Intel N100 Firewall Build Guide: NICs, Throughput, Power

The short version for anyone about to buy a fanless N100 box to run OPNsense or pfSense:

• CPU and NIC quality are the same limit. Netgate’s guidance is that the CPU is the first bottleneck for firewall throughput, and a cheap network controller is what burns that CPU.
• Buy the four-port Intel i226-V variant. Avoid the Realtek 2.5GbE listings, whatever the price difference.
• 8 GB of RAM and a 120 GB SATA or NVMe SSD match OPNsense’s published recommended specification exactly. Skip the 4 GB and eMMC configurations entirely.
• Gigabit routing and NAT are comfortable. 2.5 Gbps is plausible. Inline IDS/IPS at multi-gigabit is where the platform runs out of headroom.

What the N100 actually gives you

The Intel Processor N100 is an Alder Lake-N part built entirely from Gracemont efficiency cores. Four cores, four threads, no hyper-threading, 6 MB of cache, a 3.4 GHz maximum turbo, and a 6 W base power figure. It exposes nine PCIe 3.0 lanes and a single memory channel supporting DDR4-3200 or DDR5-4800 up to 16 GB.

Three of those numbers drive the whole build.

Four threads. That is enough for packet forwarding at the speeds these boxes are sold for, but it is a hard ceiling once you stack deep packet inspection, a VPN concentrator and a DNS resolver on the same silicon.

Nine PCIe 3.0 lanes. Each i226 controller sits on a single lane, so four ports plus an x4 NVMe link already spends eight of the nine. Vendors also want lanes for Wi-Fi, a second M.2 slot or a SATA controller, which is why a four-port board sometimes narrows its NVMe slot to x1 or x2. That rarely costs throughput at 2.5GbE, but it is why these boards never have a spare x4 slot for a 10GbE card.

Single memory channel. N100 boards cannot be dual-channel, whatever the listing photo shows. Buying two sticks buys you nothing but a second stick.

Good news for a firewall workload: Gracemont includes AES-NI. Netgate’s documentation states these instructions are “present in most modern CPUs” and that for AES-NI “the optimal cipher choice is AES-GCM” on IPsec; OpenVPN benefits from an accelerated cipher such as AES-256-GCM. You are not buying a crypto-crippled part.

Why the NIC chipset matters as much as the CPU

Both major FreeBSD-based firewall projects single out network adapters, and both are specific about why. The OPNsense hardware page states that Intel network interface cards “are reliable, fast and not error-prone” and that “Intel chipset NICs deliver higher throughput at a reduced CPU load.” Netgate frames the same point from the CPU side: “The first bottleneck with firewall throughput is the CPU,” and “Inexpensive, low-end cards consume significantly more CPU than better quality cards such as Intel.” Netgate adds that a better NIC on a slower CPU helps significantly, while a faster CPU does not proportionally rescue a poor NIC. On a four-thread part, that is the whole argument.

N100 firewall appliances ship with one of two 2.5GbE controllers:

Intel i226-V. Handled by the FreeBSD igc(4) driver, which covers the I225 and I226 families including the i226-LM, i226-V, i226-IT and i226-K. It provides transmit and receive checksum offload, TSO, RSS, MSI-X, VLAN hardware insertion and extraction, and jumbo frames to a 9216-byte MTU. Note the duplex matrix: full duplex only at both 1000 and 2500 Mbps, half duplex only at 10 and 100 Mbps. This is the configuration you want.

Realtek RTL8125. FreeBSD support has historically lagged the Linux driver and offload behaviour is less consistent, which is exactly the class of controller both vendor documents steer you away from. If a listing is vague about the chipset or only says “2.5G LAN,” assume Realtek and price it accordingly.

One caveat: the i225 shipped with well-publicised link-stability problems across several steppings, and the i226 has not entirely escaped them. Intermittent link drops and speed renegotiation have been reported on i226-V ports too, so treat this as a family trait to watch for rather than a solved problem. If a port flaps, disable PCIe ASPM in the BIOS, try forcing the link to 1 Gbps, and swap the cable before blaming the hardware. The full ordered sequence, including the documented igc(4) flow-control and mbuf tunables, is in the guide on i226-V link drops and 2.5GbE flapping.

How to read one of these listings

Almost every N100 firewall board comes from a small number of ODMs and is resold under brand names such as CWWK, Topton and HUNSN, or under bare alphanumeric model codes with no brand attached at all. Those strings identify a chassis line, not a fixed specification. The same code is routinely listed with different network controllers, different memory fitted, and different storage, so the model number is a search handle rather than a bill of materials. Judge the listing on what it commits to in writing.

