The best firewall for gigabit internet home use is OPNsense on a fanless mini PC with Intel 2.5GbE ports, such as the Protectli VP2420e at $359. If you would rather buy an appliance than administer one, pick the UniFi Cloud Gateway Max. Ubiquiti rates it at 2.3 Gbps with IPS on, more than double a 1 Gbps line.
The spec that should drive the purchase is throughput with inspection turned on, not the speed printed on the WAN port. Routing and NAT at 1 Gbps is light work for most current gateways. Intrusion prevention, which inspects every packet in software, is what pushes a box below line rate. Throughput figures below are the vendors’ own published numbers, and prices are the vendor-store list prices at the time of writing.
The shortlist at a glance
| Firewall | List price | Ports | Vendor throughput figure | Best for |
|---|---|---|---|---|
| Protectli VP2420e + OPNsense | $359 | 4x Intel I226-V 2.5GbE | None published | Full control: IPS, VPN, VLANs |
| UniFi Cloud Gateway Max | $279 | 5x 2.5GbE | 2.3 Gbps with IPS | Hands-off households, UniFi networks |
| UniFi Cloud Gateway Ultra | $129 | 1x 2.5GbE WAN, 4x 1GbE LAN | 1 Gbps with IPS | Tight budgets, IPS off |
| Firewalla Orange | $399 (regular $429) | 2x 2.5GbE plus Wi-Fi 7 | Over 2 Gbps packet processing | App-driven visibility, small homes |
| Netgate 4200 MAX | $829 | 4x 2.5GbE | 3.21 Gbps IMIX, 10k rules | Vendor-supported pfSense Plus |
| MikroTik RB5009 | $219 | 7x 1GbE, 1x 2.5GbE, 1x SFP+ | 9.37 Gbps at 1518 bytes, 25 rules | Routing per dollar, no IPS |
Ubiquiti’s US store currently adds a surcharge to both UniFi prices, bringing the Ultra to $142 and the Max to $307.
Why does throughput with IPS matter more than port speed?
Because a box that forwards 2 Gbps of plain traffic can fall well below 1 Gbps once it filters and inspects a realistic packet mix. Vendor headline numbers often come from iperf3 runs or large packets. IMIX figures, which mix packet sizes the way real traffic does, are a closer guide to what a firewall sustains.
Netgate’s own spec sheet for the 2100 shows the gap. It forwards 2.20 Gbps at layer 3 in iperf3, but with 10,000 firewall rules loaded the figure drops to 964 Mbps, and to 249 Mbps with IMIX traffic (Netgate 2100 specifications). Netgate pitches the $599 2100 at home and remote-worker deployments, yet on its own numbers it is a poor fit for a gigabit plan.
IPS is the heavier load. Suricata, the engine behind OPNsense’s intrusion prevention, performs best in its workers runmode, where “each packet processing thread then contains the full packet pipeline” (Suricata runmodes), so inspection capacity scales with core count. OPNsense runs IPS inline through netmap and tells you to disable all hardware offloading on the interfaces when IPS is enabled (OPNsense IPS manual), which moves that work back onto the CPU. Its hardware guide adds that Intel NICs “deliver higher throughput at a reduced CPU load” (OPNsense hardware sizing). For the CPU side of the equation, see our Celeron vs N100 vs i5 firewall hardware tiers.
Best overall: OPNsense on a Protectli VP2420e
The VP2420e pairs a quad-core Celeron J6412 (2.0 GHz base, 2.6 GHz burst) with four Intel I226-V 2.5GbE ports, AES-NI, a fanless aluminium chassis and a 24 W maximum draw, listed at $359 on Protectli’s product page. It takes up to 32 GB of DDR4 and an M.2 SATA SSD (NVMe is not supported). It replaces the original VP2420, which Protectli now sells only in volume.
OPNsense’s sizing guide recommends a 1.5 GHz multi-core CPU, 8 GB of RAM and a 120 GB SSD, and budgets roughly 1 KB of RAM per connection state. The J6412 clears the CPU bar comfortably, so order 8 GB of RAM and an SSD of at least 120 GB, and check whether the configuration you pick includes them.
Protectli does not publish an IPS throughput figure, so full-gigabit inline Suricata on a J6412 is something to confirm against your own ruleset, not assume. If you plan to stack a large Suricata ruleset with Zenarmor and a busy WireGuard tunnel, an N100 or N305 box with the same Intel NICs gives more margin. Our mini PC guide for OPNsense lists candidates by tier.
Who should pick it: anyone who wants IPS, VLANs, WireGuard and DNS filtering on one box and will read documentation and apply updates. Who shouldn’t: a household where nobody logs in after setup day. An unpatched OPNsense box is a worse outcome than a maintained appliance.
Best appliance: UniFi Cloud Gateway Max
Ubiquiti’s tech specs list the UCG Max at 2.3 Gbps IPS/IDS throughput on a quad-core Cortex-A53 at 1.5 GHz with 3 GB of RAM, five 2.5GbE ports (up to four usable as WAN) and a 16.1 W maximum draw (UCG Max tech specs). At $279 on Ubiquiti’s store, it is the cheapest box on this list with a published IPS figure well clear of 1 Gbps.
