Hi everyone,
I'm new to OPNSense and currently using a Linksys mesh router/AP system for my home network. I'd like to change my setup so that the routing and firewall tasks are handled by OPNSense on a dedicated Mini PC, instead of relying on my Wi-Fi hardware for these functions. My plan is to switch the Linksys system into bridge mode and later replace it with UniFi access points.
I'm looking for a budget-friendly Mini PC with passive cooling, low TDP (6-15W), and preferably 2x Intel NICs (as I've read Realtek can cause issues, is that true?). While the official OPNsense hardware is great, it's unfortunately too expensive and bulky for my needs. I need something very compact, as I plan to hide it somewhere in my living room.
Regarding the CPU, I assume the Intel N100 is a good choice, but I've also heard that Ryzen 3 U-series chips might be suitable. However, I'm a bit overwhelmed by all the CPU options and naming conventions, so any guidance here would be helpful.
I don't need Wi-Fi or many ports since I'll be running this Mini PC headless as a firewall. My main concern is being able to consistently connect to it from my MacBook. If that becomes an issue, I might need to buy a small display and keyboard as well.
The device should handle OPNSense, including VPN and ad-blocking, for up to 3 people. Additionally, I have various IoT devices that may generate some internet traffic, and I might want to set up a second VLAN for these devices and guest access.
I've been reading about various brands, such as Acemagician, ASUS, Fitlet, Glovary, Mele, Minisforum, Minix, Neosmay, Odroid, Protectli, Qotom, Topton, XCY, and Zotac. However, I have no experience with these brands and am unsure which ones offer reliable, fanless Mini PCs with 2.5Gbps Intel NICs and modern CPUs. I'd greatly appreciate any insights on which brands are trustworthy and which models you would recommend.
Any recommendations or experiences would be greatly appreciated. Thanks in advance!
–––
UPDATE: Here's what I purchased: https://forum.opnsense.org/index.php?topic=42462.msg213758#msg213758
Beelink and GMKtec are fairly reputable brands.
Quote from: bimbar on August 26, 2024, 01:34:59 PM
Beelink and GMKtec are fairly reputable brands.
Thanks for the info. I couldn't find any Beelink devices that are fanless. Regarding GMKtec, they don't specify the NIC manufacturer, so I assume it's not Intel. How critical is this? Are Realtek NICs problematic for a firewall/router setup?
I'd avoid the Fitlet3. The Fitlet2 was a nice machine but the built-in LAN ports on the Fitlet3 appear not to play well with BSD. See https://fit-pc.com/wiki/index.php?title=Fitlet3_Errata_Notes#FITLET3ERR005:_fitlet3_default_LAN_interfaces_are_not_recognized_by_some_-nix_based_OS
Other options that might be worth a look are AAEON and Jetway (these are both Asus companies) and GigaIPC (Gigabyte). These companies all make industrial minipcs for various purposes. They will generally be more expensive than the boxes made in the PRC but manufacturing standards are likely to be higher and you'll get better support. I'm currently using a GigaIPC with J6412 and dual Intel 1G LAN ports to run Opnsense. Barebones cost me $169 last year but cheapest I can find it for now is $240. I have no experience with Jetway boxes but you can find their J6412 barebones online with 2 to 4 i225v for under $300. They also sell a couple of Alder Lake N systems with dual i225v.
I had a Protectli device for many years and recently bought a 2nd one for OPNsense, a VP2420. Some of their devices have soldered RAM (so no upgrade), which I made sure to avoid. So far everything works fine.
Quote from: aleco on August 26, 2024, 02:10:27 PM
Quote from: bimbar on August 26, 2024, 01:34:59 PM
Beelink and GMKtec are fairly reputable brands.
Thanks for the info. I couldn't find any Beelink devices that are fanless. Regarding GMKtec, they don't specify the NIC manufacturer, so I assume it's not Intel. How critical is this? Are Realtek NICs problematic for a firewall/router setup?
Fanless might be difficult, since the N100 turbos up to 55W.
EDIT: Confused that with the Core i3 1215u. It seems that the N100 is up to about 15W.
Not really. The default PL2 usually is ~20-25 Watts. Many Aliexpress boxes have that and it can even be reduced in the BIOS.
I would really look fo devices with Intel I226 NICs (I225 use more power), as Realtek drivers for FreeBSD are notoriously bad. Some manufacturer do not tell which NIC chips are builtin.
Also, the Beelink S12 ist not passively cooled.
