Hey everyone, I've been living with OPNsense and the Sensei/plugin for about six months now on my home lab's primary edge firewall, which is hooked up to a 1Gbps symmetric fiber line. I've seen a lot of debate about the throughput impact of running deep packet inspection, especially with the free/home lab tier, and I wanted to share my actual, measured numbers because the "it depends" answers used to drive me nuts 😅.
My hardware is purpose-built, not some repurposed thin client, to try and eliminate bottlenecks:
* **Platform:** Supermicro A2SDi-H-TF (Atom C3758, 8 cores @ 2.2GHz)
* **RAM:** 32GB ECC
* **Storage:** 256GB NVMe for the OS, a separate 500GB SATA SSD for Sensei's data
* **NIC:** Chelsio T520-CR 10Gbase-T (for WAN/LAN)
* **OPNsense Version:** 24.1.x, running Zenarmor (Sensei) 1.16.2
I tested using `iperf3` between a wired client behind OPNsense and a public iperf server, with multiple parallel streams (to try and max out the connection), and also validated with large file downloads. The key was comparing throughput **with all filtering disabled** versus **with Sensei enabled** in its most common configuration.
Here's the breakdown of my rules/policy, which is probably similar to many home/lab setups:
* Application filtering enabled (social media, streaming, P2P categories)
* Malware protection (Cloud threat intelligence) enabled
* Ad blocking enabled
* TLS inspection **NOT** enabled (that's a whole other can of worms)
**Baseline (No Sensei):**
- Sustained throughput: ~940-950 Mbps up/down
- CPU usage during test: 15-25% spread across cores
**With Sensei (Policy Applied):**
- Sustained throughput: ~620-670 Mbps up/down
- CPU usage during test: 60-80% on 2-3 cores, others idle
- Latency (ping) increase: negligible, maybe +0.2ms
So, **that's roughly a 30% throughput penalty** on a 1Gbps line with this specific CPU and a moderately complex policy. The drop wasn't linear either—it hits a wall around 650Mbps.
Some crucial context and pitfalls I learned:
* The **data storage disk** is critical. I initially used the OS NVMe, and the throughput was even worse (~550Mbps) because of read/write contention. The separate SSD helped significantly.
* The "fast path" feature (for established connections) does work, but the initial handshake and classification seem to be the bottleneck. Short-lived, high-throughput connections (like speedtest.net) show a bigger hit.
* Memory usage is high but manageable. Sensei's processes hover around 4-5GB RAM with my traffic profile.
* If you're considering this on a smaller box (like a J4125 or similar), expect to cap out much lower, possibly in the 300-400Mbps range with similar settings.
For me, the trade-off is worth it for the visibility and control. I don't saturate my 1Gbps line often enough for the penalty to hurt day-to-day. But if you're constantly moving big files or have a multi-gig line, this is a very real consideration. I'd be super curious to hear if others have similar numbers or have found tuning knobs I might have missed!
—B
Backup first.