Running your own router is one of the most satisfying projects in the whole self-hosting hobby. You replace the plastic box your internet provider handed you with a real firewall, get proper visibility into your network, and stop trusting consumer-grade firmware that stops getting security updates about eighteen months after it ships. A small, quiet mini PC running pfSense or OPNsense is the classic way to do it, and it will happily route a gigabit connection while sipping a fraction of the power of an old desktop tower.
The trouble starts the moment you go shopping. Search around and you will find forum threads recommending a dozen different boxes, half of which are wrong for the job in a way nobody explains until you have already bought one. The single most common mistake is buying a perfectly good mini PC that turns out to have exactly one network port, which is one port short of what a router actually needs. Before you spend anything, it is worth understanding the hardware constraints that separate a good router box from a returned one.
The Two-NIC Requirement Is Non-Negotiable
A router sits between two networks: the wide-area network (your internet connection, coming in from a modem or an ONT) and your local-area network (everything in your house). To do its job, a firewall needs to see both of those as separate interfaces so it can inspect and control the traffic crossing between them. In practical terms, that means two physical ethernet ports at a minimum: one labeled WAN, one labeled LAN.
This is where the majority of mini PCs fall down. A typical Beelink, Minisforum, or GEEKOM box is built to be a desktop replacement, so it ships with a single ethernet jack (increasingly a fast 2.5GbE one, but still just one). That is fine for a desktop and useless for a border router. You cannot plug your modem and your home switch into the same port and expect the firewall to tell them apart. The port count, not the processor, is the first spec to check on any box you are considering.
There is a workaround, and it is worth knowing about even though it is not the path most people should take. With a single physical NIC and a managed switch that supports VLANs, you can run what networking folks call a router-on-a-stick: the WAN and LAN live on separate VLANs that share the one cable, and the firewall tags traffic to keep them apart. It works, and some people run it for years. But it forces all your inbound and outbound traffic through a single physical link, so your effective throughput is roughly halved, and it adds a managed switch and a VLAN configuration to a project you were probably hoping to keep simple. For a first router build, two real ports is the far less painful choice.
Why the Purpose-Built Firewall Boxes Exist
Once you know to look for two ports, a whole category of hardware comes into focus. Search Amazon or AliExpress for “firewall mini PC” or “soft router” and you will find small fanless boxes, often built around Intel’s N100 or N150 processors (and older N5105 or J-series chips), that ship with two, four, or even six ethernet ports on the front. Brands like Protectli, Qotom, CWWK, and Topton have built entire product lines around exactly this use case, and the generic multi-port boxes are cheap enough that the barrier to entry is low.
These exist because the pfSense and OPNsense community has been buying them for a decade, and the manufacturers followed the demand. A four-port N100 box gives you a WAN port, a LAN port, and two spares you can grow into: a separate port for a guest network, a link to a second switch, or a dedicated port for a wireless access point. You do not need four ports to start, but the headroom is genuinely useful as your network grows, and it costs very little extra.
The one thing to avoid in this category is trying to solve the port problem with a USB-to-ethernet adapter on an otherwise single-port box. It technically enumerates as a second interface, but USB NICs are a well-known source of instability under FreeBSD: they drop offline under load, reset at inconvenient moments, and are exactly the kind of flaky that you do not want carrying your entire internet connection. If you need more ports, buy a box that has them natively.
Why Intel NICs Beat Realtek
Here is the spec that matters more than almost anything else and that the product listings bury: the chipset behind those ethernet ports. Both pfSense and OPNsense are built on FreeBSD, and FreeBSD’s network driver support is not evenly distributed across vendors. Intel’s ethernet controllers (the i210, i211, i225, and the current i226) have mature, rock-solid drivers that have been maintained for years. Realtek’s chips, which are cheaper and therefore common in budget hardware, have historically had weaker and more troublesome FreeBSD support.
In practice this shows up as random dropouts, degraded throughput, or a port that simply refuses to come up until you install a third-party Realtek driver that then breaks on the next OS update. None of this happens on a box with Intel NICs. It is the difference between a router you set up once and forget, and one you find yourself rebooting every few weeks wondering why the internet keeps hiccupping. When you read a listing, look for “Intel i226-V” or “Intel i225” in the port description. If the ethernet controller is a Realtek part (an RTL8125, say) and the listing does not mention Intel anywhere, treat that as a real strike against it, even if everything else looks good.
The good news is that the purpose-built firewall boxes almost all use Intel NICs precisely because their buyers demand it, so if you shop in that category you are usually fine. The trap is buying a general-purpose mini PC on price and discovering its single port is a Realtek chip. This is genuinely the tradeoff at the heart of the whole decision: a cheaper box with the wrong NIC can cost you more in frustration than the money you saved.
Fanless or Active Cooling for an Always-On Router
A router runs twenty-four hours a day, every day, which changes how you weigh cooling. For that reason, a lot of firewall appliances are fanless, and for good reason: a passively cooled box has no fan to collect dust, wear out, or hum in a quiet room, and a router often lives in a closet, a rack, or a corner where nobody wants to hear it. For plain routing and firewalling at typical home internet speeds, the CPU load is light enough that a fanless N100 or N150 handles it without breaking a sweat. Passive cooling is the natural fit here.
