Best Hardware for pfSense and OPNsense
For most homelabs, buy a small fanless mini firewall: an Intel N100 or N150 box with four to six Intel i226-V 2.5-gigabit ports, the kind CWWK, Topton, and Qotom sell for $150 to $280. It is silent, idles under ten watts, routes well past gigabit with packages running, and has the one thing that actually matters, real Intel NICs. Buy a Protectli Vault instead if you want a US company and coreboot behind the same idea, or a Netgate appliance if you want pfSense Plus and a support number to call. Build or repurpose a PC only if the parts are already sitting in a drawer. pfSense and OPNsense run on the same x86 hardware, so everything here applies to both; the [pfSense vs OPNsense](/compare/pfsense-vs-opnsense) comparison covers which software to install on it.
Updated 2026-10-22 · by Jonathan Caruso
This page has affiliate links, so HomelabCompass may earn a commission at no cost to you. As an Amazon Associate, HomelabCompass earns from qualifying purchases. It never changes a verdict. How the site is funded
Top pick
Fanless mini firewall (CWWK, Topton, Qotom)
A fanless N100 or N150 mini firewall is the right box for almost everyone. For $150 to $280 you get a modern quad-core Intel CPU with AES-NI, 8 to 16 GB of RAM, an NVMe or mSATA slot, and four to six Intel i226-V 2.5-gigabit ports, all in a passively cooled case that pulls six to ten watts. That is enough to route a gigabit or 2.5-gigabit internet connection with pfBlockerNG or Suricata running and never hear it. The NICs are the reason to buy this shape over a random mini PC: the i226-V uses Intel's igc driver, which pfSense and OPNsense support in the base system, so you skip the Realtek headaches entirely. You give up a warranty worth much and a company to call, which for a box that lives in a closet is a fair trade.
The options
Fanless mini firewall (CWWK, Topton, Qotom)
New, roughly $150 to $280 with RAM and an SSDA small passively cooled x86 box built for routing: an Intel N100, N150, or i3-N305 with several Intel 2.5-gigabit ports, sold under names like CWWK, Topton, and Qotom.
Visit Fanless mini firewall (CWWK, Topton, Qotom) site- Runs on
- Intel N100/N150/i3-N305, 8 to 16 GB DDR4 or DDR5, NVMe or mSATA, four to six Intel i226-V 2.5GbE ports, fanless; some add SFP+ cages for 10-gigabit
- Pick it if
- You want the most firewall per dollar with real Intel NICs and no fan noise. The default pick for a home or small-office firewall.
Protectli Vault
New, roughly $250 to $700 depending on CPU and port countA fanless firewall appliance from a US company, with Intel NICs and an optional coreboot BIOS. The VP series carries 2.5-gigabit i226 ports; the older FW series uses 1-gigabit i210/i211.
Visit Protectli Vault site- Runs on
- Intel Celeron or Core across the range, 4 to 32 GB RAM, mSATA or NVMe, two to six Intel NICs (i210/i211/i225/i226), coreboot option, fanless
- Pick it if
- You want the mini-firewall idea with a US company behind it, documented coreboot, and no questions about the supply chain.
Netgate appliance
New, roughly $189 (1100) to $700 (4200), direct from NetgateThe official pfSense hardware, built by the company that develops pfSense. The 1100 and 2100 are ARM; the 4200, 6100, and up are Intel x86.
Visit Netgate appliance site- Runs on
- Marvell ARM on the 1100/2100, Intel Atom on the 4200 and up, 4 to 8 GB RAM, eMMC or NVMe, Intel or onboard NICs; ships with pfSense Plus
- Pick it if
- You want pfSense Plus for free, a tuned appliance, and a vendor support contract you can actually call. The buy-it-and-forget-it option.
Used mini PC plus an Intel NIC
Used, roughly $80 to $200 for the box, plus $30 to $80 for an Intel NICA used Lenovo/Dell/HP 1-liter micro pressed into firewall duty. Most have one NIC, so you add a USB or PCIe Intel adapter, or run it router-on-a-stick off a VLAN-capable switch.