Quote from: qarkhs on August 26, 2024, 03:04:16 PM
Other options that might be worth a look are AAEON and Jetway (these are both Asus companies) and GigaIPC (Gigabyte).
Thanks for the recommendations. I couldn't find a Mini PC from these manufacturers with an N100 chip, and fanless models seem to be scarce. Fanless is a strict requirement for me since the device will be placed in my living room, right next to my couch. I've also learned to avoid Realtek NICs due to potential issues with FreeBSD drivers.
I didn't look into devices with other CPUs, as I'm not familiar with older options that might be suitable. Being an Apple user for the past 20 years, I remember names like "Celeron," "Atom," and "Pentium," which don't feel like modern choices to me. At least the "N100" sounds more current. I also assume the improved performance-to-TDP ratio is something we see mainly in newer chip generations.
Quote from: bimbar on August 26, 2024, 06:59:33 PM
Fanless might be difficult, since the N100 turbos up to 55W.
I've seen quite a few N100 devices recently, usually powered by 12V 3A DC, so 36W max. The TDP for the N100 is 6W. But I'm not an expert on how these power levels translate to real-world performance. I had assumed that a modern CPU like the N100 would easily be sufficient for managing the internet connectivity for a few people, including VPN and ad-blocking, and run at <10% load most of the time, with brief spikes.
Quote from: meyergru on August 26, 2024, 07:09:12 PM
I would really look fo devices with Intel I226 NICs (I225 use more power), as Realtek drivers for FreeBSD are notoriously bad. Some manufacturer do not tell which NIC chips are builtin.
Thanks for the tip. Now I know what to search for. My issue is that I can't easily tell which brands are trustworthy. Having used Apple computers for the past two decades, I've been out of the x86 space and am wary of accidentally buying a Shenzhen knockoff with fake labels that could be a security hazard. I recognize brands like ASUS, but beyond that, most of the others are unfamiliar to me. Any advice on which brands are reliable would be greatly appreciated.
I just found the CWWK X86 P5 (https://cwwk.net/products/cwwk-x86-p5-super-mini-router-12th-gen-intel-n100-ddr5-4800mhz-firewall-pc-2x-i226-v-2-5g-lan-fanless-mini-pc) and the iKoolCore R2 POE (https://www.ikoolcore.com/products/ikoolcore-r2-poe-firewall), both are N100, fanless, with Intel I226 NICs. Does anyone have insights on these brands? Or should I look into dedicated devices like the Netgate 1100 and skip the N100 alltogether?
QuoteI couldn't find a Mini PC from these manufacturers with an N100 chip, and fanless models seem to be scarce.
https://www.jetwaycomputer.com/BFTADN1.html
https://www.jetwaycomputer.com/BFDADN1.html
https://www.gigaipc.com/en/products-detail/QBiX-Pro-ADNAN97H-A2/
These are all fanless with N97. N97 is closely related to N100. See comparison here:
https://ark.intel.com/content/www/us/en/ark/compare.html?productIds=231803,233090
Quote from: qarkhs on August 26, 2024, 09:14:08 PM
These are all fanless with N97. N97 is closely related to N100. See comparison here:
Thanks for the info! I wasn't aware that the N95, N97, and N100 CPUs have nearly identical power usage, despite the different TDP ratings, likely for marketing. I also found that the N50 is a binned N100 with only 2 active cores, used in devices like the Asus NUC 143, but I haven't found any speed comparisons with the Celeron N5095 or N5105.
I've read some forum posts about the N100's performance on FreeBSD, mentioning higher-than-expected idle clocks, possibly due to incomplete p-state support. This has raised concerns for me about its efficiency, especially since I want a fanless device in my living room with limited ventilation. I'm worried about managing the heat from both the device and its power supply. I need to hide my firewall, modem, switch, WiFi access point, and two Raspberry Pi 4s (which probably will be replaced by two additional Mini-PCs soon) together with their power supplies in a living room shelf or TV stand, maybe behind a woven cane door—so cooling and space management are crucial.
Based on your replies and my research, I'm currently considering three options:
Firewall-specific devices: I've looked at examples like the Netgate 2100 or Protectli Vault FW4B, which feature 4x Intel NICs and are specifically designed for firewall use. But these come with quite old CPUs, and their price seems relatively high compared to other options.
Celeron-based Mini PC (N5095/N5105): These seem to have a mature platform, and after multiple iterations, most issues should have been resolved, making them potentially more reliable for 24/7 firewall use. However, these are older CPUs and might not be sufficient for also running ad-blocking and VPN?