The calculus shifts if you plan to turn on the heavier features. Intrusion detection and prevention systems (Suricata or Snort), high-throughput VPN tunnels, and traffic shaping all lean on the CPU far harder than basic packet forwarding does. Run Suricata on every packet at multi-gigabit speeds and a small fanless box can heat up enough to throttle, at which point your throughput sags exactly when you are asking the most of it. If your plan includes deep packet inspection or you want to route a fast VPN at line rate, an actively cooled box (or at least a beefier passive chassis with real thermal mass) is the safer call. We walk through the throttle-versus-silence tradeoff in detail in our guide to fanless versus active cooling mini PCs, and the same physics applies to a router that is pushing its CPU hard.
For most people building a home router, though, fanless is plenty. A gigabit connection with the firewall doing normal work will not stress a modern low-power chip, and the silence and dust-immunity of a passive box are worth a lot in a device you never turn off.
How Much CPU, RAM, and Storage You Actually Need
The reassuring part of this project is that pfSense and OPNsense are lightweight operating systems, and the hardware bar is low. An Intel N100 or N150, both modern low-power quad-core chips, comfortably routes a gigabit connection and has headroom to spare. You do not need a Ryzen or a Core i7 for a home router; that horsepower only starts to matter if you are pushing multi-gigabit throughput with intrusion detection enabled, which is a niche within a niche.
For memory, 4GB of RAM will run either firewall, but 8GB is the sweet spot and gives you room to add packages (a VPN server, a DNS resolver with ad-blocking, reporting dashboards) without thinking about it. RAM is cheap and the boxes in this class usually take a standard SO-DIMM, so there is little reason to skimp. On storage, both systems are happy on a small SSD; a 128GB drive is more than enough, and you specifically want an SSD rather than the cheap eMMC or a USB stick, because the logging and state tables involve enough write activity that flash endurance matters over a multi-year always-on lifespan.
One legacy detail worth a neutral mention: pfSense once flirted with requiring AES-NI (the CPU instruction set that accelerates encryption) and then walked the requirement back. It is a non-issue today because every modern Intel chip, N100 and N150 included, has AES-NI built in. If you were eyeing some ancient fanless box from a parts bin, it is worth confirming, but any current mini PC clears that bar automatically.
pfSense vs OPNsense: Picking the Software
Once the hardware is sorted, you get to choose which firewall to run, and the good news is that either one works on the same box. Both descend from the same lineage: OPNsense forked from pfSense back in 2015, so they share deep roots and cover the same core ground (stateful firewalling, VPNs, VLANs, traffic shaping, a friendly web interface instead of a command line). You are not choosing between a capable option and a weak one. You are choosing between two mature projects with slightly different personalities.
The differences are real but modest. OPNsense ships on a faster release cadence with a more modern-looking interface and a strong emphasis on frequent security updates. pfSense takes a more conservative approach to releases and has a very large base of community documentation and forum history, which means that when you hit a problem, the odds that someone has already written up the fix are high. On the licensing side, both are free and open source to download and run on your own hardware. pfSense is developed by Netgate, which also sells appliances and a commercial pfSense Plus edition; OPNsense is developed by Deciso and offers a paid business edition alongside the free community release. The 2015 fork came with some friction between the projects, but for a home user picking a firewall today, none of that history should tip your decision. Both are legitimate, well-supported choices.
If you want a practical rule: install OPNsense if you value a modern interface and rapid updates, or pfSense if you want the largest pool of existing tutorials and community answers to draw on. Either one will serve a home network for years, and because they run on the same hardware, you can wipe and try the other if your first pick does not click.
Installing It: The Durable Steps
The install process is straightforward and has stayed essentially the same across versions, so it is worth describing in terms that will not go stale. You download the installer image from the project’s site, write it to a USB stick, and boot the mini PC from it. The installer copies the system to your internal SSD and then, on first boot, asks you to assign interfaces: you tell it which physical port is the WAN (the one going to your modem) and which is the LAN (the one going to your switch or a laptop). This interface-assignment step is the one place beginners stumble, so plug in one cable at a time and let the installer detect the link if you are unsure which port is which.
From there, you move to a computer on the LAN side and open the firewall’s web interface in a browser (both projects default the LAN to a predictable address in the 192.168.1.x range, shown on the console after install). A setup wizard walks you through the essentials: an admin password, your time zone, WAN settings for most connections are simply DHCP, and the LAN subnet. Once that is done you have a working router, and the deeper configuration (VPN, DNS filtering, VLANs, port forwards) happens in the web interface at your own pace. If this is your first firewall, resist the urge to enable every feature on day one; get basic internet flowing through the new box first, confirm everything works, then add capabilities one at a time.
Matching the Hardware to Your Connection
The right box scales to your internet speed and your ambitions. For a standard home connection up to and around a gigabit, a fanless dual- or quad-port N100 or N150 box with 8GB of RAM and a small SSD is the sensible default, and it will cost far less than a year of the router-rental fee some providers still charge. If you have a multi-gigabit fiber connection, or you intend to run intrusion detection on every packet, step up to a box with a stronger CPU, faster ports (2.5GbE at minimum, 10GbE if your connection warrants it), active cooling, and confirm those higher-speed ports are still Intel controllers.
Because the deciding spec is really the ethernet: how many ports, at what speed, on which chipset, our mini PC comparison chart lets you sort the catalog by port count and connectivity so you can find boxes that actually carry the two-plus Intel NICs this project needs. And if a dedicated router turns out to be the first of several always-on services you want to run, it is worth reading our companion guide on turning a mini PC into a home server, since the same low-power, always-on hardware thinking carries straight over. A router is often the gateway drug to a whole rack of quiet little boxes, and starting with the network is a fine place to begin.