The Cloud Gateway Ultra ($129) is rated at exactly 1 Gbps with IPS, and only its WAN port is 2.5GbE; the four LAN ports are 1GbE (UCG Ultra tech specs). On a 1 Gbps plan with IPS enabled, that leaves no headroom. Buy the Ultra if you will run without IPS or your plan sits below gigabit.
The trade-off is control. You get UniFi’s managed IPS settings rather than direct access to rulesets and tuning, and the gateway ties you to the UniFi ecosystem. Our UniFi vs pfSense comparison covers where that ceiling starts to matter.
For visibility over tuning: Firewalla Orange
Firewalla lists the Orange at more than 2 Gbps of packet processing on a quad-core ARM CPU with 2 GB of RAM, two 2.5GbE ports and built-in dual-band Wi-Fi 7, at $399 against a $429 regular price (Firewalla Orange). Its limits sit elsewhere: WireGuard is rated at 350 Mbps, OpenVPN at 100 Mbps, and segmentation tops out at five VLANs. The product page lists it as US-only.
If you need more wired ports, the Gold SE ($519) adds two 1GbE ports to two 2.5GbE ports and carries a 2 Gbps rating (Firewalla Gold SE). The Purple is off the table for now, because Firewalla has paused sales, citing a DDR4 and eMMC shortage (Firewalla Purple). Firewalla vs pfSense covers the extensibility you give up with a sealed appliance.
Who should pick it: a household that wants per-device alerts and blocking from a phone app. Who shouldn’t: anyone who relies on remote access, since a 350 Mbps WireGuard rating will not fill a gigabit line from outside the house.
Supported pfSense Plus: Netgate 4200 MAX
The 4200 MAX runs a four-core Intel Atom C1110 at 2.1 GHz with four 2.5GbE ports. Netgate rates it at 8.61 Gbps of firewall throughput in iperf3 and 3.21 Gbps of IMIX traffic with 10,000 rules loaded, and at 1.05 Gbps of IMIX IPsec with AES-GCM-128 (Netgate 4200 MAX). TAC Lite support is included.
The store price is now $829, and Netgate notes that it tracks fluctuating memory and component costs. That is more than double the Protectli, so the premium buys vendor support and pfSense Plus rather than speed a gigabit line can use. The 4200’s product page lists Snort-based IDS/IPS as a feature but gives no throughput figure for it. Our Protectli vs Netgate comparison weighs that premium in more detail.
Fastest per dollar without IPS: MikroTik RB5009
MikroTik’s test table for the $219 RB5009 shows 9.37 Gbps through 25 filter rules at 1518-byte packets and 3.10 Gbps at 512 bytes, on a quad-core 1.4 GHz ARM chip with 1 GB of RAM (RB5009 product page). Stateful gigabit routing barely registers on it. What it lacks is an on-box inspection engine comparable to Suricata, and RouterOS has a steep learning curve. Pick it when routing speed and port count matter and you inspect traffic elsewhere or not at all.
Which one should you buy?
Buy the OPNsense box if you want IPS and VPN control and will maintain it, and the UCG Max if you want gigabit IPS without administration. Choose the Firewalla Orange for app-driven visibility on a small network, the Netgate 4200 when vendor support justifies $829, and the RB5009 when inspection is not a requirement.
Two rules apply whichever you choose. Size for the features you will actually enable, because IPS and VPN throughput, not routing, are where gigabit boxes fall short. And if remote access matters, compare WireGuard ratings as carefully as firewall ratings; WireGuard vs OpenVPN on your firewall explains why the protocol choice moves that number.
FAQ
do i need a firewall for gigabit internet
No, not strictly: your ISP’s router already performs NAT and basic stateful filtering. A dedicated firewall earns its place when you want intrusion prevention, VLANs to isolate IoT devices, a WireGuard server or DNS filtering. For those features at 1 Gbps, choose hardware whose inspected throughput, not its port speed, clears your plan.
is opnsense or pfsense better for a home gigabit firewall
Either handles gigabit on the same hardware, so the decision is about software and support rather than speed. OPNsense is free and includes Suricata-based intrusion prevention, while pfSense Plus is what Netgate ships on its appliances with support included. Pick OPNsense for a self-built box and pfSense Plus if you are buying Netgate hardware.
do i need 2.5gbe ports for gigabit internet
No, a 1GbE WAN port carries a 1 Gbps plan. 2.5GbE ports still earn their place: they give headroom if your provider raises your plan, and they speed up routing between your own VLANs, where traffic never touches the WAN. On OPNsense or pfSense builds, prefer Intel I226-V ports for driver reliability.
how much ram does opnsense need for gigabit
Eight gigabytes is the practical target. OPNsense’s hardware guide recommends 8 GB of RAM alongside a 1.5 GHz multi-core CPU and a 120 GB SSD, and estimates roughly 1 KB of RAM per connection state. Go to 16 GB if you run large Suricata rulesets alongside Zenarmor or keep long log retention.
Related across the network
- Best Hardware for OPNsense in 2026: Protectli and Mini-PCs — opnsenselab.com
- Intel N100 Firewall Build Guide: NICs, Throughput, Power — n100firewall.com
- Best NIC for OPNsense: Intel i226-V, i350, and 10G Picks — opnsenselab.com
- OPNsense Suricata IDS/IPS: Installation and Tuning Guide — opnsenselab.com
