OPNsense on a Mini PC: The Dual-NIC Starter Build

If you read One NIC and a Dream, you know how that build went: free HP Mini, one Ethernet port, a router operating system that flatly requires two. I spent a weekend discovering the hard way that a router needs a WAN side and a LAN side, and one hole in the back of the case doesn’t give you both.

This is the guide I wish I’d read first. Not the story — the actual shopping list and the actual steps. If you follow this one, you skip the entire USB dongle chapter.

Who this is for

You want a proper router of your own: real firewall rules, your own DNS, network segmentation, the works — instead of the sealed plastic box your ISP hands you. You’re comfortable flashing a USB stick and sitting through a text-mode installer, but you don’t want to guess your way through hardware compatibility the way I did.

By the end of this you’ll have a genuine two-port OPNsense router: one interface facing your modem (WAN), one facing your home network (LAN), routing real traffic, with the defaults changed so it isn’t wide open to the first person who finds the login page.

What’s OPNsense? A free, open-source firewall and router operating system. You install it on your own hardware and it turns that box into a proper router — firewall rules, VLANs, VPNs, traffic shaping. More effort than a consumer router, dramatically more control.

Hardware: buy the two ports, don’t improvise them

Here’s the one decision that determines whether this weekend goes well: buy hardware with at least two physical Ethernet ports. This isn’t an OPNsense quirk — it’s the documented minimum to run it as a proper firewall, one NIC for WAN and one for LAN (OPNsense hardware requirements).

NIC = Network Interface Card. The bit the Ethernet cable plugs into. One port, one NIC, usually.

The good news: this is no longer an expensive ask. Dual-NIC (and quad-NIC) mini PCs built specifically for router/firewall duty are cheap and widely available, and the good ones use Intel-chipset NICs, which have solid, mature driver support on the FreeBSD base that OPNsense runs on. A modern dual-Intel-NIC mini PC will happily route multi-gigabit traffic without breaking a sweat (Mini PC Lab) — no fan-noise drama, no PCIe card, no compromise.

What to look for when you’re shopping:

Two or more built-in physical Ethernet ports. Don’t count on adding one later — check before you buy.
Intel NIC chipsets specifically, if the listing tells you (i225, i226, i210 and similar show up often on these boxes). They’re the safe, boring choice, and boring is exactly what you want from your router’s network drivers.
Enough RAM and storage to run comfortably — this isn’t demanding hardware, but don’t buy the absolute floor spec if you plan to add packages later (an IDS, a VPN, DNS filtering).

Why USB Ethernet is a trap, not a shortcut

I know the temptation, because I fell for it: your box is one port short, and a USB-to-Ethernet dongle looks like a tenner-and-done fix. It isn’t, and this is worth spelling out plainly so you don’t repeat Part 2 of my mistakes:

Reliability. USB Ethernet is widely considered unreliable on OPNsense and pfSense, and cheap Realtek-chipset adapters (RTL8152/RTL8153) are the worst repeat offenders — IO errors, adapters vanishing after a reboot, interfaces that just don’t come back (OPNsense forum; FreeBSD forums). The chip is usually fine on Windows; the FreeBSD driver support underneath OPNsense is the weak link.
No VLAN tagging. USB Ethernet adapters generally don’t support VLAN tagging at all (SNBForums discussion), which quietly rules out several router designs before you’ve even started.
Interface name-swaps on reboot. USB interfaces can swap names between boots, meaning your WAN and LAN can trade places — on a firewall, that’s a genuinely bad surprise to discover at midnight (OPNsense forum).
USB 2.0’s hard ceiling. USB 2.0 tops out at 480 Mbps in theory, less in practice — it physically cannot carry a full gigabit, whatever your internet connection or switch is capable of.

If you’re genuinely stuck and a USB NIC is your only option for now, the community’s least-bad pick is an ASIX AX88179-based adapter over anything Realtek, and USB 3.0 (5 Gbps) over USB 2.0 (OPNsense forum). Treat it as a bridge to get you running, not a permanent fixture — the moment you can, replace it with a real second NIC.

Install walk-through

The exact wording of installer screens and the web UI changes between OPNsense releases, so treat the steps below as the shape of the process, and confirm exact labels against whatever version you download.

