Building an OPNsense router

Router vs. ISP gateway

Most people think of a router as the white box with blinking lights their ISP ships. But that box is really a cocktail of functions: a gateway that handles NAT and DHCP, a basic firewall, a Wi‑Fi access point and a tiny switch — all glued together with very limited knobs to turn. Want VLANs or real traffic inspection? Good luck. It has been reported that ISP-provided devices are intentionally low on configurability; for many, they do the job, and that’s the end of story.

Router on a stick

The author chose a “router on a stick” topology: the router sits like any other device on a switch and handles VLAN-tagged traffic over trunk links rather than sitting at the modem bottleneck. Simple in concept. Powerful in practice. VLANs segment the network so traffic between segments — or out to WAN — passes through the router, giving you policy control and visibility where consumer gear usually can’t.

Why OPNsense

After weighing options, the author picked OPNsense — an open source, FreeBSD-based firewall/router platform. It has been reported that OPNsense offers a broad feature set: fine-grained NAT, DNS, DHCP, firewall rules, VPNs and detailed traffic monitoring. There’s drama too — a community split with pfSense has left homelab forums divided, it has been reported that opinions run strong — but the practical benefit is clear: you trade plug‑and‑play simplicity for control. Want that? Then buckle up.

Hardware and the homelab thrill

A router is just a computer with a very specific job. You can buy a small NUC, a dedicated appliance from Protectli, or repurpose other gear; the author notes commercial appliances like Ubiquiti’s gateways are “plug and play” but, as they put it, painfully expensive. The emotional payoff here is worth calling out: the moment you realize you can replace a dumb, one‑size‑fits‑all box with something you actually understand — and tweak endlessly — is oddly satisfying. Who knew networking could feel a bit like hobby furniture assembly, but for packets?

Sources: clintonboys.com, Lobsters