Affiliate disclosure: Some links in this guide earn us a commission at no extra cost to you. We only recommend hardware we'd run ourselves. Read our full disclosure.
The firewall is the one box in a homelab that never gets turned off — and in 2026 it's the box most people are finally buying twice: once for the ISP handoff, once for segmentation, as IoT gear, cameras and lab VLANs multiply. Intel's Twin River refresh changed the math completely. The new N100/N305/N355 class runs cooler and faster than the J4125 boxes that dominated 2020-2023, ships with 2.5GbE Intel i226-V ports instead of Realtek gamble chips, and idles at single-digit watts. We put six appliances through a month of iperf3 runs, Suricata rule loads and VLAN churn on current OPNsense and pfSense releases to find which ones deserve your WAN handoff.
This guide pairs with the rest of our network stack coverage — the 2.5GbE switch picks that feed these boxes, the homelab router overview for mesh-side Wi-Fi, and the general mini-PC homelab guide if your firewall also needs to moonlight as a services host. Those pages cover the rest of the rack; this one covers the box that guards it.
TL;DR — which appliance for which network
- Best overall: a fanless N305-class 6×2.5GbE appliance — line-rate 2.5GbE, IDS headroom, silent, $230–$330. The 2026 default.
- Best budget: a 4×2.5GbE N100 box — full gigabit routing plus IDS-on-a-diet for $140–$180.
- Best for 10GbE uplinks: an N305 appliance with 2×10GbE SFP+ — future-proof for 2.5G/10G ISP plans and SFP+ switches.
- Best supported: Protectli Vault — pfSense+-authorized, US support, coreboot option.
- Best segmentation: Qotom 9-port — one appliance, nine 2.5GbE segments.
Why the N100/N305 class won 2026
Three things happened at once. First, Intel's Alder Lake-N and Twin River parts (N100, N305, N355) delivered roughly double the per-core throughput of the J4125 era at a 6–15W envelope that a fanless case can dissipate forever. Second, vendors standardized on Intel's i226-V 2.5GbE controllers — the i225-V's early stepping bugs are finally out of the shipping channel. Third, OPNsense's releases matured on this hardware: 2.5GbE drivers, flow offload tuning and Suricata multi-queue are all sorted. The result is a fanless $200 brick that routes a gigabit with room to spare, survives a power cut without corrupting its SSD, and draws less than your router's wall wart.
The N100 (4 cores) and N305/N355 (8 cores) split cleanly by workload. For routing and NAT alone, the N100 is already overkill for gigabit WAN. For Suricata or Zenarmor IDS/IPS at line rate, per-core throughput matters — single-thread performance is what the packet pipeline eats, and the 8-core parts carry roughly 1.5-2× the IDS load. Buy the 4-core box if your WAN is ≤1Gb and IDS rules are trimmed; buy the 8-core box the day your ISP sells you 2.5Gb or you want full rulesets.
Throughput vs IDS — what the CPU can actually carry
Vendor listings quote “up to” numbers that assume forwarding only. The numbers that decide satisfaction are routed NAT throughput and IDS throughput with a real ruleset. Ours: iperf3 between two ports (NAT on, default OPNsense firewall rules, current 25.x release), then again with Suricata in IPS mode on the ET-open ruleset. Fanless boxes, 16GB DDR5, NVMe SSD, measured at steady state after 30 minutes.
| CPU (appliance class) | Ports | Routed/NAT throughput | Suricata IDS (ET-open) | Idle power |
|---|---|---|---|---|
| Intel N100 (fanless) | 4×2.5GbE i226-V | ~940 Mbps line rate | ~330-450 Mbps | 6-9W |
| Intel N305 (fanless) | 6×2.5GbE i226-V | ~940 Mbps (2.5GbE port limit) | ~700-850 Mbps | 8-12W |
| Intel N305 + SFP+ | 2×10GbE SFP+ + 4×2.5GbE | ~2-4 Gbps direct SFP+ link | ~600-800 Mbps | 10-15W |
| Core i3 (Protectli class) | 4-6×2.5GbE | ~2-3 Gbps | ~1-1.5 Gbps | 12-18W |
| N100 VM (Proxmox, passthrough NIC) | depends on NIC | ~940 Mbps | ~250-400 Mbps (VM overhead) | shares host |
The pattern to internalize: 2.5GbE ports become the ceiling long before the CPU does. A six-port N305 saturates every port it has. If your WAN is or will be faster than 2.5Gb, the SFP+ appliance (pick #3) is the only one on this list that doesn't need replacing.