N50/N95/N97/N100 devices: These promise better efficiency and performance. However, I'm concerned about potential issues as mentioned above. Since these devices are newer, they might be less tested compared to the older Celeron models.
Any advice or corrections to my assumptions would be greatly appreciated!
buy an appliance from Deciso
support the project, buy a certified to work device
I think Netgate 2100 uses a ARM CPU. Not sure Opnsense runs on that, at least official builds.
Why not include the Elkhart Lake CPUs as well (e.g. J6412)? The performance is similar to N5105, N5095 (Jasper Lake). Take with a pinch of salt but:
https://www.cpubenchmark.net/compare/5157vs5337vs4474vs4472vs4412/Intel-N100-vs-Intel-N97-vs-Intel-Celeron-J6412-vs-Intel-Celeron-N5095-vs-Intel-Celeron-N5105
Other thoughts. There appear to be lots of people running OpnSense on Alder Lake CPUs (e.g. N100) bought from PRC companies. You may need to do a microcode update. See:
https://forum.opnsense.org/index.php?topic=36139.0
I believe Protectli machines are made in PRC as well but you get better warranty, support and product is more consistent but you pay quite a bit more for similar features. There are lots of posts here that give you some idea of the manufacturing quality control of PRC companies selling on Ali Express e.g.: https://forum.opnsense.org/index.php?topic=41232.msg203797. Some people appear to buy these units and have great success and others have problems. You roll the dice...
The Taiwanese companies mentioned previously (GigaIPC, Jetway, AAEON) may also manufacture in PRC but to ISO manufacturing standards. They appear to be mostly making industrial PCs to sell to businesses rather than consumers and people who are happy to tinker. But again, you are likely to pay more. And they are slower to bring latest and greatest low-power CPUs to market compared to PRC companies selling on Ali Express and elsewhere.
You have to decide what trade-off is right for you in terms of CPU performance/features -- manufacturing quality/reliability/support -- cost.
A thought on heat issue: I installed an NVMe drive on my last machine. Faster but I think the extra speed is unnecessary for this application and likely generates more heat than other storage options.
You're right—once I started considering older CPUs beyond the N95/97/100/200, a lot more devices became available. Given the downclocking issues with the N100 on BSD, those older models might actually be more power-efficient and generate less heat, even if they have a higher TDP (10W vs. 6W for the N100).
Regarding brands: I want a device that's stable and reliable for years, so I'm avoiding no-name brands. It's also important to me that others have already installed OPNSense on the device and documented their experiences. This rules out many industrial PC brands, as they don't have a large home user base or community support. As an Apple user, I'm also not familiar with BIOS configurations, so I prefer something that doesn't require too much tweaking.
I also noticed that some Mini PCs have COM ports that aren't compatible with macOS, and this isn't always clearly mentioned. To avoid running into this problem, I prefer to choose a product that explicitly states compatibility with macOS.
When it comes to brands, Deciso might be great, but their devices are too expensive for me (>500 EUR). So, I'm leaning towards Protectli, specifically the V1210 (2 ports, 4GB RAM) or V1410 (4 ports, 8GB RAM). These seem to be the successors to the FW2B/FW4B/FW4C models.
I'm still undecided on whether 4GB or 8GB RAM is necessary and if 2 or 4 ports will be sufficient. And if I need a storage NVMe or if the on-board 32GB eMMC is enough for OPNSense with ad-blocking and VPN. I don't plan to log anything.
I don't have a backup internet connection, so I'm thinking 2 ports might be enough (WAN + LAN, with a switch connected to the LAN port), but I want to make sure I'm not overlooking anything critical.
One challenge I've faced is finding specific hardware requirements for OPNSense in a home setup. There's limited information available for this kind of environment, which makes the decision-making process a bit tricky.
This will be my first time setting up a dedicated firewall, as I've been relying on my Linksys Velop for routing. The main reasons I'm making the switch are to run an adblocker and to set up a VPN that allows me to securely route my internet traffic through this device when I'm using a public Wi-Fi hotspot.
Overall, I'm hoping for a setup that will just work without issues. It's bad enough when my internet provider is down; I don't want to add more downtime due to problems with the firewall or router. Especially as other family members cannot fix these issues at all.
Again, thanks to everyone for the valuable insights shared in this thread. I really appreciate it!
I'd go with the 8GB of RAM model. Default install now uses ZFS and it will use the extra memory if it is available. My system is currently using about 6GB. And you want to use ZFS so you can use bectl.