Download the installer image from the official OPNsense site, matching your hardware’s architecture (almost certainly the standard amd64 image for a mini PC).
Write the image to a USB stick. Use a dedicated imaging tool rather than a plain drag-and-drop copy — the image needs to be written raw to the device, not extracted onto a filesystem.
Boot the mini PC from the USB stick. You’ll likely need to hit a boot-menu key during startup and pick the USB drive; the exact key varies by manufacturer.
Run through the installer. When the image boots you land in a live environment; to install permanently you log in as installer (password opnsense) to launch the installer utility. It will ask you to confirm keyboard layout, partition the target disk, and — this is the important bit — prompt you to replace the default opnsense password with a proper root password. Set a real one here. Accept sane defaults for the rest unless you have a specific reason not to.
Assign your interfaces. This is the step this whole guide exists for. The installer (or the console menu on first boot) will list the physical NICs it’s detected and ask you to assign one as WAN and one as LAN. Plug a cable into each port beforehand if you can, or use the detect option that watches for link activity as you plug cables in one at a time — it’s the most reliable way to know which physical port is which.
Reboot without the USB stick, and let it boot from the internal disk.
First login. Connect a laptop to the LAN port, get an IP address (OPNsense runs a DHCP server on LAN by default, with the router itself on 192.168.1.1/24), and open https://192.168.1.1 in a browser. Log in as root with the password you set during install — or, if you’re only poking around a live environment before committing to a permanent install, the factory default root / opnsense.

The default logins aren’t a secret — that’s the point. OPNsense ships with well-known factory credentials: root / opnsense for both the console and the web GUI (default LAN address 192.168.1.1), and installer / opnsense to launch the installer from a live boot. A permanent install prompts you to change the root password; a live environment leaves the default in place. So on any real, internet-facing router, changing that password is the first thing you do — anyone who can reach the login page already knows what the default is.

First-boot sanity checks

Before you consider the router “built,” walk through this short list:

LAN DHCP is handing out addresses. Confirm your test laptop actually got an IP in the expected range (for example, something in 192.168.1.0/24 if that’s how you’ve configured LAN — adjust to whatever range you chose).
WAN is up and has an address. Check the interface status in the dashboard; it should show a public-facing IP (or the address handed to it by your ISP’s modem/ONT) and a gateway.
Update the firmware. OPNsense cuts a major release every January and July, and the image you download is frequently a version or two — plus a stack of cumulative patches — behind by the time you actually sit down to install it. Run the system update before you do anything else, either from the web UI or the console (option 12, Upgrade from console). You want to start from a patched baseline, not build habits on top of known bugs.
Change the default root password if you haven’t already. A permanent install prompts you for one; a live environment doesn’t. Either way, root / opnsense is public knowledge, so leaving it in place on a device sitting directly on the internet is not a risk worth taking, even for a few hours.
Confirm the web UI is on HTTPS, not plain HTTP, and consider restricting admin access to the LAN interface only, if it isn’t already.

When router-on-a-stick is actually the right call

Everything above assumes two physical ports, because that’s the sane default. But there’s a legitimate version of the single-port workaround I tried and failed with in Part 1: router-on-a-stick, where one physical port carries multiple VLANs, tagged, back to a managed switch.

VLAN (Virtual LAN) = a way to carve one physical network into several logical, isolated ones over shared cabling, using traffic tags.

It’s a real, documented pattern — but only if you have the right supporting hardware and follow the rule that trips people up. You need a genuinely managed switch that understands VLAN tagging (an unmanaged, plug-and-play switch can’t do this), and you must never mix tagged and untagged traffic on the same trunk port — doing so lets broadcast traffic leak between networks that are supposed to be isolated (OPNsense VLAN docs; OPNsense forum).

If that setup sounds appealing, or if you want the full story of why I abandoned single-port designs entirely rather than fight this rule, One NIC and a Dream has the blow-by-blow.

Where this leads

A dual-NIC mini PC running OPNsense, installed properly, first-boot-hardened — that’s a real router, and a genuinely good one. It’s also more router than most homes strictly need to hand-manage on their own, which is exactly the realisation that eventually pushed me off OPNsense and onto a managed ecosystem instead. If you want to see where that road goes — controller-managed switches, access points, and a single dashboard instead of one box doing everything — that’s Enter Omada.

But if all you need is a proper two-port firewall doing one job well, the build above is the whole story. No dongles required.