- Runs on
- 8th-gen or newer Intel with AES-NI, 8 to 32 GB RAM, NVMe; add an Intel I350-T4 card in an SFF, or an Intel-chipset USB 2.5GbE adapter on a tiny model
- Pick it if
- You already have one of these or can get one cheap, and you do not mind adding a NIC and setting up VLANs to make up for the single port.
DIY or repurposed PC with an Intel NIC
Free if you have the PC, plus roughly $40 to $150 for the NICAny spare x86 desktop or small server with a free PCIe slot and an Intel network card. The route to 10-gigabit and heavy inline filtering.
- Runs on
- Any modern multi-core x86 with AES-NI, 8 GB or more RAM, an SSD, and an Intel I350-T4 for gigabit or an X520/X710 for 10-gigabit SFP+
- Pick it if
- You want multi-gigabit routing, Suricata or Zenarmor inline at speed, or you just want to use hardware you already own.
How to choose
Size the CPU to your internet speed and your packages, not to a spec-sheet number. A fanless N100 or N150 routes a gigabit or 2.5-gigabit connection with NAT, VLANs, and a package like pfBlockerNG without breaking a sweat. The moment you want 10-gigabit routing, or inline intrusion detection (Suricata and Snort on pfSense, Zenarmor on OPNsense) running at multi-gig, step up to an Intel i3, i5, or a Xeon-D, because deep packet inspection is CPU-bound. RAM is cheap insurance: 4 GB is the floor, 8 GB is comfortable, and 16 GB is the number if you plan to run IDS or a lot of block lists. Install to an SSD, NVMe, or the appliance's eMMC, never a USB stick or SD card, because the constant log and state writes wear that kind of flash out fast. If you are going to carve the network into VLANs, plan the addressing first in the subnet calculator.
The network card decides whether the build is painless or a weekend of driver threads, so buy Intel and stop thinking about it. Intel's igb driver (i210, i211, i350) and igc driver (i225, i226) are in the FreeBSD base that pfSense and OPNsense are built on, so the ports just work. The current 2.5-gigabit standard is the i226-V, which every appliance above uses; the earlier i225 had a stepping bug that Intel fixed by its third revision, and anything shipping now is past it. Realtek is the trap: the 2.5-gigabit RTL8125 in cheap consumer boards has shaky FreeBSD support, and while OPNsense ships a vendor driver you can add, pfSense makes you fight it. Plan for at least two ports, one WAN and one LAN, and more if you run separate VLANs on physical ports or want a DMZ. For 10-gigabit, that means an Intel X520 or X710 SFP+ card, or an appliance with SFP+ cages built in.
Decide how much you want to own. A Netgate appliance is the hands-off choice: it ships with pfSense Plus for free, it is tuned for the hardware, and a support contract sits behind it, which is worth real money for a business firewall. A fanless CWWK or Protectli box is the homelab sweet spot, giving you the same silent low-power routing for less, with OPNsense or pfSense CE that you install yourself. Repurposing a PC only makes sense when the hardware is already yours, since a single-NIC micro needs an add-in card or a VLAN switch before it can be a router. Whatever the box, the software is a separate call: both are excellent, and the pfSense vs OPNsense comparison lays out the fork, while OPNsense vs OpenWRT covers the case where you would rather flash a router than run an appliance. Last thing: this box runs 24/7, so fanless and low idle watts matter more than peak speed for most people. Put real numbers on the yearly cost in the power calculator before you buy a hungry CPU you do not need.
The verdict
Buy a fanless mini firewall. An Intel N100 or N150 box with four to six Intel i226-V 2.5-gigabit ports from CWWK, Topton, or Qotom costs $150 to $280, runs silent on under ten watts, and routes past gigabit with packages going, which is the right answer for almost every home and small-office firewall. Step up to a Protectli Vault if you want a US company, coreboot, and a cleaner supply chain, and to a Netgate appliance if you want pfSense Plus for free plus a real support contract. Repurpose a used mini PC with an added Intel NIC only when the hardware is already yours, and go DIY with an Intel X520 or X710 when you genuinely need 10-gigabit. Across all of them the rule holds: Intel NICs, an SSD rather than a USB stick, and enough RAM for your packages. Pick the software in the pfSense vs OPNsense comparison, plan your VLANs in the subnet calculator, and check what the box costs to run all year in the power calculator.
