Opinions on Opnsense dec850 as router

Submitted ⁨⁨20⁩ ⁨hours⁩ ago⁩ by ⁨Attacker94@lemmy.world⁩ to ⁨selfhosted@lemmy.world⁩

https://shop.opnsense.com/product/dec850-opnsense-desktop-security-appliance/

I asked this question about a week ago on homelab and didn’t get very much input, so I hope I can get more help here.

I have been looking at replacing my L3 switch at the gateway of my network & the OPNsense DEC850 seems to have all the features I want, mainly, vlans, 10 GB wan, multiple 2.5 GB lan, & open firmware. Does anyone have experience with this router/ are there better routers out there that do similar setups? I have experience with Cisco hardware and am willing to learn new syntax so I am not too worried about the CLI, but I heard that opnsense’s docs are a bit thin.

source

Comments

Sort:hotnew top

MuttMutt@lemmy.world ⁨5⁩ ⁨hours⁩ ago
You could get similar (and in some ways faster as routing is better with fast single cores) performance with an X10SLL-F, Xeon E3-1271V3, 16GB of RAM and an Intel X520 10G NIC.

Power draw will be higher with a maximum around 110 watts vs 55 for the DEC 850 v2 but that is only under full load, the real world load will be around 45 watts vs 30 watts.

You can easily increase the ram in the Supermicro motherboard, as well as put in multiple 10G NIC’s or even faster. Throw a couple mirrored SSD’s (the Intel D3-S4510’s are amazing) and drop it into a case with a psu and you can be up and running for around 300 to 400 through eBay, the mobo and cpu is running 80 bucks together.

NVME drive in a router isn’t worth much, outside of boot time and logs it just sits there. Even a HDD is fine for that, a SATA SSD will boot in about 30 seconds after POST. I’m using the X10SLL-F with an E3-1226 v3, 16GB of RAM, and a pair of D3-S4510’s that are underprovioned. I do not have native IPv6 and use a Wireguard tunnel to Route64, multiple vLAN’s, run CrowdSec with Intrusion Detection and UnboundDNS beyond the base system on a 1Gbps fiber connection WAN with 10Gbps fiber backbone LAN.

OpnSense is truthfully meant to be managed through the GUI or the API. If you want to control through a CLI you may find building a system on FreeBSD with packages is better. The tools used are mostly things in the FreeBSD pkg system and can be recreated, the OpnSense setup is mainly a GUI, an API, and some middleware that makes everything work. I’ve been using OpnSense since 15.7, I tried multiple others before then including running Openwrt on a WRT54G IMHO the DEC850 is way overpriced so unless you are running this for a business you will probably be better suited with some used server hardware

source
Reannlegge@lemmy.ca ⁨4⁩ ⁨hours⁩ ago
When I went looking for a hardware firewall I personally looked at OPNsense and found lots of Youtube videos that the company had sent firewalls to to review, that turned me off of it. I ended up going with openWRT. Take what I say as a lonely example of an alternative but know there are options.

source
irotsoma@piefed.blahaj.zone ⁨6⁩ ⁨hours⁩ ago
Yikes, that’s pricey. But I suppose that’s the way of the world with LLM hoarding. I pit it on an off brand mini-pc with an n100 processor 4 2.5Gbit ports, 32GB RAM, and 512GB SD for under $500 just 5 years ago. Works great. And if you know Cisco, OPNSense is a breeze in comparison. I don’t use the CLI much, but it’s nice to have a more standard OS behind it than Cisco stuff so you can do a lot more if you wanted to. Though I put Proxmox as the base OS on the bare metal so I could install other stuff even more easily. I’ve found the documentation to be OK, but yeah not the best. Fortunately there are a lot of places to find more information, unfortunately a lot is on Reddit who is about to lock everything down behind accounts and I refuse to go back there after being a huge reddior up until the IPO fiascos and continued decline. Hopefully more people will move here.

source
flueterflam@lemmy.world ⁨8⁩ ⁨hours⁩ ago
I was in your exact same position 2-3 weeks ago. Was also considering the OPNsense rack mounted options FWIW.

I ended up going with Protectli, which some others have mentioned. Specifically, the VP2440e.

