Best Hardware for OPNsense in 2026: Protectli, Netgate, Mini-PCs

Affiliate disclosure: Some links below are Amazon affiliate links. We may earn a small commission at no extra cost to you. Hardware is selected based on performance data, not commission rates.

OPNsense runs on any x86-64 hardware with two NICs. The question is which hardware fits your throughput needs, noise tolerance, power budget, and expansion plans.

How to size it (do this before buying)

Work backwards from three numbers:

WAN throughput. Match to your ISP plan, with headroom. Plain NAT routing is light — even low-power Atom-class CPUs route a gigabit. The cost explodes when you add inline IDS/IPS (Suricata), which is single-flow-CPU-bound and can cut usable throughput by half or more on a given box.
Feature load. Plain firewall + DHCP + DNS is trivial. Add inline Suricata, a VPN with many concurrent tunnels, traffic shaping, or Netflow/reporting, and CPU and RAM demands climb. Be honest about what you’ll actually enable.
Single-thread performance. OPNsense’s packet path and Suricata benefit more from strong single-thread performance and AES-NI than from many slow cores. A 4-core chip with good per-core speed beats an 8-core chip of weak cores for this workload.

A practical rule: size for the feature set you’ll enable within a year, not just today’s link speed. Under-provisioning shows up as latency under load and a saturated CPU exactly when you need the firewall most.

NIC choice matters more than the CPU badge

Use Intel NICs (igb/em/ix drivers). Realtek NICs work for casual use but have a long history of throughput and stability issues under sustained load on FreeBSD, and inline Suricata (netmap/IPS) often won’t run on them. If a mini-PC only ships Realtek, budget for an Intel-based add-in or pick a different box. Confirm AES-NI is present (it is on essentially all modern Intel/AMD) for fast VPN.

Tier 1: Entry-level (sub-$200, up to ~500 Mbps IDS-off)

Protectli FW4C (~$180–220 used)

CPU: Intel J3160 (quad-core, 1.6 GHz, 6W TDP)
NICs: 4×Intel GbE
RAM: 4–8 GB DDR3L
Storage: mSATA SSD slot
Fan: Fanless
Verdict: Best entry point. Runs cool and quiet. IDS/IPS (Suricata) will saturate the CPU around 250 Mbps on ET Open rules. Fine for <500 Mbps WAN without IPS.

Used Intel Celeron NUC (Gen 7–9) (~$80–150)

Works but requires an external USB NIC or PCIe NIC adapter. More I/O hassle than a purpose-built device.

Tier 2: Mid-range (200–400, up to ~940 Mbps IDS-off, ~600 Mbps IDS-on)

Protectli VP2420 (~$350 new)

CPU: Intel Celeron J6412 (quad-core, 2.0 GHz, 10W TDP)
NICs: 4×Intel 2.5GbE (i225)
RAM: 8 GB DDR4 (upgradeable to 16 GB)
Storage: M.2 NVMe + 2.5” SATA slot
Verdict: Significant leap from the J3160. 2.5GbE on all ports future-proofs for multi-gig WAN. Suricata ET Open handles ~600 Mbps comfortably.

Topton/Cwwk N5105 mini-PC (~$200–260)

Intel N5105, 4×Intel GbE or 2.5GbE, fan-cooled but quiet.
Slightly louder than Protectli but significantly cheaper for equivalent throughput.

Tier 3: High-end (500+, 1 Gbps+ with IDS, 10GbE inter-VLAN)

Protectli VP4630 (~$600+)

CPU: Intel Core i3-10110U (dual-core, 4.1 GHz Turbo)
NICs: 6×Intel 2.5GbE
RAM: up to 64 GB DDR4
Storage: dual M.2 NVMe
Verdict: Handles 1 Gbps IDS/IPS throughput. Overkill for most homes; appropriate for a power homelab or small office.

Refurbished Supermicro SuperServer (used)

Overkill in power draw (35–65W idle) but gives you 10GbE SFP+ and ECC RAM. Worth it if you’re also running pfSense ↗ BGP/OSPF experiments.

Key buying criteria

Criterion	Recommendation
WAN speed	Match NIC to your ISP tier (GbE for ≤1G, 2.5GbE for multi-gig)
IDS/IPS	J6412 minimum if enabling Suricata inline
Power	Fanless < 10W for always-on closet install
Expansion	Pick hardware with extra NIC ports for future DMZ/IoT VLANs
Used vs new	Used FW4C is the best value entry — OPNsense doesn’t need warranty

RAM and storage guidance

RAM: 4 GB is a workable floor for routing + basic services. Run Suricata, Zenarmor, or heavy reporting and you want 8 GB; 16 GB is comfortable headroom and cheap. If you use the ZFS install (recommended for boot environments/rollback), give it more RAM rather than less.
Storage: use a real SSD (SATA or NVMe), not a USB stick or low-endurance SD card. Suricata, Netflow, and the reporting database write continuously and will wear out cheap flash. 20 GB+ is sensible if you enable logging/reporting; the OS itself is small. ZFS on a single SSD is fine and gives you snapshot/rollback before firmware updates.

Buying used safely

Used Protectli/mini-PC boxes are the best value in homelab firewalls. A quick checklist:

Confirm the exact NIC chipset (ask the seller or check the model spec) — you want Intel, not Realtek.
Verify the unit accepts the RAM/storage you plan to add (DDR generation, M.2 vs mSATA, SATA bay).
Check it has the port count for future VLAN/DMZ growth — adding a NIC later is often impossible in a fanless case.
Factory-reset and re-flash OPNsense yourself; never trust a pre-installed firewall image from a stranger.

When this is the wrong purchase

Don’t buy a high-end 6-NIC box “to be safe” if you have a 300 Mbps connection and won’t run IPS — a quiet fanless dual/quad-core unit will idle near silent, sip power 24/7, and do the job. Conversely, don’t try to run inline Suricata at multi-gig on an entry Atom box; it will be the bottleneck and you’ll blame the software. And if you only need basic routing for a small flat network, repurposing an existing low-power PC with an Intel dual-NIC card is often the most economical path — buy purpose-built hardware when fanless operation, low idle power, port density, or appliance form factor genuinely matter to you.

Comparing OPNsense vs pfSense hardware compatibility? FirewallCompare hardware guide ↗ has side-by-side appliance spec sheets.