# Hardware Firewalls

## Open Source

### OPNsense (recommended for new deployments)
- HardenedBSD base, 2 major releases/year, patches every ~2 weeks
- Built-in: Unbound DNS, Suricata IDS/IPS
- Hardening: disable root login, TOTP on all admin accounts, default-deny all interfaces, SSH key-only on non-standard port
- Guide: https://www.zenarmor.com/docs/network-security-tutorials/opnsense-security-and-hardening-best-practice-guide
- GitHub: https://github.com/LelandParker/opnsense-hardening
- Series: https://sysadmin102.com/2024/03/opnsense-security-and-hardening-episode-1/

### pfSense
- CIS Benchmark: https://www.cisecurity.org/benchmark/pfsense
- Guide: https://www.zenarmor.com/docs/network-security-tutorials/pfsense-security-and-hardening-best-practice-guide
- Combined guide: https://lgcybersec.co.uk/the-ultimate-guide-to-security-hardening-pfsense-and-opnsense-bulletproof-your-network-infrastructure/

## Hardware

### Protectli Vault (best value)
- N100 or i5-7200U models
- Install OPNsense yourself, no vendor lock-in
- FW6C with i5 is nearly 2x the Netgate SG-5100 at $150 less

### Netgate (pfSense maker)
- Pre-loaded with pfSense Plus, includes TAC support
- Models: 6100, 2100 MAX
- More expensive but integrated support

### Intel N100
- Sweet spot for DIY firewall/VPN box
- WireGuard at 900+ Mbps (near gigabit)
- Under $200 complete with 4 NICs

Hardware guide: https://hometechhacker.com/11-great-choices-for-pfsense-hardware/

## Enterprise (for reference)

What makes them different from open source:
- **Custom ASICs**: Fortinet SPUs accelerate threat detection in silicon
- **Inline ML**: Palo Alto inline ML detects zero-days, signature updates in seconds
- **Threat Intel**: proprietary networks vs community rules (ET Open)
- **Central management**: Panorama (PA), FortiManager (Fortinet)
- **Cost**: PA-400 from ~$1,000; FortiGate 40F from ~$400 + $500-2,000/yr subscriptions

For home lab: open source + Suricata + ET Open = 90% of detection at zero recurring cost.

## Comparison Table

| Feature | OPNsense | pfSense | VyOS | OpenWrt |
|---------|----------|---------|------|---------|
| Base OS | FreeBSD (HardenedBSD) | FreeBSD | Debian Linux | Linux |
| IDS/IPS | Suricata built-in | Suricata/Snort pkg | Manual | Manual |
| Updates | 2 major/yr + biweekly | Slower | Rolling | Rolling |
| VPN | WireGuard, OpenVPN, IPsec | Same | Same | WireGuard, OpenVPN |
| Best for | Firewall/UTM | Firewall/UTM | BGP/OSPF router | WiFi/embedded |
| License | BSD (free) | Apache 2.0 (CE) / proprietary (Plus) | GPL | GPL |

Recommendation: OPNsense for firewall, VyOS if you need advanced routing. Never OpenWrt for a firewall.