I just finished the setup completely the last few days and have been making tweaks as I run into concerns or preference changes. But the hardware itself is running great. I ran into a hiccup because I bought a bad RAM DIMM externally and had to return and get a new one. I put in a 32GB one for expandability (Running Proxmox with assorted stuff, like OPNsense, AdGuard Home, Tailscale, an NTP server LXC, UniFi OS controller LXC and a few others). I mention this because these some of the Protectli devices are very picking with brand AND model of RAM, so take a look for compatibility on their website.

Anyhow, I got the barebones option and supplied my own RAM and NVMe and it’s working great so far.

To answer your question about OPNsense DEC850 - when I was researching the general consensus is that their products are just fine, but overpriced and really geared more towards businesses that plan to utilize an ongoing services/support agreement. That’s also partly how OPNsense (the software) remains free for home users who can put it on whatever hardware they choose (sans professional support).

For my specific setup, I use one RJ45 port directly to the ISP/modem, one SFP+ port to an SFP+ port on my “gateway” switch (not a software gateway, just a physical one where all the traffic goes through to reach the VP2440e), and then another RJ45 port which was a transit link. I’m looking at changing this up and putting the Proxmox containers/VM on a VLAN 99 as an internal network and having the default LAN be 10.x.x.x instead, which (with a fireall rule) would help me eliminate the transit link port need.

I included a lot because I just went through your exact process/decision-making situation. Protectli appear to be highly praised in the homelab community. But the choice is always yours, of course!

source
brickfrog@lemmy.dbzer0.com ⁨18⁩ ⁨hours⁩ ago
OPNsense is great (IMO) but I think most people just install it on other hardware they build/purchase. Not saying there’s anything wrong with buying the DEC850 specifically but you could probably do the same with any hardware with 10/2.5 GB NICs in it.

For what it’s worth, after my old Netgate pfSense hardware died on me I went ahead & bought a Protectli to install OPNsense on and it’s been fantastic. They can be a bit pricey (especially now with RAM costs) but I had wanted to buy something with good build quality. That said I’m sure you can find something similar for cheaper if you want to spend less money, just look for the right combination of NICs, CPU, and RAM that you want.

PS - There’s an OPNsense community you could try too lemmy.world/c/opnsense

source
- Attacker94@lemmy.world ⁨17⁩ ⁨hours⁩ ago
  I am unpracticed in low power draw builds which is a must ATM so I don’t trust my speccing abilities without hands on with the hardware, and I intend to use it in a home office as a tax write off so I can’t exactly order and return until I get something working.
  
  source
Shabby4582@lemmy.world ⁨12⁩ ⁨hours⁩ ago
I personally find the machines from opnsense to be a little overpriced, but I’m now more used to running my own hardware. They look like nice boxes though, you’re not going to be disappointed with it. If you’re in the US, take a look at Protectli as they’re pretty great too. If you’re not, the shipping might be a bit of a big ask (or not, have a look). They can stick coreboot on for you to be super open etc and support all the features you want. Customer support is pretty good too.

Are you using the box as a switch? That’s how I read your post, apologies if I misread it. While it’s straightforward enough to include multiple NICs in the same LAN, I’m not sure they are handled in hardware on these boxes, which just means the cpu is making more heat doing something it’s not that good at compared to a dedicated chip. If you’re fine with that, that’s a fair enough way of doing it. For me it’s more standard to just run the router into a dedicated switch, even though ultimately that’s more expensive. I’d love a DIY switch though.

I went from a consumer router to a ubiquiti edge series router and I found that a jump…then I landed in Opnsense land and it was a huge jump again. Totally worth it in my opinion. Really value being able to spin up my own firewall from parts (or in proxmox if the machine shits the bed, which has happened).

homenetworkguy.com and his accompanying YouTube channel were absolute godsends for me setting opnsense up the first time. Now I’m a complete opnsense convert and cannot really see any reason to change in the future.

source
zo0@programming.dev ⁨16⁩ ⁨hours⁩ ago
It’s good hardware, never had issues with it. Make sure to buy a fan for it because it can get pretty warm if you set it up at home.

source
ReedReads@lemmy.zip ⁨19⁩ ⁨hours⁩ ago
Do you have experience with OpnSense software? If not, I’d recommend figuring out vlans in a VM first. OpnSense is great but there is definitely a learning curve.

A lot of people like Microtik too but I don’t have any experience with it.

source
TheButtonJustSpins@infosec.pub ⁨19⁩ ⁨hours⁩ ago
I have the DEC2752 in my rack and like it, if that’s helpful information. I also find that it’s not hard to get the relevant information for whatever I’ve needed to do so far.

source