Firewall & Router Appliances

What a firewall build actually needs

pfSense and OPNsense both need at least two network interfaces - one WAN, one LAN. A stock mini PC has one. That single fact drives every decision on this page.

There are two ways to solve it. You can add a USB network adapter, which works but is the most common source of instability people complain about. Or you can fit a real PCIe network card, which is what we do.

The PCIe riser

Several ThinkCentre Tiny models accept a low-profile PCIe card through an official riser kit. That turns a one-litre desktop into a genuine multi-port appliance without the size, noise or power draw of a rackmount box. Combined with the onboard port, a dual-port card gives you three usable interfaces - WAN, LAN and a spare for a DMZ, a management network or a second WAN.

Intel versus Realtek network cards

This matters more than people expect. pfSense and OPNsense are FreeBSD-based, and FreeBSD's Intel drivers are mature and well maintained. Realtek support on BSD has historically been weaker, and cheap Realtek desktop adapters are a recurring source of throughput and stability complaints in firewall builds. When we build a firewall system we fit a server-class card chosen for BSD compatibility rather than the cheapest adapter that fits the slot.

AES-NI and hardware encryption

If you intend to terminate a VPN on the firewall, you want AES-NI for hardware-accelerated encryption. Every Intel Core generation in the machines we stock includes it, so this is rarely a constraint on hardware of this era - but it is worth knowing why the requirement exists.

1GbE or 2.5GbE?

Be honest about your internet speed. If your connection is 500Mbps, a gigabit firewall is not your bottleneck and 2.5GbE buys you nothing at the WAN edge. 2.5GbE earns its place when you are routing between internal networks at speed - a NAS on one VLAN and workstations on another - or when your connection is genuinely faster than gigabit. Buying 2.5GbE for a 200Mbps connection is a common and expensive mistake.

Which of our machines take a card

If you want a system supplied with the network card already fitted, configured and tested rather than sourcing the riser and card yourself, tell us what you need - we build these to order and can confirm exact card compatibility before you buy.

Can one of these really replace a consumer router?

For routing, firewalling, VLANs and VPN termination, comfortably - and it will do all of it better than a consumer box. What it will not do is provide Wi-Fi. Running access points as separate devices is the correct design anyway, but it does mean a firewall appliance is one part of a network rather than a single-box replacement.