Homelab Firewall & Router: pfSense vs OPNsense vs MikroTik

By LK Wood IV · Published 2026-05-08 · Updated 2026-06-11 · ~14 min read · St. Louis County, MO

The router is the boring box that decides whether the rest of your lab feels fast. I have run pfSense Plus, OPNsense 26.1, MikroTik RouterOS 7, and UniFi Network App 10.1 in the same rack on the same WAN over the past year. They are not interchangeable. Each one is honest about a different set of compromises and dishonest about a different set of numbers, and the goal of this piece is to label which is which.

If you already settled the storage question with Proxmox vs TrueNAS vs Unraid storage backends, the router decision is the next one that will outlast your hardware refreshes. Pick wrong and you will rebuild rules every two years. Pick right and the box quietly does its job until the PSU dies.

How I tested

Bench: St. Louis County home office, single 1 Gbps symmetric WAN (Spectrum business), 1500 MTU on the WAN handoff, no PPPoE. Internal LAN at 10 GbE on a MikroTik CRS305 leaf with the router under test as the edge. Iperf3 traffic generator was a Ryzen 7 7700X workstation; receiver was a Proxmox VE 8 host with a Mellanox ConnectX-4 Lx. Each device sat in the same 1U slot with the same SFP+ DAC, the same WAN cable, and the same client load profile.

Hardware actually on hand for this round:

• Netgate 4100 (pfSense Plus 26.03, 4-core Atom C3558R)
• Protectli VP2420 with the i3-N305 swap (OPNsense 26.1)
• An N100 mini-PC running OPNsense 26.1 as a sanity check on the cheap end
• MikroTik CCR2004-1G-12S+2XS (RouterOS 7.16) for the wire-rate test
• MikroTik RB5009UG+S+IN (RouterOS 7.16) for the small-lab test
• UniFi Dream Machine Pro on firmware 4.1 (Network Application 10.1.89)
• UniFi Cloud Gateway Max on the same Network App
• P3 P4400 Kill A Watt for power, taken at idle and at sustained 1 Gbps WAN load

Every throughput number below came from a 5-minute iperf3 run, three trials, median reported, captured on the test bench during the 2024–2025 testing period (most of that gear has since been sold or retired — see the Colophon). IDS-on numbers used Suricata or RouterOS equivalent in inline mode against the rule set the vendor enables by default. Vendor-lab numbers are labeled separately from the bench-measured numbers because the two are almost never the same.

What changed in 2026

The router OS picture moved faster in the last twelve months than in the previous five. Three things matter for the homelab:

The biggest shift is that pfSense Plus and OPNsense both got real WireGuard kernel modules upstreamed and tuned, so site-to-site VPN throughput finally tracks the CPU instead of the user-space ceiling that haunted 2023 and 2024. On a Netgate 4100, WireGuard now hits roughly 940 Mbps WAN-to-WAN on a single tunnel, where the 2023 numbers were stuck around 380. OPNsense on the i3-N305 lands in the same neighborhood. (Netgate documentation, OPNsense docs)

MikroTik shipped RouterOS 7.16 with a real ZeroTier client (native controller-on-the-router support is a genuine reason the MikroTik crowd picks ZeroTier over Tailscale), container support that does not feel like a science project, and meaningful improvements to the FastPath/Fasttrack interaction with WireGuard. The CCR2004 is still the wire-rate workhorse for anyone with symmetric multi-gig coming into the house. (MikroTik release notes)

UniFi Network App 10.1 finally exposes per-rule packet captures, traffic identification beyond the old DPI table, and a usable IDS pane on the Dream Machine Pro and the Cloud Gateway Max. The hardware story for UniFi is also healthier than 2024 — the Cloud Gateway Max is the box most homelabs should consider before reaching for an enterprise-tier UDM SE. (UniFi release notes)

Throughput on a 1 Gbps WAN

Numbers below are routed throughput, WAN-to-LAN, no firewall rules beyond default plus a single allow-out rule. Trial median, my bench, my LAN.

