A firewall box wants fast, well-supported NICs and low idle power - it runs 24/7 and does little heavy lifting between traffic. Two or more Intel 2.5GbE ports (i225/i226) is the sweet spot; the CPU only matters once you are pushing multi-gigabit VPN.

The ranking favours boxes with more Intel NICs and lower idle draw. The one hard rule: avoid Realtek NICs on BSD - OPNsense and pfSense are far happier on Intel.

What to look for

Intel NICs, 2+
i225/i226 2.5GbE is ideal. More ports means WAN + LAN + an optional DMZ or second WAN without a switch.
Avoid Realtek on BSD
Realtek NICs are a known headache on pfSense/OPNsense. Intel is the safe default.
Low idle watts
A router idles almost all the time. Fewer watts is the spec that pays you back.
AES-NI for VPN
Any modern Intel chip has it; it is what keeps WireGuard/IPsec fast without a big CPU.

The picks right now

# Pick Fit Price
1 Topton N5105 4-LAN Top pick
4 NICs, ~8W idle - Intel Celeron N5105.
4x Intel I225-V
~$189 Check price on Amazon
2 CWWK NAS Board
4 NICs, ~12W idle - Intel Processor N100.
4x Intel I226-V
~$210 Check price on Amazon
3 CWWK N305 4-LAN
4 NICs, ~9W idle - Intel Core i3-N305.
4x Intel I226-V
~$279 Check price on Amazon

Ranked from curated specs, same logic as the interactive recommender and the calculator. Approximate - verify against your exact setup. Prices move; check the retailer.

Other guides