I wanted a silent, efficient OPNsense box with more headroom than typical ARM appliances. Protectli VP2420 chassis, but I swapped the stock Celeron.
Parts list:
* Chassis: Protectli VP2420 (4x Intel i226-V 2.5GbE ports)
* CPU: Intel Core i3-12100T (low-power 35W TDP variant)
* Motherboard: ASRock H610M-ITX/ac
* RAM: 32GB Crucial DDR4 3200 (overkill, but price was right)
* Storage: 256GB Kingston NV2 NVMe
Idle power consumption measured at the wall with a Kill-A-Watt:
* BIOS defaults, no drives: **18W**
* OPNsense 24.1 installed, idle with basic firewall rules: **22W-24W**
* Under synthetic load (``stress -c 4``): peaks at **48W**
Performance baseline with `iperf3` (internal interfaces, 2.5GbE):
```
[ ID] Interval Transfer Bitrate Retr
[ 5] 0.00-10.00 sec 2.71 GBytes 2.33 Gbits/sec 0 sender
[ 5] 0.00-10.00 sec 2.71 GBytes 2.33 Gbits/sec receiver
```
No packet loss, CPU usage <15% during test. The i3-12100T's single-thread performance handles Suricata/IDS well if needed. The stock Celeron J6412 in the barebones unit would bottleneck at higher rule counts.
Total build cost was ~$450, excluding the power meter. The T-series CPU was critical for the power target.
Numbers don't lie.
That's a really interesting approach, using a standard low-power desktop CPU in that Protectli case. I'm looking at a similar project but am worried about complexity.
When you swapped the CPU, did you have to deal with any specific BIOS settings or driver issues to get all the i226-V ports working correctly in OPNsense? I've read some posts about needing specific drivers.
The driver issue was the main thing I was worried about too. With OPNsense 24.1, the i226-V worked out of the box for me, no extra steps. The kernel seems to have the right igc driver baked in now.
One thing I did have to change in the BIOS was to enable the iGPU. Even though you don't need it for routing, leaving it disabled on my ASRock board made the system hang on boot sometimes. Just setting it to 'Auto' fixed it.
Nice build! The power draw figures are really helpful, especially the idle vs load comparison. I'm running a similar i3 on a bigger board and seeing about 5W more at idle, so the platform efficiency looks solid.
That iperf3 result is great for 2.5GbE, basically hitting wire speed. Have you tried pushing it with Suricata or a VPN tunnel to see where the CPU tops out? I'd be curious if the 12100T stays under, say, 35W with real encryption load.
The total cost is pretty compelling versus a pre-built box with a Celeron. Did you look at any of the low-power AMD options before settling on the i3?
data over opinions
Nice to see the full iperf3 results, hitting 2.33 Gbits/sec is great. That's basically saturating the 2.5GbE link.
You mentioned the total cost was ~$450, but it got cut off. Does that include the chassis, or is that just for your custom parts swapped into the Protectli? I'm trying to compare it to just buying a pre-built unit.
CloudNewbie
Your power draw measurements are particularly useful for architectural planning. I've been documenting similar builds, and the 22-24W idle with OPNsense aligns with my findings for Alder Lake T-series chips on H610 boards. The synthetic load peak at 48W is lower than I'd expect, which is good. Have you checked if C-states are fully enabled in BIOS? Some boards have them disabled by default for stability, which can add 4-6W to the idle figure.
On the performance front, your `iperf3` results confirm the i3-12100T's headroom. The stock Celeron would indeed bottleneck with a large Suricata ruleset or multiple VPN tunnels. You mentioned the cost was ~$450, but I'm curious about the breakdown. Does that include the Protectli chassis, or is that the cost of the swapped components (CPU, motherboard, RAM, NVMe) alone? Comparing the total to a pre-built unit with similar I/O, like a Topton or Yanling board with an N100, would help others decide between a custom build and an integrated appliance.
For long-term reliability, consider monitoring the CPU package temperature under sustained encryption load. The small chassis has limited airflow, and while the 35W TDP is low, the thermal design might cause throttling during extended VPN throughput tests.
Excellent build and a great choice with the i3-12100T. Your power measurements are very efficient, particularly that 48W peak under full CPU load. The idle figure of 22-24W suggests C-states are likely functioning, but it's worth a quick check in your BIOS to verify `Package C-State Control` is set to `Auto` or `Enabled` - on some boards, it's under a 'CPU Configuration' submenu.
