#Hardware Firewalls

#Open Source

#OPNsense (recommended for new deployments)

• HardenedBSD base, 2 major releases/year, patches every ~2 weeks
• Built-in: Unbound DNS, Suricata IDS/IPS
• Hardening: disable root login, TOTP on all admin accounts, default-deny all interfaces, SSH key-only on non-standard port
• Guide: https://www.zenarmor.com/docs/network-security-tutorials/opnsense-security-and-hardening-best-practice-guide
• GitHub: https://github.com/LelandParker/opnsense-hardening
• Series: https://sysadmin102.com/2024/03/opnsense-security-and-hardening-episode-1/

#pfSense

• CIS Benchmark: https://www.cisecurity.org/benchmark/pfsense
• Guide: https://www.zenarmor.com/docs/network-security-tutorials/pfsense-security-and-hardening-best-practice-guide
• Combined guide: https://lgcybersec.co.uk/the-ultimate-guide-to-security-hardening-pfsense-and-opnsense-bulletproof-your-network-infrastructure/

#Hardware

#Protectli Vault (best value)

• N100 or i5-7200U models
• Install OPNsense yourself, no vendor lock-in
• FW6C with i5 is nearly 2x the Netgate SG-5100 at $150 less

#Netgate (pfSense maker)

• Pre-loaded with pfSense Plus, includes TAC support
• Models: 6100, 2100 MAX
• More expensive but integrated support

#Intel N100

• Sweet spot for DIY firewall/VPN box
• WireGuard at 900+ Mbps (near gigabit)
• Under $200 complete with 4 NICs

Hardware guide: https://hometechhacker.com/11-great-choices-for-pfsense-hardware/

#Enterprise (for reference)

What makes them different from open source:

• Custom ASICs: Fortinet SPUs accelerate threat detection in silicon
• Inline ML: Palo Alto inline ML detects zero-days, signature updates in seconds
• Threat Intel: proprietary networks vs community rules (ET Open)
• Central management: Panorama (PA), FortiManager (Fortinet)
• Cost: PA-400 from ~$1,000; FortiGate 40F from ~$400 + $500-2,000/yr subscriptions

For home lab: open source + Suricata + ET Open = 90% of detection at zero recurring cost.

#Comparison Table

Recommendation: OPNsense for firewall, VyOS if you need advanced routing. Never OpenWrt for a firewall.