Layer 3 · self-hosting reality check
What it actually takes to self-host OPNsense
The docs say 2 GB. In practice you want 4 GB, or 8 GB if you run intrusion detection. Here is the honest version — real requirements, real monthly cost, what you will be maintaining, and the one thing that catches people out.
Usually reached from Locked-Down Consumer Routers alternatives, where OPNsense is one of the picks.
| RAM — documented minimum | 2 GB |
|---|---|
| RAM — what it really needs | 4 GB, or 8 GB if you run intrusion detection |
| CPU | 2 cores, more for deep packet inspection |
| Disk | 32 GB SSD — it writes logs constantly and will kill cheap flash |
| Monthly cost | Free software on hardware you buy once. A $150–350 mini PC replaces a subscription router permanently. |
| Setup time | An afternoon for a working firewall, longer to tune rules |
| How you install it | install the image to a mini PC or VM with at least two network interfaces |
| Ongoing maintenance | Moderate. Firmware updates matter — this is your network edge. |
| Where it stops scaling | Small business networks comfortably. Throughput is bound by the CPU you chose, so choose deliberately. |
The thing that catches people out
Enabling Suricata intrusion detection on a low-power box quietly destroys throughput. A machine that routes a gigabit happily drops to a fraction of that with inspection on, and it presents to the household as "the internet got slow" rather than as a firewall problem. Size the hardware for inspection if you want it, or leave it off knowing that you did.
When not to self-host OPNsense
Nobody else in the house can fix it. When a self-built firewall fails, everyone loses internet and the person who built it is the only support line.
Every guide here carries this section. A site that only ever tells you to self-host is selling something — the useful answer is sometimes no.
Other Layer 3 self-hosting guides
Common questions
- How much RAM does OPNsense actually need?
- 4 GB, or 8 GB if you run intrusion detection in practice. The documented minimum is 2 GB, which is the figure at which the process starts rather than the figure at which it works under real use. 2 cores, more for deep packet inspection alongside it.
- What does self-hosting OPNsense cost per month?
- Free software on hardware you buy once. A $150–350 mini PC replaces a subscription router permanently. This is commodity VPS pricing and excludes your time, which is the larger cost for most people — budget for moderate. Firmware updates matter — this is your network edge.
- How long does it take to set up OPNsense?
- An afternoon for a working firewall, longer to tune rules, via install the image to a mini PC or VM with at least two network interfaces.
- When should I NOT self-host OPNsense?
- Nobody else in the house can fix it. When a self-built firewall fails, everyone loses internet and the person who built it is the only support line.
- What is the most common mistake when self-hosting OPNsense?
- Enabling Suricata intrusion detection on a low-power box quietly destroys throughput. A machine that routes a gigabit happily drops to a fraction of that with inspection on, and it presents to the household as "the internet got slow" rather than as a firewall problem. Size the hardware for inspection if you want it, or leave it off knowing that you did.