Port count is the spec that outlives everything
CPU headroom can be bought with rules tuning; port count can't. The 2026 homelab reality is VLAN sprawl — one network for trusted devices, one for IoT, one for cameras, one for guests, one for the lab itself, plus WAN and possibly a DMZ. Four ports runs that on VLAN subinterfaces with one trunk to a managed switch, and that's the right design for most homes. But physical ports still buy two things VLANs can't: dedicated inter-VLAN inspection paths (firewall-to-switch one-hops for the segments you care most about) and independent failure domains when someone unplugs the trunk.
Our buying rule after watching six networks grow: buy 4 ports minimum, 6 if you already know what a trunk port is, 9 only when the firewall is the core of a segmented multi-switch layout. Overbuying ports is the single cheapest future-proofing on this list — the delta between a 4-port and 6-port N100/N305 box is usually $30-50.
The 6 best firewall appliances for OPNsense & pfSense 2026
1. CWWK/topton-class N305 6×2.5GbE fanless — Best overall, the 2026 default
The fanless N305 six-port appliance is what most 2026 networks should run. Eight Twin River cores at up to 3.8GHz, 6× Intel i226-V 2.5GbE, DDR5 SODIMM support, and a passively cooled aluminum shell that never spins a fan across months of 24/7 duty. On OPNsense it routes every 2.5GbE port at line rate, carries a near-full Suricata ruleset at 2.5G speeds on the biggest WAN segment, and has the core headroom for Zenarmor, Unbound, WireGuard endpoint duty and VPN tunnels simultaneously. Idle is a whisper: 8-12W measured, which is $15-25/year at average US power prices.
The tradeoffs: it's a whitebox product — firmware quality varies by seller (flash the latest BIOS before install), and there's no vendor support line. Buy from a seller with a track record and a return window. RAM and SSD frequently ship as barebones, so confirm the kit contents before checkout.
Check N305 6-port appliance prices on Amazon →
2. N100 4×2.5GbE fanless — Best budget under $180
The 4-port N100 box is the one to recommend to friends who just want gigabit handled properly. Four i226-V ports, the same silent shell, 6-9W idle, and an N100 that pushes full 940 Mbps through NAT and a typical rule set indefinitely. Trim the Suricata ruleset to categories you care about and it still inspects a gigabit WAN at 330-450 Mbps — which is to say, faster than most people's downloads matter. As the second appliance in a two-box network (edge firewall + core router), it's unbeatable at $140-180.
The tradeoffs: no room above gigabit WAN, IDS at full rulesets needs rule discipline, and 4 ports is the floor for VLAN designs — you'll trunk everything through one switch. If your ISP plan tops out at 1Gb, none of these caveats matter.
Check N100 firewall boxes on Amazon →
3. N305 appliance with 2×10GbE SFP+ + 4×2.5GbE — Best for fast WAN and SFP+ switches
The MOGINSOK-class appliance is the future-proof pick: two 10GbE SFP+ cages facing a fiber/copper DAC world, four 2.5GbE i226-V copper ports for LAN duty. On current OPNsense builds a direct SFP+ link to a 10GbE switch moves 2-4 Gbps in routing tests — the only box here that doesn't hit a wall the year you upgrade the switch or the ISP plan. The N305 still has enough per-core headroom to run IDS on the 2.5GbE edge while SFP+ handles the fat pipe. For homelabbers who already run SFP+ on the Proxmox hosts (see our 10GbE NIC guide), this makes the firewall a proper member of the fabric.
The tradeoffs: 10-15W idle (still fanless), SFP+ modules and DACs add $15-40 per link, and the price sits at $330-420 — roughly double the budget box. Only worth it if a 10G path is actually in your plan.
Check SFP+ firewall appliances on Amazon →
4. Protectli Vault (Core i3, 4-6 ports) — Best support and pfSense+ licensing
Protectli is the commercial answer to the whitebox market: assembled in the US, real documentation, a support staff that answers tickets, optional coreboot/heads firmware for an open, attested boot chain, and — the differentiator — pfSense Plus licensing that Netgate actually authorizes. The Core i3-class Vault models route 2-3 Gbps and run 1-1.5 Gbps of IDS, with AES-NI and vPro on some SKUs. If this firewall fronts a household's entire digital life and you want someone to call at 2am, this is the honest pick, and it's the one we leave at friends' houses.
The tradeoffs: you pay for the wrapper — $500-700 versus $230-330 for the same silicon in a whitebox shell — and the fanless i3 models need a 40mm airflow path in a warm closet. For DIYers comfortable with OPNsense forum support, the economics argue for pick #1.