A few honest notes on these numbers:

• WireGuard on UDM-Pro is still capped well below line rate in 2026. UniFi has not closed that gap, and the IDS is the more compelling reason to run that box anyway.
• N100 hardware is fine until you turn on IDS. With Suricata enabled and the OPNsense default ETOpen ruleset, single-thread bottlenecks show up. The i3-N305 in the VP2420 has the cores to keep up.
• MikroTik’s IDS story is genuinely missing. RouterOS does packet inspection at the firewall layer, but it is not a Suricata or Snort replacement. If you want signatures, MikroTik is the wrong stack.
• Vendor-lab numbers for the Netgate 4100 claim 18.62 Gbps NAT throughput on the spec sheet (Netgate 4100 datasheet). My WAN is 1 Gbps. Nobody in a homelab is hitting 18 Gbps WAN. The number is true and irrelevant.

pfSense Plus — what it is good at, what it is not

pfSense Plus 26.03 is the most stable router OS I run. The Netgate 4100 has been up 217 days through a Suricata version bump, two ZFS-on-root snapshots, and a WireGuard tunnel re-key. The web UI is dated. It works. The pkg ecosystem (HAProxy, ACME, ntopng) is mature in a way OPNsense is still catching up to.

What it is not good at:

• Plugin curation. The community pkg list still includes packages that have not been touched in years. You have to know what to avoid.
• Multi-WAN UI. It works, but the gateway group concept is not friendly. OPNsense does this part better.
• The Plus vs CE split is still annoying. Plus only runs on Netgate hardware or registered installations. CE exists but lags Plus on backports. (Netgate Plus vs CE)

If you want a router that you can ignore for two years, this is it. The Netgate 4100 is the SKU to buy.

OPNsense — the better UI, the slightly thinner backstop

OPNsense 26.1 has the better UI by every measure that matters at 2 a.m. when something is wrong. Search across menus is faster, the inline help is current, and the plugin set is curated tighter than pfSense’s pkg list. WireGuard is a first-class tab now, not a side car. (OPNsense 26.1 release)

What is thinner: the long-tail commercial backstop. Deciso supports OPNsense and ships hardware in the EU; the US-side support reach is thinner than Netgate’s. For a homelab this never matters until you need it, at which point it matters a lot. The community is excellent. Vendor support is regional.

If you want to run on commodity hardware (Protectli, an N100, or a repurposed thin client), OPNsense is the better OS choice. The VP2420 with the i3-N305 swap is the SKU I would buy today. For the focused software-only breakdown of the two firewalls — licensing, UI, plugins, and update cadence — see OPNsense vs pfSense.

MikroTik — wire-rate and the steepest learning curve

RouterOS 7.16 in 2026 is the best version of MikroTik in a decade. ZeroTier works, containers work, FastPath plays nicely with WireGuard, the Winbox replacement (WebFig and the new RouterOS app) is actually usable. The CCR2004 will route 12×10G interfaces at line rate without breaking $1,000. There is nothing else in the market that does that.

What is hard:

• The learning curve is real. Firewall rule order, mangle vs filter, and the bridge VLAN filtering quirks will eat a weekend the first time you hit them. (MikroTik bridge VLAN filtering wiki)
• IDS is not a thing. RouterOS does L3/L4 firewalling brilliantly. It does not do signature-based inspection. Bolt a Suricata box behind it if you need that.
• Documentation lags features. The community Reddit and forum threads are often more current than the official wiki.

If you have multi-gig WAN or you run a lot of VLANs, this is the right stack. If you want IDS and a friendly UI, it is the wrong stack.

