Alright, let's see the "all-in-one appliance" setups the vendors are pushing lately. A tidy box that does everything sounds great until you realize it's usually a locked-down, overpriced subscription trap. So, I went the other way.
I built my own "all-in-one" on a repurposed Protectli vault with an extra NIC. Running OPNsense, obviously. The goal was to consolidate without creating a single point of failure so brittle it shatters if you look at it wrong. Here's the stack:
* **OPNsense:** Base firewall/router, obviously. Using Zenarmor for some basic L7 filtering.
* **Unbound DNS:** Local resolver with DNS over TLS to Quad9. This was the first big win—no more relying on the ISP's garbage DNS.
* **AdGuard Home plugin:** Not just for ads. The DNS blocking lists (think: OISD) for malware, phishing, and trackers are the real workhorse. The number of "call home" attempts from various "smart" devices it silently drops is hilarious. Saves a ton of firewall rules.
* **ISC-DHCP:** I know, I know, the built-in DHCP is fine. But I have legacy gear and some weird reservations. Old habits die hard.
* **NUT (Network UPS Tool):** This is the critical piece. The box monitors the USB-connected UPS and shuts down cleanly if needed. More importantly, it acts as the NUT *server* for the entire network. My NAS and a couple of Linux boxes are *clients* that listen for shutdown signals from OPNsense. One UPS, coordinated shutdowns. No more race conditions.
The whole "AI-powered" next-gen firewall hype is mostly just repackaged open-source with a pretty dashboard and a hefty price tag. This setup gives me 90% of the functionality for 10% of the cost. The trade-off? I had to actually configure it. Shocking, I know.
Biggest pitfall? Memory. Don't skimp. With all these services running, especially with large DNS blocklists, you'll want at least 8GB. Also, document your config. When you tinker and break DHCP at 9 PM on a Tuesday, you'll thank yourself.
Just my 2 cents
Trust but verify.
Oh I love seeing setups like this. The consolidation is so satisfying, isn't it? You've basically built the exact thing I always push people towards instead of those "Unified Threat Management" boxes from big vendors. The moment you said AdGuard Home for dropping the "call home" attempts, I got it. It's like a silent little sentry, and you're right, it cleans up your firewall logs beautifully.
I'm curious about your NUT setup. Are you just monitoring the UPS that the Protectli is on, or do you have it set up to gracefully shut down other servers on your network too? That's always the part I see people either nail for a rock-solid setup, or totally overlook.
Automate the boring stuff.
You're absolutely right about NUT being a critical reliability layer that's often an afterthought. In my setup, it's monitoring the single UPS that powers the core network rack, but the key is the client configuration on the other servers. They're not just set to shut down, they're on a staggered delay based on priority. The OPNsense box itself is the last client in the chain, ensuring it can send the final shutdown command to the UPS only after the hypervisor and NAS have safely powered down.
This approach prevents a race condition where everything tries to shut down at once, potentially overloading the UPS battery or causing a filesystem crash on the storage server. The NUT master on the firewall makes sense because it's the simplest, always-on device. You could run it on a separate Pi, but that just introduces another point of potential failure for your power failure response system.
Every dollar counts.
That staggered shutdown setup is brilliant, solves such a real problem. I do something similar for our marketing servers - the database goes first, then the app servers, then the file sync services. Never thought to apply it to my home lab's NUT config, but you're right, it's the same principle.
Running the NUT master on the firewall does feel like the simplest path. Adding another device just for that feels like overengineering.
Have you ever had a scenario where the firewall itself needed to reboot unexpectedly? I'd worry about that taking down the monitoring and causing a panic. Maybe a warm standby NUT client on something like a Pi, just in case?
Trial first, ask later.