Untangle is software, so the hardware decision is yours — and it decides whether your free firewall flies or crawls. Two network cards, a healthy disk and honest sizing: here is the full hardware truth before you install.
Most failed firewall projects fail on hardware, not software. Someone installs on a PC with one network card, or on a disk that was already dying, and blames the product. This page walks through what an Untangle box actually needs — the two NIC rule, realistic old-PC sizing, and the throughput check almost nobody does.
A gateway firewall physically stands between the internet and your office. Traffic enters on one network card and leaves on the other, and the firewall inspects everything in between. With a single network card there is no "in between" — the box can only watch traffic, not control it. So the spare PC you pick must have two Ethernet interfaces: the onboard port plus one PCI or PCIe network card, which is cheap and takes five minutes to fit. Virtual setups are the one partial exception — a hypervisor can present two virtual NICs — but the physical host still needs two real ports or a managed switch with VLANs, which is advanced territory.
The video makes the point that you do not need a new server — a retired office PC is the classic Untangle host. Judge it by workload, not age. A dual-core or better CPU from the last decade handles the free core apps for a small office comfortably. Where old PCs fall short is usually the disk: a dying mechanical hard drive makes reports slow and is the first thing to fail, so an inexpensive SSD is the single best upgrade. RAM is the second consideration — the base system is light, but every app you switch on (intrusion prevention, virus blocking, reporting history) eats memory, and the more users you have, the more sessions it tracks. If the video's suggestion of a well-specced spare machine sounds generous, it is really insurance for running many apps at once.
Your internet connection speed sets the bar. A firewall inspects every packet, so a weak CPU or a cheap low-quality network card can turn a 300 Mbps connection into 120 Mbps at the desk. Intel-chipset network cards have the best driver support and offload work properly; no-name cards often become the bottleneck on fast fibre plans. The honest approach: reuse the old PC, but before you declare victory, run a speed test through the firewall and compare it with a direct connection. If the firewall halves your speed with your chosen apps on, the hardware — not the software — is your limit.
An old desktop tower running 24x7 uses far more electricity than a small dedicated appliance, runs a fan all day, and its power supply is usually the oldest part in the box. For a home lab or a first firewall that cost is acceptable and the learning is worth it. For a permanent office install, do the simple maths: months of extra electricity plus one fan or PSU failure at the worst moment often costs more than expected. Many offices start exactly this way — old PC first, prove the value, then move the same configuration onto a small low-power box later. That path is completely legitimate.
See the firewall in action in the video, then spec your box with this checklist.
▶️ Watch Full VideoNot as a gateway firewall. It needs two interfaces — one facing the internet, one facing your LAN — because all traffic must pass through it. A single-NIC machine can only run in limited monitoring roles. Adding a second PCI or PCIe network card to a desktop is cheap and is the correct fix.
The free core runs on a few GB, but every extra app and every extra user adds load. A small office is comfortable with modest RAM; if you plan to run intrusion prevention, virus blocking and long report history together, give it more. Check Arista's current hardware guide for your user count before finalising.
It can. Firewall inspection costs CPU, and cheap network cards throttle fast connections. After installing, compare a speed test through the firewall against your raw connection speed. A big drop with your apps enabled means the hardware is the bottleneck, not the connection.