Hiya, looking the a firewall for my homelab, mostly to experiment but also for a added layer of security. There are just two of us in this household with a few laptops, phones and my servers, so nothing much. Therefore looking for something affordable and not “overkill”.
Anyone got any recommendations for this? Also how do you run your opensense/pfsense instance?
Appreciate any tips!
You don’t mention your throughput requirements. How fast is your internet connection? Will you be a VPN server and/or VPN client? A reverse proxy? All that adds overhead but really not that much compared to other services. It just changes your requirements as to how many years obsolete your hardware can be.
Generally, whatever desktops or laptops businesses are throwing out in the trash will be more than enough.
If you have a managed network switch or one that can do VLANs, a router on a stick will work fine, especially if your Internet connection isn’t more than half the speed of your server’s network card. A repurposed laptop is perfect for this, because it has a built-in UPS and console!
I’ve got a 13-year-old server handling my 300Mbps internet connection, Wireguard, reverse proxy, and other stuff. It used to handle a backup internet connection, too. It’s regrettably on pfSense and I’m trying to migrate it to opnSense but my setup isn’t exactly by the book. I put stuff that’s supposed to go out over VPN on a separate VLAN and I give them a separate OpnSense router running in a VM so there’s much less chance of leakage.
One thing I did learn the hard way is that a lot of consumer “smart” devices wrongly assume to be on the same broadcast domain as any servers, clients, or peers they talk to, so even with avahi handling relaying between VLANs, they won’t work. It’s annoying having to move your dishwasher off the IoT VLAN just to make it work.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters AP WiFi Access Point ARP Address Resolution Protocol, translates IPs to MAC addresses DHCP Dynamic Host Configuration Protocol, automates assignment of IPs when connecting to a network IoT Internet of Things for device controllers NAT Network Address Translation NUC Next Unit of Computing brand of Intel small computers SBC Single-Board Computer SSD Solid State Drive mass storage Unifi Ubiquiti WiFi hardware brand VPN Virtual Private Network
10 acronyms in this thread; the most compressed thread commented on today has 12 acronyms.
[Thread #38 for this comm, first seen 3rd Jul 2026, 08:50] [FAQ] [Full list] [Contact] [Source code]
i bought a intel n100 board with used 4gb of ram and an used ssd. then i bought 1 nic with poe for the wan (5g antenna with integrated modem) and second nic for a dmz.
also i tried opnsense but switched to ipfire, because it offers all i need in a much simpler package.
cost was arround 300€. tbh i would just buy a simple mini pc with enough nics, but couldnt find one with poe to a good price.
Take a sophos second hand FW.
Intel nic, low power consumption processors and full opnsense support.
Go at least for 4gb ram and the most powerful processor you can safely get. It will come with a lot of eth ports too on top.
And it will cost close to 100€, probably less if you struck a good deal
Good shout, on our second hand market there is currently a Sophos SG-115 for sale for 100ish euros. It includes an AP 55C and a Unifi poe adapter. Doesnt seem too bad a deal to me. What do u think?
Which hw revision?
If it is a ver3 it is the same I have, good for FW and red services, you can make complex setups.
It is a bit short on cpu for ips systems(suricata and zenarmor) , but it is able to do dns filtering via adguard or unbound.
100€ sounds good to me if it comes with AP, people here are happy with that brand
Good luck
Looks to be the second revision.
Try to find a rev3, the cpu upgrade really is really worthy
Nowadays I think most homelabbers are buying those n150 mini PCs from AliExpress. Specifically for opnsense
@bytepursuits @selfhosted I’ve tried one mini-pc about 10 years ago; what a disappointment! It was a small jewel, touching it. It ran Win10, 64GB hard disk. For a couple years it has been my emergency portable aid - I installed NVDA (non visual desktop access) screen reader in it, as JAWS for Windows, the commercial one, is very heavy. So, after a few updates from Win10, this poor machine literally became so, so slow. And, hot. It seemed to have a little oven in my hands.
Now, I don’t find anything interesting; those machine, low-priced, sold in extra-EU e-commerces, don’t seem trustworthy. The second one I bought was bigger, about the size of an iPad mini. But it arrived with broken LCD screen. As a blind user, I was relying just on audio. But in the end, gearbest said “you have broken it” - money thrown in the toilet.
Yes don’t buy their expensive hardware is whet I recommend. It’s not worth it.