Building/Buying OPNsense 10 Gbit firewall router with Wireguard

FOSSOS

I have a 10 Gbit connection and reach close to that speed in speedtests. I want to increase my privacy and security by adding a OPNsense Firewall either replacing my current ISP router, which is allowed, directly connected to the internet or behind the ISP router. The problem is that I want to use it as Wireguard client so it routes all my network traffic through my VPN provider but I can't find any guides or hardware builds that are fast enough to reach the full 10 Gbits Wireguard throughput. When connected to my VPN provider I can reach close to my full bandwidth on a device supporting 10 Gbit. I am willing to build or buy a hardware configuration with a reasonable power consumption to run OPNSense and my Wireguard connection on but I do not know where to start.

What CPU, RAM, SSD, Motherboard and 10 GbE NICs should I be looking for?

I appreciate any guidance

n3t_admin

FOSSOS uhm first question: what commercial VPN provider actually supports 10Gbit connections per client? I was working at an ISP with multiple 100 clients and we had a total of 250Gbit available for the whole data center. Your requirement sounds... unreasonable to be honest.

FOSSOS

n3t_admin a dedicated IP bought from a VPN provider. I can reach the speed just fine on a speedtest with the VPN on, I cap at 6 or 7 Gbit but that is expected because of the wireguard connection. I don't know why, if it sounds unreasonable it probably is but it is a real world scenario. My ISP offers me 10 Gbit and the dedicated VPN has a 40 Gbits pipeline if memory serves

n3t_admin

FOSSOS alright, that explains it.
I don't know if this will actually work, since saturating 10Gbit with Wireguard will probably require some overhead (which will be limited by the WAN), so I'd actually expect it to be in the same realm of 7Gbit.
Now for hardware... the easiest option would be to just ask Deciso, the makers of OPNSense basically, if their hardware (e.g. DEC4200 series) can reach these speeds.

Problem is: there's reports that the OPNSense Wireguard implementation doesn't reach the speeds of Wireguard on pfSense. No idea what affects this.
I'd say your idea of a 10Gbit external VPN is ambitious for sure.

In case you decide to go the pfSense route, also ask them (Netgate) directly what would be required to get up to those speeds. This should give you a good idea, where you'll land.
Otherwise you'll be spending a lot of money for nothing.

FOSSOS

n3t_admin

I did notice OPNSense and pfSense had some hardware that could possibly reach my requirements but it limited to the higher end builds. That's why it might be a better idea to build it myself since I know that the 10 Gbit consumer market is still pretty small. It might be cheaper if I do but I don't know which CPU would be able to stable when encrypting and decrypting such a large besides a high end CPU that consumes lots of power.

I know there will be a lot of overhead and calculate about 30% speed loss when Wireguard is used but I didn't know OPNsense had wireguard implementation problems.

Sigismund
I'm not afraid of the mini PCs they sell on Ali but I haven't found one fast enough to do 10 Gbit Wireguard throughput

Sigismund

What @n3t_admin said, you will not saturate the full uplink with wireguard regardless of router used (unless you'd pick some really expensive stuff) so I'd go with either something coreboot can be flashed onto (limited options) or if you won't fall the paranoia trap, buy a mini PC off of Ali. I have one and I can't say I complain.and no I don't expect it to be backdoored.

n3t_admin

FOSSOS It might be cheaper if I do but I don't know which CPU would be able to stable when encrypting and decrypting such a large besides a high end CPU that consumes lots of power.

Well, I don't know what you have invested in your setup so far, but I had assumed you had the cash to go through with this, since you seem to have 10Gbit gear, an according WAN and a custom agreement with a VPN provider. That doesn't scream "poor" to me (and I mean that as a compliment).
However, you'll be most likely looking at some pretty expensive options either way. VPN en-/decryption is tasking on any CPU.

