’t assume. From an OPNsense shell:
pciconf -lv | grep -B3 networkconfirms which driver actually attached (igc, igb, ix, or re).iperf3 -son a LAN host, theniperf3 -c <host> -P 4 -t 30through the firewall, both directions. Single-stream and parallel numbers should both approach line rate.iperf3 -c <host> -P 4 -Rwhile Suricata runs in IPS mode, because the offload story changes once packets go through inspection.vmstat -iduring the iperf3 run: MSI-X NICs should show multiple queue interrupts spread across vectors, not one storming line.- Pull the WAN cable mid-transfer and reconnect. Link should renegotiate in seconds without a reboot; flaky renegotiation is the classic symptom of a NIC to return.
The pattern behind all of this: the best NIC is the one whose driver the FreeBSD man pages describe in the past tense, with a features list instead of a workarounds list. In 2026 that means i210/i350 for gigabit, i226-V for multi-gig, X520/X710 for 10G, and Realtek only when the price gap pays for your time.
Related across the network
- Firewall Hardware Tiers: Celeron vs N100 vs i5 Mini-PCs — firewallcompare.com
- Best Homelab Firewall in 2026: OPNsense, pfSense, UniFi, MikroTik — firewallcompare.com
- Best Mini PC for OPNsense 2026: A Buyer’s Guide by Tier — firewallcompare.com
- Firewalla vs pfSense: Appliance or DIY Firewall? — firewallcompare.com
- Protectli vs Netgate 2026: Which Firewall Hardware Wins? — firewallcompare.com
