Just built a low-power OPNsense box with Protectli - here's my parts list and power draw

Solid performance numbers, and thanks for clarifying the cost breakdown. That context is key for anyone doing a value comparison against a pre-built unit. You might want to edit your original post to include that detail, as it's the first question on everyone's mind.

For the idle power draw, I'd second the suggestion to check for an ERP or EuP setting in the BIOS. It's often off by default and can shave off a few watts.

You're absolutely right about editing the original post for the cost breakdown. It's the first thing I check when evaluating any build, so it should be front and center for others. Good call.

On the ERP/EuP setting, I completely agree, but I'd add a slight caveat from my own testing. On this H610I-PRO board, enabling EuP 2013 did drop the idle power, but it also disabled wake-on-LAN and some other remote management features I rely on. It's a trade-off between absolute lowest idle wattage and functionality some of us might want.

Good point on editing the original post. Clarity on costs up front stops the repetitive questions and saves everyone time.

I've seen the ERP/EuP trade-off firsthand. The power savings are real, usually 2-4W, but you're right that it can break functionality. On a server, losing wake-on-LAN is a dealbreaker. For a dedicated firewall that's always on, it's a worthwhile trade. For a multi-purpose box, you have to check what else gets disabled.

Your iperf results at less than 15% CPU load are the critical data point. It validates the platform choice for future throughput. I'd be curious about the interrupt distribution across CPU cores during that test, as the i226-V drivers can sometimes pin a single core, which would explain the low overall usage while potentially hiding a bottleneck.

The cost clarification is necessary, but you've cut it off mid-sentence again. Just stating the component cost and explicitly noting the chassis is separate would end the speculation. For the power tuning, beyond the EuP setting, have you experimented with setting a lower, static CPU C-state limit in the BIOS? It can sometimes reduce latency variance for packet processing at a minor power cost, which might be relevant if you later run Suricata.

Good to hear the i226-V drivers are solid now. The iGPU issue is a known quirk with some boards. Setting it to auto or enabling it in BIOS, even with no monitor, often resolves those boot hangs. It's a minor power trade-off for stability.

You're right about C-states, they were disabled by default on this H610 board. Enabling them knocked about 5W off my idle figure, so it's definitely the first thing to check.

The comparison to an N100 appliance is apt, but that's where the value calculation gets interesting. A pre-built unit with the same six 2.5GbE ports and an N100 is often in the $550 range. For my $450 in parts, I get a 4-core/8-thread chip with significantly higher single-thread performance, a standard mITX board I can replace, and DDR4. The extra $100 buys a lot of future headroom for when Suricata rulesets inevitably bloat.

I'm monitoring temps with netdata. The 12100T barely cracks 50C during sustained OpenVPN throughput, so the chassis airflow seems sufficient for this TDP. The real thermal test will be this summer.

That's a solid baseline, and confirming the i226-V drivers are behaving well is a great sign. For your cut-off cost line, to be explicitly clear, you're saying $450 for the CPU, motherboard, RAM, and NVMe, but the Protectli VP2420 chassis itself is separate and not included in that figure, correct? That's the key detail for anyone trying to compare this to a complete pre-built unit.

The thermal performance you're seeing is encouraging, and you're right that the real test will be sustained load with a full IDS ruleset or VPN encryption. The architectural benefit here over an N100, aside from raw throughput headroom, is the extra PCIe lanes. If you ever wanted to add a low-profile NIC for a dedicated DMZ or WAN2 interface, you've got that flexibility on the standard mITX board.

Correct, the $450 is strictly for the CPU, motherboard, RAM, and NVMe. The Protectli chassis is a separate purchase. That comparison to pre-built units is the main value proposition. The price delta often isn't as wide as people assume once you add a case and a proper power supply to the component list.

The point about PCIe lanes is critical and often overlooked. An N100 or most other embedded platforms lock you into the onboard NICs. Having a spare x16 slot, even if it's only electrically x4, means you can adapt to new requirements. Adding a multi-gig NIC or a small storage controller for local logging is trivial later, whereas a pre-built appliance is a dead end.

Good question! The $450 is just for the swap parts - CPU, mobo, RAM, SSD. The Protectli case itself is separate, which makes the total cost a bit higher but still good value against a pre-built unit.

For the hardware swap, it's pretty beginner friendly if you've ever built a PC before. The only tricky part I ran into was the iGPU setting in the BIOS. Like user1150 said, you have to set it to 'auto' even without a monitor, or the system might hang on boot. Not a big deal once you know.

What are you thinking of using for your firewall setup?

Great catch on the interrupt distribution! I didn't think to check `htop` sorted by IRQ during the test. I'll run it again and see if one core is getting hammered. That's a solid troubleshooting tip.

You're right about the C-state limit, I haven't played with that yet. I left C-states enabled but on auto. For a firewall, a bit more consistent latency is probably worth a watt or two. I'll lock it to C3 and see if it changes the power or the iperf variance. Thanks for the suggestion!

If you're locking C-states, I'd be curious if you see any increase in `vmstat`'s system time during your iperf run. It's a small trade, but sometimes the kernel scheduler overhead from deeper states isn't worth the watt.

On IRQ pinning, it's a useful data point but don't stress it unless you're seeing packet loss. The i226 drivers have improved, but you can still manually set SMP affinity if one core is saturated later.

>but I swapped the stock Celeron

That's the key move right there. The stock Celerons bottleneck IDS.

Solid power numbers. Your load test proves the headroom. A N100 or similar appliance would choke trying to push 2.5GbE with Suricata loaded.

Only thing I'd question is the RAM. 32GB is overkill for a firewall, even with heavy IDS. Unless you're running everything plus a local logging database, you'll never use it. Could've cut cost there.