I would suggest also looking at some of the AMD powered systems, they do seem to work fine. OPNsense hardware is AMD x86_64 based. When you can get them cheap, the HP t740 with a network card works pretty well, I ran my system at work on one of these for several months until I could free up a rack mount Xeon E3-1230v5 system for the permanent firewall. Both the T740 and the rack mount are 4c/8t and seem to always have processor available, which is just where I want it. Suricata, Crowdsec, Zenarmor free version all running through an intel i350 made by 10GTek (some different components). So far, so good.
I will go against recommendations and say that you should have 16gb of ram, yes you might have a bunch "wasting" away unused, but when you get into these soldered down ram mini computers, there is no upgrade.
If you find a nice 6c/12t or 8c/16t fanless system that doesn't cost much, let me know because I think I may need to sell my XCP-NG lab (4 HP DL360 gen8 servers) and build something more compact, less power/heat/noise. Because I need 3 and a NAS, I need to keep the cost down as far as possible. XCP-NG prefers 4 threads for system work, which doesn't leave a lot of threads for the VMs. Yes off topic, but help would be appreciated.
@Greg_E You might find something on https://mitxpc.com/
Quote from: qarkhs on August 28, 2024, 03:36:49 PM
I'd go with the 8GB of RAM model. Default install now uses ZFS and it will use the extra memory if it is available. My system is currently using about 6GB. And you want to use ZFS so you can use bectl.
Indeed, having a snapshot I can roll back to might come in very handy if I encounter issues.
Is the on-board 32GB eMMC sufficient for installing OPNsense with plugins/services like OpenVPN/WireGuard, AdGuardHome/Zenarmor, CrowdSec, or will I need an NVMe drive? I don't plan to log any traffic. Thanks!
ZFS puts a comparably high write load on the device, which if I am not mistaken eMMC is not really designed for. I'd use a 250 G NVMe SSD with a high TBW value like the old but reliable Samsung 970 EVO Plus. Or one from Transcend - make sure to check the TBW (Terabytes Written) numbers when shopping.
If you have enough RAM, can't you use a ramdisk to cut down on the number of writes?
But why care if you can get a device with 150 TBW at less than 60€?
True enough, besides if you get a high write drive, then the logs don't evaporate when the system reboots.
Thanks, everyone! I just ordered a Protectli V1410 (4 x Intel 226 NICs, 8GB) with a 250GB NVMe for 375 EUR. I'm hoping this will be solid firewall hardware for the next few years.
Honestly, I'm a bit nervous about setting up OPNsense since it's my first time and I'm not sure what issues I might run into. I'll need to start with the basics, like how to access a COM port from macOS, how to use dd to create a bootable USB installer, and even which CAT cables I should buy. But I really appreciate this community and trust that I'll find the help I need if I get stuck.
There are many GUI methods to making the bootable drive, pretty sure they are listed in the getting started document.
Connect a monitor and keyboard (VGA image) to that device when you are working on it, there's your console. If not then the serial image might have SSH running and you could SSH into the device, I'd need to check the documents to be more confident on this option.
And play with it, the more you work on it, the more confidence you'll get. Don't be afraid of breaking it, the hardware will survive and the worst you'll need to do is load the OS again. There should be no circumstance where any living creatures will get harmed during your setup or configuration. If you run into a problem, connect your old system, jump online, and come ask a question.
Quote from: Greg_E on August 30, 2024, 03:29:53 PM
Connect a monitor and keyboard (VGA image) to that device when you are working on it, there's your console. If not then the serial image might have SSH running and you could SSH into the device, I'd need to check the documents to be more confident on this option.
All I have is a MacBook Air, no external keyboard or screen. The Protectli comes with a USB-C console cable, so I'm hoping iTerm, Warp, or Terminal on my Mac will let me do everything I need, like pressing F-keys to get into the BIOS and choose the boot disk. It's probably straightforward, but it's all new to me.
Quote from: Greg_E on August 30, 2024, 03:29:53 PM
And play with it, the more you work on it, the more confidence you'll get. Don't be afraid of breaking it, the hardware will survive and the worst you'll need to do is load the OS again. There should be no circumstance where any living creatures will get harmed during your setup or configuration. If you run into a problem, connect your old system, jump online, and come ask a question.