FWIW, I found this Reddit thread discussing exactly your question, so it might be worth a read. They also have developed a formula where

In absence of hard data, here's a guesstimation algorithm for you: a Wireguard connection requires approximately 8 MHz of processor bandwidth per 1 Mbps of Wireguard throughput. Said another way, a Gigabit Wireguard connection will require approximately 8 GHz of processor bandwidth; a 2.5-gig connection, approximately 20 GHz.

So I would honestly prepare for a high-end Ryzen/entry-level Epyc setup, Intel NICs (or Mellanox even? I don't know how well they play with OPNSense; needs more research) and the according power consumption that comes with that.

Remember: my former employer had a total of 250Gbit for hundreds of clients with whole racks filled to the brim with hardware to keep the operation going. Even though we live in 2025, 10Gbit is pretty expensive to maintain - and especially for exotic setups like yours.

23Sha-ger

https://utcc.utoronto.ca/~cks/space/blog/linux/WireGuard10GPerformanceSoFar

n3t_admin

23Sha-ger nice find, but it doesn't really translate into OPNSense or pfSense, as both products are based on FreeBSD and have a different wg-kernel implementation compared to Linux.
That's one of the issues we're trying to solve now :D

FOSSOS

n3t_admin You're right, I was afraid I'd be looking at high end CPU's to do it. As you said I'm not poor but the idea having to buy the power of a small server rack to accommodate a firewall and VPN that is draining your power (and your bank account) as if it's playing AAA games 24/7 is not someone's first thought, but I do understand the reasoning behind it xD. As I said, 10 Gbit at home is a pretty small market and the market for people that want to push all their encrypted network traffic through one tunnel at those speeds is even smaller.

What Ryzen models are you thinking of that might be suitable?
The reddit post is an interesting read. It didn't show up when I was searching.

I recently watched a video of someone using a Mellanox NIC on OPNsense, it didn't configure it automatically but it did show up and work after manually adding it in the interface.

n3t_admin

Yeah, I figured as much. It's not something I'd be running at home. Even my company (around 400 employees) runs on a 2Gbit WAN, without much VPN usage at all.

FOSSOS What Ryzen models are you thinking of that might be suitable?

If we stick to the calculation of that reddit thread and take 8Mhz as our reference... we land somewhere in the ballpark of an Epyc 9255 or 9275F, to accommodate for the 80Ghz of total CPU power required for 10Gbit. Now throw in a nice mainboard, RAM, good PSU, case and all the other crap and you'll be looking at 4 or 5k in hardware alone maybe? Not even accounting for your power bill...

Mellanox is more of a "industrial" solution for sure. I'm not up to date regarding NICs, so please conduct your own research; I don't want to spread misinformation.

FOSSOS

n3t_admin i forgot i had this topic open and never read your response. I'm sorry.
That's much too expensive to even consider as a consumer at this point in time. It will become more useful when technology develops to support this more widely.

I'm considering lowering my expectations and buying one or two OPNsense devices that would support 2.5 Gbit Wireguard throughput as a wireguard client to a commercial wireguard server instead and connect some devices without the wireguard connection that don't need a vpn because it looks like solutions for that are available. However, I don't know what I should buy. Protectli offers some solutions but they are overpriced, TLSense offers some solutions but I really do not know what to buy. I can only buy something once and I have a record of buying something that doesn't live up to expectations since products are marketed for certain performance they can't deliver.

Does anyone have any suggestions for prebuilt hardware that could reach full or close to 2.5 Gbit wireguard throughput for in an affordable price range?

n3t_admin

FOSSOS No worries, happens to all of us.

I don't think you will find anything prebuilt that is going to be cheaper compared to a DIY system, as the markup for components is quite significant. I think your best bet is to buy a refurbished server with some nice dual Xeons and a good NIC. They are usually pretty cheap and as long as you don't mind the noise and the electricity bill, they're your best choice for this task.

To add to this: what you are looking for is definitely not in the realm of "consumer" applications, so expect a hefty price tag. A good portion of the world still runs on pretty slow internet (talking <100 Mbit/s here), so even considering a VPN upwards of a gig is a professional task that requires professional gear. I see no way around that as of right now, sadly.

