OPNsense hardware requirements - Thomas-Krenn-Wiki-en (2024)

In many use cases it is sufficent to operate a OPNsense firewall with smaller server configurations. The OPNsense creators give some recommendations for sizing the firewall server hardware.^[1] We have summarised these for you here.

To our OPNSense firewalls

Suitable hardware for your application

The following overview shows the recommendations issued by the OPNsense makers.

Important Hint: For an exact sizing of your hardware please contact our sales department, we will find the right hardware for you.

Component selection

The following table shows the minimum configurations recommended by OPNsense:

Scope of application			Equipment			Sample system
	Network throughput (Mbps)	Number of users/networks	CPU	RAM	Disc capacity	Sample system
Minimum (OPNsense standard features, without disk writes as for caching proxy (cache) or Intrusion Detection & Prevention (Alert Database))	11 - 150	10 - 30	1 GHz Dual-Core	2 GB	4 GB SD or CF card	Edge 4L
Reasonable (OPNsense standard features, all functions can be used, but possibly only for fewer users or lower loads)	151 - 350	30 - 50	1 GHz Dual-Core	4 GB	40 GB SSD	LES network 6L / RI1102D-F / RI1102D-F Ver.2
Recommended (OPNsense standard functions, meets most use cases)	350 - 750+	50 - 150+	1,5 GHz Multi-Core	8 GB	120 GB SSD	RI1101-SMXEFH / RI1102H+ Scalable

Impact of special functions

Although most functions have no particular influence on the hardware selection, the following functions can have extensive effects:

Squid Proxy cache for controlling Web content: high influence on CPU (higher loads) and disk writes (cache).
Captive portal:^[2] several hundred users require more CPU performance than listed in the table above.
State transition tables: OPNsense logs as firewall with Stateful Packet Inspection^[3] the state of all active network connections (Connections/Sessions) going through the firewall. This information is stored in a state table. Two entries are stored for each individual connection (one for the outgoing connection and one for the incoming connection). Each entry in this table occupies approximately 1 KB of RAM.

Firewall Performance Tests

We perform our own in-house Performance Tests with various OPNsense-compatible servers. The test scope includes among others a firewall throughput test, IDS/IPS test, OpenVPN, IPsec and WireGuard VPN test.

Hardware compatibility list

Because OPNsense is based on FreeBSD, it supports at least the same hardware as the respective FreeBSD version:

OPNsense 24.7 (FreeBSD 14.1): FreeBSD 14.1 Hardware Notes (www.freebsd.org)
OPNsense 23.7/24.1 (FreeBSD 13.2): FreeBSD 13.2-RELEASE Hardware Notes (www.freebsd.org)
OPNsense 22.7/23.1 (FreeBSD 13.1): FreeBSD 13.1-RELEASE Hardware Notes (www.freebsd.org)
OPNsense 22.1 (FreeBSD 13.0): FreeBSD 13.0-RELEASE Hardware Notes (www.freebsd.org)
OPNsense 20.7/21.1/21.7 (FreeBSD 12.1 / HardenedBSD): FreeBSD 12.1-RELEASE Hardware Notes (www.freebsd.org)
OPNsense 20.1 (FreeBSD 11.2 / HardenedBSD): FreeBSD 11.2-RELEASE Hardware Notes (www.freebsd.org)
OPNsense 19.1/19.7 (FreeBSD 11.2 / HardenedBSD): FreeBSD 11.2-RELEASE Hardware Notes (www.freebsd.org)
OPNsense 18.1/18.7 (FreeBSD 11.1): FreeBSD 11.1-RELEASE Hardware Notes (www.freebsd.org)
OPNsense 17.1/17.7 (FreeBSD 11.0): FreeBSD 11.0-RELEASE Hardware Notes (www.freebsd.org)
OPNsense 16.7 (FreeBSD 10.3): FreeBSD 10.3-RELEASE Hardware Notes (www.freebsd.org)

References

↑ Hardware sizing & setup (docs.opnsense.org)
↑ Captive portal (en.wikipedia.org)
↑ Stateful firewall (en.wikipedia.org)

Author: Werner Fischer

Werner Fischer, working in the Knowledge Transfer team at Thomas-Krenn, completed his studies of Computer and Media Security at FH Hagenberg in Austria. He is a regular speaker at many conferences like LinuxTag, OSMC, OSDC, LinuxCon, and author for various IT magazines. In his spare time he enjoys playing the piano and training for a good result at the annual Linz marathon relay.

Author: Thomas Niedermeier

Thomas Niedermeier working in the product management team at Thomas-Krenn, completed his bachelor's degree in business informatics at the Deggendorf University of Applied Sciences. Since 2013 Thomas is employed at Thomas-Krenn and takes care of OPNsense firewalls, the Thomas-Krenn-Wiki and firmware security updates.