Homelab Rebuild Part 2: Hardware for the Firewall

The question Link to heading

Part 1 settled what I wanted: a dedicated firewall to take over routing, so the Banana Pi R4 could become a pure switch and access point. What wasn’t settled was the hardware.

My requirement sounded simple at first. Init7 gives me symmetric 10 Gbit here, at the same price as 1 Gbit. If I’m buying a box anyway, it should pass as much of that through as possible. On top of that I wanted to try deep packet inspection — mostly because companies run it and I want to understand how it behaves.

Before spending any money I asked on the OPNsense forum. That was the best decision in the whole project.

What I had to learn Link to heading

The answers were fairly unanimous, and they wrecked my plan.

Routing and firewalling at 10 Gbit is not the problem. Surprisingly small hardware handles it. An Intel N100 or N355 will do.

IDS/IPS at 10 Gbit is an entirely different animal. Suricata mainly needs high single-core performance, and a box that manages 10 Gbit with an active IDS and a decent rule set sits in the mid four figures. Zenarmor in its free version is single-threaded on top of that.

Then came the argument that convinced me most: most of the interesting traffic is encrypted anyway. What a layer 7 inspection sees of that is limited — unless you break TLS open. Which would mean pushing your own CA onto every device in the network, and that falls apart the moment you hit phones and IoT gear.

The recommendation instead: clean separation of less trustworthy devices, DNS blocklists, IP blocklists, plus something like CrowdSec. In other words, exactly what was already on my list.

One reply also described the knock-on effect nicely: once you have a 10 Gbit firewall, you want a 10 Gbit switch. And then you go looking for counterparties that can actually serve you that fast. It’s a rabbit hole with its own momentum.

What I dropped Link to heading

DPI and IDS as a purchasing criterion. Not as a topic — I still want to look at it later. But I’m not letting hardware selection be driven by whether I can run Suricata at line rate. That costs a multiple and delivers little against encrypted traffic.

That took the expensive appliance off the table before I’d seriously considered it.

What I didn’t do either Link to heading

The obvious conclusion would have been a small mini PC with an N-series CPU and two SFP+ ports. Available for a few hundred euros, low power draw, plenty for routing.

I decided against it anyway, for one reason: I didn’t want to close the door. If Suricata mainly needs single-core performance, then the CPU is the one thing you can’t retrofit later. An N355 would have locked me into “no IDS” permanently. A current desktop CPU leaves me the choice — even if I never use it.

There’s a second reason: a normal motherboard has a normal PCIe slot. I can swap the network card if I ever need something else. With a mini PC and soldered ports, I can’t.

The parts Link to heading

New parts came to CHF 481.45. On top of that a used network card for around 45 euros and an SSD I already had.

I didn’t need to buy an SFP module for the fibre — it was already in the R4 and simply moved over. The R4 port it used to sit in now connects to the OPNsense over the DAC cable.

Why an ancient network card Link to heading

The X520-DA2 is built on the Intel 82599. That chip is from 2009. Used cards go for 40 to 50 euros, while current 10 Gbit cards cost a multiple of that.

This isn’t a compromise, it’s the right move. With OPNsense, driver maturity matters more than chip generation. The ix driver for the 82599 has been in the FreeBSD base system forever and is thoroughly shaken out. After installation my interfaces came up as ix0 and ix1 and it just worked — no tunables, no fiddling.

That’s not a given. Dell-branded X520 cards sometimes check the vendor ID of the inserted module and refuse third-party optics or DAC cables. If that happens to you: on FreeBSD the check can be disabled with hw.ix.unsupported_sfp="1" in /boot/loader.conf. I got lucky and didn’t need it — but I’d have liked to know beforehand.

What it actually does Link to heading

Measured with iperf3 across eight parallel streams, workstation to firewall:

[SUM]   0.00-35.21  sec  38.0 GBytes  9.27 Gbits/sec  1053   sender

9.27 Gbit/s. With 10 Gbit gross, Ethernet and TCP overhead put the theoretical ceiling around 9.4 — so the firewall isn’t the bottleneck. It pulls 90 watts doing it and stays inaudible.

A note on method: eight parallel streams is deliberate. A single TCP stream rides on one CPU core and measures that core rather than the machine. Whenever you see a 10 Gbit number, ask how it was measured.

What I’d do differently Link to heading

The power supply. Measured with an inline meter: a good 50 watts idle, around 90 watts at full load (with -25 on the curve optimizer). That leaves a 650 watt unit sitting permanently at the bottom of its efficiency curve. Smaller would have made more sense — except the RMe series doesn’t go below 650 watts, and I’ve had good experiences with that series. If you take power draw seriously, look wider than I did.

No ECC. The board doesn’t support it, and I knew that when buying. For a firewall at home I consider that acceptable; the alternative was a server platform at several times the price. At work I’d decide differently.

The case is oversized. The Node 304 has six drive bays and I use one. I like the case, but a firewall doesn’t need it.

What I got right Link to heading

Asking before ordering. Without that thread I’d probably have bought a considerably more expensive appliance — for a feature I’d barely have used against encrypted traffic.

Next up Link to heading

Next comes the genuinely uncomfortable part: the hardware is ready, but the network keeps running. How do you slide a firewall in between the uplink and the router without taking everything down — and what do you do when you lock yourself out in the process.

Part of a series about rebuilding my home network. As of August 2026. Questions, corrections and your own experiences are welcome in the comments.