What to buy
What fits the advice above. Amazon links open a search, so you can compare current models and prices.
Fanless 2.5GbE mini firewall
The default pick: an Intel N100 or N150 box with four or more Intel i226-V 2.5-gigabit ports, silent and under ten watts, that runs pfSense or OPNsense out of the box.
See it on AmazonProtectli Vault
The same idea from a US company, with Intel NICs and an optional coreboot BIOS when you want support and a cleaner supply chain.
See it on AmazonIntel I350-T4 NIC
Turns a used mini PC or spare desktop into a real router: a quad-port Intel gigabit card that pfSense and OPNsense support in the base system.
See it on Amazon
FAQ
What is the best hardware for pfSense in 2026?
A fanless mini firewall with an Intel N100 or N150 and four or more Intel i226-V 2.5-gigabit ports, from a brand like CWWK, Topton, or Qotom, for $150 to $280. It is silent, pulls under ten watts, and routes past gigabit with packages running. Buy a Protectli Vault if you want a US company and coreboot, or a Netgate appliance if you want pfSense Plus for free and a support contract.
What hardware do I need to run pfSense?
At a minimum, a 64-bit Intel or AMD CPU with AES-NI, 4 GB of RAM, an 8 GB or larger SSD, and at least two network ports, one for WAN and one for LAN. In practice buy more than the minimum: 8 GB of RAM and Intel NICs. Any mini firewall, appliance, or repurposed PC that meets that runs pfSense, and the same specs run OPNsense.
Can I run pfSense on any PC?
Almost any 64-bit PC with two network ports, but the network cards decide whether it is pleasant. Intel NICs (i210, i211, i225, i226, i350) are supported in the FreeBSD base and just work; Realtek 2.5-gigabit chips have poor support on pfSense. If your PC has a single Realtek port, add an Intel card or pick a different box.
Do I need Intel NICs for pfSense?
You strongly want them. Intel's igb and igc drivers are mature in FreeBSD, so Intel ports work with no fuss. Realtek's 2.5-gigabit RTL8125 has unreliable support on pfSense; OPNsense ships an add-on driver for it, but Intel is still the safe choice. Every appliance and mini firewall recommended here uses Intel NICs for exactly this reason.
How much does pfSense cost?
pfSense Community Edition is free on your own hardware. pfSense Plus is free on Netgate's own appliances and adds features there. OPNsense is free on any hardware, with an optional paid Business edition. So the software is free either way; what you pay for is the box it runs on.
Do I need AES-NI for pfSense?
You want it, and every CPU worth buying has it. AES-NI accelerates the encryption behind VPNs, so a WireGuard or OpenVPN tunnel runs far faster with it. pfSense recommends it and OPNsense benefits the same way. Any Intel N100, N150, Core, or Atom chip from the last several years includes AES-NI, so this only rules out quite old hardware.
What hardware do I run OPNsense on?
The same hardware as pfSense: a 64-bit CPU with AES-NI, 4 GB or more of RAM, an SSD, and Intel NICs. OPNsense is a little more forgiving about Realtek because it ships an add-on driver, but Intel is still the better choice. Any fanless mini firewall or appliance on this page runs OPNsense well.
How much RAM and what CPU for a gigabit firewall?
An Intel N100 or N150 with 8 GB of RAM routes a full gigabit, and often 2.5-gigabit, with VLANs and pfBlockerNG running. Step up to an i3 or i5 only if you want 10-gigabit routing or inline IDS/IPS (Suricata, Snort, Zenarmor) at multi-gig speeds, where the CPU is the limit. 4 GB is the floor; 8 GB is the comfortable number for most setups.