OPNsense itself is light — the official minimum is modest. What actually decides your hardware is what you ask it to do: plain gigabit routing is easy, but VPN tunnels and intrusion detection eat CPU. Here is how to size the box honestly, without overspending and without buying the one part that causes all the trouble.
Most OPNsense regret is a hardware story, not a software story. People install it on something with a single network port, or on ports with poor FreeBSD drivers, and then blame the firewall for drops that were never its fault. This guide walks through each part — CPU, RAM, storage, and above all the network cards — using the official OPNsense guidance as the base and real-world behaviour as the judge.
Plain routing and firewalling at gigabit speed does not need a powerful CPU; almost any dual-core chip from the last decade manages it. The honest exceptions are the features that inspect or encrypt traffic. Intrusion detection (Suricata) reads every packet and costs real CPU, and VPN throughput depends heavily on single-core speed and whether the chip supports AES-NI encryption acceleration. If you plan a fast WireGuard or OpenVPN tunnel, buy CPU headroom, not more cores.
The firewall itself uses little memory, but the state table (one entry per live connection), logs, DNS cache and add-ons all live in RAM. 2 GB works for a basic setup; 4 GB is the sensible minimum to buy, and 8 GB gives intrusion detection, reporting and growth plenty of room. More than 8 GB is wasted on almost every home and small-office setup — spend the money on better network cards instead.
OPNsense is FreeBSD underneath, and FreeBSD loves Intel network chipsets (the igb, em and igc driver families) and is famously grumpy with many cheap Realtek ports, which can stall or drop under load. This one choice decides whether your firewall feels invisible or haunted. If your PC has only Realtek ports or a single port, adding a genuine Intel dual-port PCIe card is the classic fix. USB Ethernet adapters work for testing, but a loose USB cable should not be the thing your whole network depends on.
Install on an SSD — 40 GB is plenty, 120 GB if you keep long logs. SD cards and cheap USB sticks wear out under firewall logging; OPNsense can log to RAM to protect weak media, but a small SSD removes the worry. Form factor is about your life, not performance: a fanless mini PC is silent and sips power, a tower is cheaper and noisier. Whatever you choose, the box runs all day, every day — put it somewhere ventilated, ideally on a small UPS so a power blink does not corrupt a write.
See the hardware running in the video and watch the full OPNsense setup performed on it, step by step.
▶️ Watch Full VideoNot practically. OPNsense is built for 64-bit x86 hardware, and ARM support is not an official install path. Use a small x86 mini PC instead — they are inexpensive, silent and have the two proper Ethernet ports a firewall needs.
Technically yes — one port can carry WAN and LAN as separate VLANs through a managed switch, the so-called router on a stick. It works, but it halves the port's bandwidth between the two sides and makes setup and troubleshooting harder. For a first build, two physical ports are strongly recommended.
A fanless mini PC typically draws roughly 6 to 15 watts, similar to a normal router. An old desktop can draw 40 to 80 watts or more around the clock, which adds up over a year of 24 by 7 running. If you are reusing an old PC, measure it before deciding it is the cheap option.