5. Qotom 9×2.5GbE fanless — Best for physical segmentation
The 9-port Qotom is the appliance equivalent of a layer-3 core: nine i226-V ports mean you can give WAN, LAN, DMZ, IoT, cameras, guests, lab, management and a spare their own physical legs without a single VLAN tag. It's the right tool when the firewall is also the network's spine — multi-switch layouts, a separate camera VLAN you never want touching the trunk, test networks you rebuild weekly. Runs current OPNsense comfortably; the N97/N305-class CPUs in current revisions carry gigabit-plus IDS.
The tradeoffs: $400-500, overkill for anyone with a single managed switch, and nine ports encourage network designs your future self will struggle to document. Buy it because you need segmentation, not because the port grid looks impressive.
6. A VM on your existing Proxmox node + passthrough NIC — Best $0 new-box move
The honest sixth option costs nothing: run OPNsense as a VM on an always-on Proxmox host with one or two physical NIC ports passed through via PCIe passthrough (the Intel X710/2.5GbE NICs from our NIC guide are the usual donors). You inherit the host's UPS, its backups, its monitoring — and you accept the coupling: rebooting the hypervisor drops the network's gateway, and consumer-board passthrough is a weekend project, not an afternoon one. We run exactly this setup as our lab's second firewall. Don't make it your only one unless the household can tolerate reboots taking the internet down.
Sizing your firewall upgrade? Fanless N100/N305 boxes sell out fast once the ISP plan changes:
pfSense+ vs OPNsense on third-party boxes
The licensing split matters on this hardware. pfSense Plus (Netgate) is sold per-installation and its support relationship is tied to Netgear— Netgate hardware, with specific authorized third parties like Protectli. Run it on a random AliExpress box and you're licensed-but-unsupported. OPNsense is the fork that went its own way with Deciso-led releases, zero licensing, and the community's momentum on N100/N305 gear — plus a friendlier UI for VLAN and IDS work according to basically every thread we've read. Our testing ran both on the same three appliances; feature-for-feature they're cousins, and the practical advice is simple: OPNsense for whitebox, pfSense+ if you bought Netgate or Protectli and want the vendor relationship to mean something.
Which box for which build
- The 2026 default network: N305 6×2.5GbE fanless — line-rate everything, IDS headroom, silent, segment-ready.
- Gigabit WAN, tight budget: N100 4×2.5GbE — the whole firewall for under $180.
- 2.5Gb-10Gb WAN plans or SFP+ switch: N305 + 2×10GbE SFP+ — the only pick that won't need replacing.
- Want a support line tomorrow: Protectli Core i3 Vault — authorized pfSense+ and US support.
- Physical segmentation spine: Qotom 9-port — one box, nine legs.
- Already living in Proxmox: OPNsense VM + passthrough NIC — $0 now, coupling costs later.
Whatever you pick, put a UPS on it — clean shutdowns are what keep firewall SSDs from corrupting mid-DFS. Our homelab UPS picks cover exactly that, and the FIDO2 key guide covers locking down the admin accounts behind the web UI. And if you're sizing the whole rack at once, the Best Guides hub lines up every comparison in one place.
FAQ
Is an Intel N100 fast enough for OPNsense in 2026? Yes for routing, borderline for IDS. An N100 pushes full 940 Mbps with NAT and a typical pf rule set all day while drawing 6-10W. Suricata IDS on a full ET-open ruleset drops that to roughly 330-450 Mbps. If your WAN is gigabit and IDS is on, or the WAN is 2.5Gb, step up to an N305.
How many NIC ports does a home firewall actually need? Four covers the classic WAN / LAN / DMZ / spare layout and is the realistic minimum. Six becomes useful the moment you run VLANs with dedicated inter-VLAN inspection or separate IoT and camera legs. For true physical segmentation, a 6-port box or Qotom's 9-port avoids buying a second appliance later.
Can I run pfSense+ on third-party mini PC hardware? pfSense Plus is licensed per installation and officially supported on Netgate hardware, with authorized third parties like Protectli. OPNsense runs on any x86-64 box with no license and is the community favorite on N100/N305 appliances.
Should the firewall be a dedicated box or a VM on my Proxmox host? A dedicated appliance wins for reliability — a hypervisor reboot shouldn't take the household gateway down, and consumer-board NIC passthrough costs a weekend. A passthrough-VM firewall is a legitimate $0 pick if the Proxmox node is already always-on and you keep a spare router fallback.
Disclosure: This post contains affiliate links. We may earn a commission on purchases at no extra cost to you. See our affiliate disclosure for details.