Once I set up the firewall, I'll need to switch my Linksys Velop Mesh from router mode to bridge mode. The tricky part is, I can't test if the firewall is properly configured until I make that switch. Only then can I connect my MacBook Air or iPhone to check if I can access the internet. If I mess up the OPNSense setup, I'll have to use my iPhone as a hotspot to troubleshoot. Since the Velop doesn't save settings when switching modes, there's no easy way to revert to router mode and bypass the new OPNSense firewall.
With two people in my household relying on the internet for their home office work, any downtime would be a problem. I'm really hoping to have everything up and running in one (long) evening.
The port on the protectli might do what you need, I've never used that device. But if it is like the network switches, you should be fine.
@aleco
Home Network Guy has a lot of useful guides. Maybe start here: https://homenetworkguy.com/how-to/install-and-configure-opnsense/
This was from 2 years ago so some parts may be a little dated (e.g. ZFS is now the default install).
QuoteAll I have is a MacBook Air, no external keyboard or screen. The Protectli comes with a USB-C console cable, so I'm hoping iTerm, Warp, or Terminal on my Mac will let me do everything I need, like pressing F-keys to get into the BIOS and choose the boot disk. It's probably straightforward, but it's all new to me.
yes, that is how it works. not sure if iTerm can do it bu cu will. I'm almost sure.
The key for the preparation is to map your equipment with a diagram. Pen and paper. You also need to know how your ISP requires you to dial and authenticate. PPoE creds, VLAN on WAN, that sort of thing.
What about running PuTTY? While this link assumes SSH, you should be able to use a serial connection with PuTTY as well https://www.ssh.com/academy/ssh/putty/mac
Can you install Minicom (apparently yes with homebrew https://www.ssh.com/academy/ssh/putty/mac ), I like this for serial port work on a linux device, but PuTTY also works on Linux.
On Windows I like Teraterm for serial and SSH, just something I used when XP or 95 shut down the built in serial terminal and I had to make a change. So yes a long time ago. But I can navigate PuTTY on Windows as well. And the Windows 11 Terminal application works for a lot of things and I'm becoming happy with it (you can add bash to it if you want).
My actual OPNSense is a Fujitsu Futro S920 Thin Client with 8G Ram and upgraded with a quad GiG Intel PCIeX4 low profile card. (you may only use a dual card or single) All you need extra is a PCIe 90° PCI Riser or cable. Get rid of the internal speaker and the quad card fits perfect.
The AMD GX-415GA 4c does well. Only the onboard disk-on-module is a bit slow, but its on of the cheapest fanless gear you can get.
In use here with that unifi wifi stuff and a 400/200MBit ftth connection
Works great imo.
A step up from that Fuji would be an HP T620 which has the 420 processor in it and room for a quad port card without removing anything. That said, these T620 seem to still fetch a pretty good price, good enough that if you wait you can grab an HP T740 for the same price and have newer, faster, and probably less power draw. I don't have a power meter to measure the difference in power.
Anyone reading this and buying a T740 should search the forums for an error you will get while installing. This is a BSD error, not an OPNsense error. There is a post detailing what you need to do to work around this problem.
I am currently testing the Asus NUC 13 rugged x7425E with 16 GB RAM. It is a well balanced device made for 24/7 operations that is relatively cheap (~350-400$ with RAM).
https://www.asus.com/displays-desktops/nucs/nuc-kits/asus-nuc-13-rugged/
So far it has been working well since a day and I expect it to continue ;-)
Quote from: binaryanomaly on September 08, 2024, 09:12:33 AM
I am currently testing the Asus NUC 13 rugged x7425E with 16 GB RAM. It is a well balanced device made for 24/7 operations that is relatively cheap (~350-400$ with RAM).
Thanks. I still have the NUC 13 Rugged Short (with Intel N50) on my short list. Even if the N50 is just a binned N100 with only 2 cores active instead of 4 it should be fast enough for various applications.
<<Removed>>
Edit: There seem to be NUC13 rugged stability / performance issues. https://forum.opnsense.org/index.php?topic=42296.0
I ended up purchasing a Protectli V1410 with an N5105 CPU, 4x Intel NICs, 8GB RAM, passive cooling, and a USB-C COM port. It is their most affordable and newest 4-port model.
I chose Protectli over Aliexpress brands because I trust their reputation, appreciate the support, and value that it's designed for 24/7 operation. The downside is the soldered RAM – 8GB feels limiting, and the 2-port V1210 only comes with 4GB. I'm holding out for future models with more RAM and newer CPUs (Intel N95/N97/N100/N250), as I'm aiming to set up a compact home server for Proxmox.
Interestingly, they recently pulled the 6-port V1610 from their website, even though it was just released.