The Network Journey — Part 1
One NIC and a Dream: Building My First Router From a Spare Mini PC
#opnsense#mini-pc#router#vlan#homelab#beginner
Every good homelab disaster begins with the words “I’ve got a spare one of those lying around.”
In my case, the spare thing was an HP Mini desktop — one of those little business boxes that turns up cheap and tidy and looks vaguely heroic on a shelf. It had been gathering dust since its previous career, and I decided — with the boundless optimism of someone who hadn’t yet read a single spec sheet — that it would become my new router.
Not a router I bought. A router I built. There’s a difference, and that difference is roughly one weekend and a small amount of dignity.
Why build a router at all?
Fair question. The plastic box your ISP sends you works fine for most people. But “fine” stops being enough the moment you want to do homelab things: segment your network so the smart fridge can’t see your laptop, run your own DNS, block ads at the network level, or just understand what your network is actually doing.
A consumer router hides all of that behind a friendly app and a blinking light. I wanted the opposite — full control, all the knobs, none of the hand-holding. So I reached for OPNsense.
What’s OPNsense? It’s a free, open-source firewall and router operating system. You install it on your own hardware and it turns that hardware into a seriously capable router — firewall rules, VLANs, VPNs, traffic shaping, the works. Think of it as the difference between a microwave meal and a kitchen. More effort, infinitely more control.
The plan was beautiful in its simplicity: install OPNsense on the mini PC, plug it in, become a network wizard. I was so close to being right.
The wall everyone hits
Here’s the thing nobody tells you in the “build your own router!” YouTube thumbnails: a router needs at least two network ports.
It makes obvious sense once you say it out loud. A router sits between two networks — the internet (WAN) on one side, your home network (LAN) on the other. Traffic comes in one port, gets inspected and routed, and goes out the other. One cable from the modem, one cable to your network. Two ports. Minimum.
This is not a quirky OPNsense preference, by the way — it’s the documented baseline. The absolute minimum to run OPNsense as a proper firewall is two NICs: one for WAN, one for LAN. (OPNsense hardware requirements.)
NIC = Network Interface Card. The bit that the Ethernet cable plugs into. One port, one NIC. Usually.
My heroic little HP Mini had exactly one NIC. And no practical way to add another — no spare PCIe slot, no second-NIC flex port fitted, no expansion of any kind I could use. It was single-port, take-it-or-leave-it hardware.
I had, in essence, bought a one-handed boxer to a two-handed fight. Except I hadn’t even bought it. It was free. Which felt like a bargain right up until the exact moment it didn’t.
”But what about router-on-a-stick?”
If you’ve done a bit of reading, you’re already shouting this at the screen. And you’re right — there is a clever workaround, and it has a wonderfully silly name.
Router-on-a-stick lets you run multiple networks down a single physical port. The trick is VLANs.
VLAN (Virtual LAN) = a way to carve one physical network into several logical, isolated ones. Same cables, same switch, but the traffic is tagged so devices in different VLANs can’t see each other unless you explicitly let them. It’s how you keep the kids’ tablets, the smart TVs, and your work laptop in separate lanes on the same road.
With router-on-a-stick, OPNsense creates a virtual sub-interface for each VLAN on that single port. One cable runs to a “trunk” port on a managed switch, the switch tags the traffic for each VLAN, sends it up to OPNsense to be firewalled and routed, and sends it back down the same cable. One physical port, many networks. (OPNsense VLAN docs.)
It’s genuinely elegant. It’s also where my “free” router started quietly racking up a bill.
Because router-on-a-stick has a catch, and the catch has a price tag:
- You must have a managed switch that understands VLAN tagging. An unmanaged switch — the cheap plug-and-play kind — can’t do it. (OPNsense forum.)
- You have to be careful not to mix tagged and untagged VLANs on the trunk, or you get broadcast traffic leaking between networks — DHCP, router advertisements, the lot. The official docs warn about this specifically. (OPNsense VLAN docs.)
So my free router now required a managed switch I didn’t own, and a single overworked port doing the job of two. All my WAN and all my LAN traffic would be squeezing in and out of one Ethernet hole, taking turns like a single-lane bridge at rush hour.
The lesson I should have learned here (but didn’t)
Looking back, this was the moment to stop and ask the obvious question: is the free thing actually the cheap thing?
The honest answer was no. A single-NIC HP Mini with no expansion was the wrong tool for a router, full stop. The right move would have been to spend a little and buy a small box with two (or four) proper Intel NICs — they exist, they’re cheap, and a modern dual-NIC mini PC will happily route multi-gigabit traffic without breaking a sweat. (Mini PC Lab.)
But I didn’t do that. Because I’d spotted what I was certain was a shortcut: a little USB-to-Ethernet dongle. “I’ll just add a second port over USB,” I thought. “How bad could it be?”
That, friends, is the subject of Part 2. Pour yourself something. It doesn’t go well.