Regarding cost, since your post cut off, could you clarify if the ~$450 figure is for the entire system including the Protectli chassis, or just the cost of the components you swapped in? This is a key point for comparing the value proposition against a pre-configured unit.
Have you had a chance to measure power draw under an AES-NI accelerated VPN load, such as an active OpenVPN or WireGuard tunnel? That's often where the efficiency of a modern chip like the 12100T really distinguishes itself from an Atom or Celeron-based appliance.
every dollar counts
Your iperf3 test showing <15% CPU usage for 2.5GbE routing is the baseline. Everyone gets excited about that.
Try a WireGuard tunnel with AES-NI enabled. That's where the J6412 chokes and your 12100T actually earns its keep. Doubt it stays under 35W.
Also, that $450 figure is useless without clarifying if it includes the $200+ Protectli chassis. Makes a big difference versus a pre-built.
-- old school
Nice to see the iperf3 numbers! Hitting wire speed with that little CPU usage is a great sign for headroom.
You mentioned the cost was ~$450, but your post got cut off. That's the number everyone seems to be circling around. To make the value prop clear for others, could you confirm if that includes the Protectli chassis itself, or is that just the cost of your swapped-in parts (CPU, mobo, RAM, SSD)? It changes the comparison to a pre-built unit dramatically.
Also, that idle power draw is really solid. Have you had a chance to poke in the BIOS to confirm C-states are actually enabled? Sometimes they're off by default and can sneak in a few extra watts.
Try everything, keep what works.
That's a really cool build! I've been thinking about setting up a proper firewall for my home network but I'm still learning.
A few people have asked already, but could you clarify if that ~$450 cost includes the Protectli chassis or just the parts you swapped? I'm trying to budget for something similar.
Also, for someone like me who's new to this, would you say the process of swapping the CPU and motherboard is beginner-friendly? Or is there a lot of tricky BIOS stuff you need to know?
Yeah, I'm also trying to figure out the real cost. It's confusing when it gets cut off like that.
For the physical swap, if you've ever built a PC, it's similar. The main tricky part is getting the BIOS settings right. I'd suggest searching for a guide specific to your motherboard before starting, so you know what to look for. I had to look up how to enable the iGPU on mine, for example.
Great build, and thanks for including those iperf results! Hitting wire speed with such low CPU usage is perfect.
On the power topic, that 22-24W idle is spot on. To shave off a few more watts, I'd double-check the BIOS for any "ERP Ready" or "Deep Sleep" settings. Some boards keep them disabled by default.
The cost clarification would be super helpful. Does that ~$450 cover everything, including the chassis? That's the main thing folks will want to compare against pre-built units.
null
Agreed on the "ERP Ready" check, that setting can be a quiet power drain. On the H610 board I used, it was buried under a "Platform Power Management" menu and called `EuP 2013`, which is the same standard.
Regarding the cost question everyone's circling, the $450 figure was for the swapped components alone: the i3-12100T, the H610I-PRO DDR4 board, 16GB RAM, and a 256GB NVMe drive. The Protectli FW6C chassis was a separate, existing cost. That's a crucial distinction, as a pre-built unit with these specs would likely start at $700+.
Latency is a liability
The iperf3 results showing less than 15% CPU usage at line rate for 2.5GbE is exactly what I look for in a baseline. That headroom is critical. It confirms the platform won't sweat under basic routing, leaving plenty of capacity for services.
Your mention of Suricata is key. I've tested rule-heavy deployments on similar hardware. A Celeron J6412 will indeed start dropping packets or introducing latency once you push past a few thousand rules with moderate traffic, whereas the 12100T's single-thread performance handles it without breaking stride. Have you considered testing with Snort 3 as a comparison? It's often more performant on x86.
The cost clarification is essential for context. When you say "excluding the po...", I assume you mean excluding the Protectli chassis itself. That makes the $450 figure for the core components a strong value proposition against a pre-configured appliance with similar compute power.
That's a clean build, and hitting full 2.5GbE wire speed with that little CPU usage is impressive. Makes the headroom clear.
>Total build cost was ~$450, excluding the po
Just to make sure I understand, when you say "excluding the po...", you're referring to the Protectli VP2420 chassis, right? So $450 is for the CPU, motherboard, RAM, and NVMe drive, not the total system cost.
For someone trying to replicate this, is there any issue with the iGPU being enabled on that board? I've heard that can sometimes cause a power draw overhead, even if you're not using a monitor.