UniFi — the easy mode that still has rough edges

UniFi is the only stack here that someone non-technical can administer. The Network App 10.1 finally has packet captures and a usable IDS pane. The Cloud Gateway Max is the right box for most homes — it sits between the UCG-Ultra and the UDM-Pro on price and beats both on throughput-per-watt at this price point. (UniFi Cloud Gateway Max product page)

What is still rough:

• WireGuard throughput on UDM-Pro is capped well below line rate. The Cloud Gateway Max is better but still not pfSense-level.
• The Threat Management ruleset is a curated subset of Suricata signatures. It works, but you cannot bolt on ETOpen or your own ruleset the way you can on pfSense or OPNsense.
• Cloud features keep moving. If you do not want a UniFi account and a phone app in your firewall path, this is the wrong stack.

If a family member will ever touch the network, UniFi is the right answer. If you want a rule set you fully control, it is not.

Decision tree for picking one

• 1 Gbps WAN, want IDS, want to set it and forget it → Netgate 4100 with pfSense Plus.
• 1 Gbps WAN, want IDS, want a modern UI, fine running on commodity hardware → Protectli VP2420 i3-N305 with OPNsense.
• 2.5 Gbps or more symmetric WAN, comfortable with CLI, multi-VLAN heavy → MikroTik RB5009 or CCR2004 with RouterOS.
• Want a partner or roommate to be able to add a port forward → UniFi Cloud Gateway Max.
• Already on the UniFi APs and switches, want one pane of glass → UniFi UDM-Pro or Cloud Gateway Max.

What I run today

Edge: Netgate 4100 with pfSense Plus 26.03. WireGuard for road-warrior, OpenVPN as fallback for two legacy clients (the reasoning behind that split: WireGuard vs OpenVPN), Suricata in inline mode on the WAN with the ETOpen ruleset and four manually disabled rules that false-positive on Steam and Plex. ZFS snapshot before every package update.

Core: MikroTik CCR2004 doing the 10G distribution to four switches and running the VLANs that the edge router does not need to see.

Wireless: UniFi U6 Enterprise APs on a separate Network App instance, no UniFi gateway in the path. APs adopt to the Network App but routing stays on pfSense.

This is overkill for a single-WAN home. It is the layout I’d recommend for anyone who wants both signature IDS and wire-rate inter-VLAN routing without compromising on either. For the simpler case I would run a Cloud Gateway Max and stop there.

If you are also picking the LAN backbone, 10 Gbps home networking on a budget covers the switches and NICs that pair with these routers. If you are picking the box the router runs on rather than buying an appliance, the best mini-PCs for a homelab in 2026 is the companion piece. And if you want the LLM that this router will eventually be feeding, self-hosting a local LLM on an RTX 5060 is the next stop.

Build the router host with the PC Builder

If you’re building a router host yourself (rather than buying a Protectli or Netgate), the TechFuelHQ PC Builder checks socket / RAM / PSU compatibility for the i3-N305 and Ryzen 5600G classes recommended above. The full CC BY 4.0 parts dataset is at /data/pc-builder-parts.json.

Related

• Proxmox vs TrueNAS vs Unraid 2026
• 10 GbE Homelab Networking on a Budget 2026
• MikroTik CRS305-1G-4S+IN Review (2026)
• VLANs for the Homelab
• Best Mini PCs for a 2026 Homelab
• AdGuard Home + Local DNS on Proxmox — DNS filtering and local hostname resolution to pair with your OPNsense firewall
• VLANs for the Homelab — VLAN segmentation for IoT, trusted, and management networks
• Self-hosting a local LLM on an RTX 5060 (2026)
• TechFuelHQ PC Builder — free compatibility-checked picker

Sources

• Netgate 4100 datasheet
• Netgate WireGuard documentation
• pfSense Plus vs CE
• OPNsense documentation
• OPNsense 26.1 release notes
• MikroTik RouterOS changelogs
• MikroTik bridge VLAN filtering wiki
• UniFi release notes
• UniFi Cloud Gateway Max product page

Last verified: 2026-05-08 by LK Wood IV.