FOSSOS

n3t_admin

I would rather get prebuilt because the noise and price is a problem. It's a household appliance. I can build it myself if I can find a small case but I wouldn't know where I could find one.

The thing is that in the EU and UK these speeds are considered "consumer level" and are dirt cheap. 1 Gbit costs about $40 a month, 10 Gbit will be about $80 a month. The prices are even going down because of competition on the market. Copper cables are a thing of the past and that is generally true for most European countries, especially in large urban areas with high populations.

I've seen in the OpnSense discussion forum that consumers using small devices with N100's are reaching 1 Gbit Wireguard throughput. If I look at a model like the TLSense 10810U from TekLager it says this on the website:
"Throughput
This hardware has been internally tested at TekLager to provide clients with reliable information.

Full 2.5 Gigabit routing under all popular operating systems (pfSense, OPNsense, etc).
Full 2.5 Gigabit encrypted WireGuard throughput under OpenWRT."

They tested it with OpenWRT but I think it should be capable of reaching a similar speed on OpnSense if it can reach that Wireguard speed on OpenWRT.
This is a consumer product. It is fanless stated to produce 0 db and has a 15W TDP. The price is about $725, it uses a Intel Core i7 10810U Quad-Core, 8 threads, Up To 4.9GHz as it's CPU and has a 6 x Intel I225-V rev3 2.5Gbps NIC.

These are the kind of systems I'm looking at but it has to be able to achieve what they state is possible

n3t_admin

FOSSOS The thing is that in the EU and UK these speeds are considered "consumer level" and are dirt cheap. 1 Gbit costs about $40 a month, 10 Gbit will be about $80 a month

I live in Germany. 100 Mbit/s is around 40€ a month for me. A 1 Gbit connection is currently 70,95€ a month from Telekom (the only reliable choice in Germany sadly, unless you are B2B). You can't compare prices in e.g. Romania with places like France or Germany.

FOSSOS I've seen in the OpnSense discussion forum that consumers using small devices with N100's are reaching 1 Gbit Wireguard throughput

I mean, you can try? Imho routing 10Gbit is a lot more difficult than anything below.

FOSSOS

n3t_admin I live in Germany. 100 Mbit/s is around 40€ a month for me. A 1 Gbit connection is currently 70,95€ a month from Telekom (the only reliable choice in Germany sadly, unless you are B2B). You can't compare prices in e.g. Romania with places like France or Germany.

We're neighbors. Is it that expensive in Germany? We have one major company still offering copper cable connections, all of the others have fibre. Prices for copper cable connections here are the same as fibre prices so the only customers that still use that company are the loyal customers. It's common to offer speeds between 1 and 10 Gbit here for competitive prices.

"n3t_admin"#p181194 I mean, you can try? Imho routing 10Gbit is a lot more difficult than anything below.

I gave up on 10 Gbit for now, technology is not advanced enough to be capable of this in consumer products. I'm looking at systems that can handle full 2.5 Gbit throughput now because they are available. Do you think this would work? Can you think of a better choice for a full 2.5 Gbit wireguard throughput than the TLSense which has a low TDP and a low purchase price making it a good consumer product? I want to buy something I won't regret. If it works well I can buy another and split the traffic between multiple systems if I have to. Having a full 2.5 Gbit Wireguard throughput is fast enough for almost everything I currently own.

n3t_admin

FOSSOS Is it that expensive in Germany?

You have no idea, German customers get milked like cows because the companies know full well that there will be little resistance. Germans have been conditioned to accept old technology as the default. Getting a 10 Gbit connection here is only possible as business customer and with very few companies generally. So speaking from the view of someone in the 3rd strongest economy or whatever, it's bad.

2.5Gbit is going to be a lot easier I would say. Most modern CPUs should be able to handle that. Since TLSense claims these speeds, you can hold them accountable if it doesn't in the real world - so I'd go with that option.

FOSSOS

n3t_admin German customers get milked like cows

When push comes to shove companies are all the same, they rather spend as little as they can and make more. There is no real competition so you have to take it from them.

n3t_admin 2.5Gbit is going to be a lot easier I would say. Most modern CPUs should be able to handle that. Since TLSense claims these speeds, you can hold them accountable if it doesn't in the real world - so I'd go with that option.

They say they tested it on OpenWRT on the website, they say it runs Opnsense but they don't have actual test reports or claims about the speed on that OS but I would assume it will be similar but they could say it wasn't tested on Opnsense if you try to hold them accountable.

They have a plethora of configuration options for each model, could I bother you to have a look at the website and help me pick a model that would be best suited? You know a lot more about this than I do, I'm new to networking and Opnsense.

There are RAM upgrades and NVME upgrades. The Wireguard client won't saturate the system often so I do not know if it would or wouldn't be smart to use it for any other LAN only (they wouldn't be exposed to WAN access) homelab services or other tasks that might be useful in the network such as, as an example, running clamav, password database storage or something to sync backups with.

n3t_admin

FOSSOS oh well, I took a look and I find the prices horrendous for what they offer. I mean these are just rebranded AliExpress boxes at the core.

If you want to go with this form factor (low power/fanless), you'd be better off with a Protectli box. They are basically the same, but they offer coreboot as their UEFI/BIOS (and are still cheaper compared to TLSense).

And you could build a system yourself for half the price with 3 times more performance, almost dead silent. Fanless systems will probably crumble under sustained load, so when you saturate your WAN with 2.5GBPS VPN traffic for an hour, it very well might start to throttle.

So before recommending anything, I suggest you take a look at the Protectli offerings first. Because I'd rather not recommend buying anything from TLSense if possible.

FOSSOS

n3t_admin Thanks for taking a look.

I don't know which of the Protectli boxes could do full 2.5 Gbit wireguard without crumbling. I could go with protectli, its the same for me as long as it can do what I need it to do.

I'd be happy to build it myself and it doesn't have to be fanless but I would need to know what to get exactly (you are relatively close to me so shipping would be no issue from any stores you mention). The form factor is not that important but I do need a case that would work so I can put it all together without running into unforseen issues.

The thing that is important to me is that it won't use too much power. It will be on 24/7/365 so it shouldn't be too high. It could have a higher TDP than 15 watt like the TLSense but but I don't want it to to be too power hungry. I want to strike a balance while still having a powerful device. The fan can make some noise as long as it doesn't spin up nonstop. I have a mini pc that does this and it annoys the family members.

If you want to help me pick a device or parts to build one that could do everything I need it to I'd be very grateful to you.

Edit: looking at the protectli its not cheap. The VP4670 with the same CPU, 32 GB and 1 TB SSD is 876,00 €

n3t_admin

FOSSOS looking at the protectli its not cheap. The VP4670 with the same CPU, 32 GB and 1 TB SSD is 876,00 €

You are looking at an outdated model with the according price tag from that time. A VP6630 should be able to outperform the older i7. TLSense doesn't even have anything in its portfolio that is comparable - their newest i-Series chip is this 5 year old i7.

For building it yourself:

Ryzen 5500, stock cooler should be plenty for such applications as a firewall.
AM4 mainboard - preferably with an A520 chipset from Asus.
16-32GB of RAM should be more than plenty
Case and PSU should be up to you. Anything will suffice - I usually recommend bequiet for the PSU if you want it to be reliable for years to come.
NIC is the only hard part really. Intel X550-T2 should work, but you will need to do some research too for 2.5GBase-T auto-negotiation. 10GBase-T seems to work flawlessly though from my quick research.
SSD - take whatever you want. It's not really critical in a firewall. Cheap one for 20€ should suffice.

With my German pricing, I'm at around 420€ plus shipping for the parts (although with shipping it should still be under 450€). Throw in some nice case fans and you have a very flexible system that you can tweak and fine tune to your liking. At least compared to all the other offerings from these AliExpress boxes.