What the listing says	What to make it say	Why it matters
”4x 2.5G LAN"	"4x Intel i226-V”	Realtek RTL8125 is the usual substitute, and both vendor documents steer away from that class of controller
”N-series CPU” or “12th Gen”	The exact SKU: N100, N150, N200 or i3-N305	Core count and base power differ by more than double across those parts
”8GB DDR5”	Soldered or SODIMM, and how many sticks	The platform is single-channel, so one stick is correct; soldered memory cannot be upgraded later
”128GB SSD”	SATA or NVMe, explicitly not eMMC	Both firewall platforms write logs, state and RRD data continuously, and soldered eMMC is not replaceable
”Fanless aluminium chassis”	Which SKU that enclosure was designed for	A 15 W i3-N305 in an enclosure sized for a 6 W N100 throttles under sustained load
”Supports pfSense / OPNsense”	Nothing; it is marketing	Neither project certifies this class of board, so the phrase carries no warranty

If a seller will not name the Ethernet controller, that is the answer. The chipset is the single specification that most changes how the box behaves, and a vendor confident about it says so.

What throughput to actually expect

Vendor listings quote 2.5GbE and buyers hear 2.5 Gbps of firewalled throughput. Those are different claims.

OPNsense publishes a sizing table that maps throughput bands to hardware tiers. Its recommended specification, a 1.5 GHz multi-core CPU with 8 GB of RAM and a 120 GB SSD, is mapped to the 350 to 750+ Mbps band with all features enabled for 50 to 150+ users. That is the top row and the band is open-ended, so it sets a floor rather than a ceiling. An N100 with 8 GB clears that reference comfortably, but the table stops there and so does any official statement about where the box tops out.

The number that determines your ceiling is packet rate, not bandwidth. Netgate’s sizing page gives a reference: at 500,000 packets per second, 64-byte packets amount to 244 Mbps while 1500-byte packets amount to 5.59 Gbps. Same packet rate, a 23x difference in throughput. A firewall does per-packet work, so small-packet traffic costs far more CPU per megabit than a large file transfer.

Practical implications for an N100 build:

• Plain routing and NAT at gigabit is not a serious ask for this hardware.
• 2.5 Gbps of large-packet WAN traffic is a realistic target with i226 ports, and it degrades as average packet size falls. Do not chase it by switching on hardware offloads: both projects ship checksum offload, TSO and LRO disabled, both advise leaving them off for routed traffic, and netmap-based inline IPS requires them off.
• Inline IDS/IPS with a large ruleset is the expensive feature. Suricata inspects every packet in userspace, and a saturated 2.5GbE link is where four Gracemont threads become the constraint. Run it on selected interfaces, prune the ruleset, and treat full-line-rate inspection as out of scope.
• Feature-by-feature envelope. The appliance throughput and power estimator sketches where a given combination of NIC, firewall platform and inspection features lands before any hardware is bought.
• PPPoE WAN links need separate thought. The long-standing mpd5 and netgraph PPPoE path on FreeBSD pins that traffic to one queue, so a PPPoE fibre line can bottleneck well below what the same box does on a DHCP or static WAN. pfSense CE 2.8.0 added a kernel backend, if_pppoe, that spreads the work across cores, but it is opt-in and drops MLPPP support. Check what your platform runs before assuming the old ceiling applies.

RAM, storage and the boring parts people get wrong

OPNsense also documents a minimum of a 1 GHz dual-core CPU, 3 GB of RAM and a 4 GB install target. Ignore that row when buying new and buy to the recommended one.

• 8 GB is the correct purchase. It matches the recommended spec, leaves room for Suricata rules and Unbound cache, and costs very little more than 4 GB. Intel specifies 16 GB as this processor’s maximum, worth buying only if you will run extra services on the box.
• Buy a real SSD, not eMMC. Both platforms write logs, state tables and RRD graph data continuously. Cheap soldered eMMC is a wear-out failure waiting to happen and is not replaceable. A 120 GB SATA or NVMe drive is the documented recommendation and the cheapest insurance in the build.
• ZFS on root is worth enabling at install time on either platform. Boot environments and snapshots make an upgrade rollback simple, which matters on a device whose failure mode is the whole household losing internet.

Power and fanless thermals

The 6 W processor base power is the headline that sells these boxes, and it is a genuine advantage for a device that runs for years without stopping. It is also only the CPU. A four-port appliance adds four 2.5GbE controllers, memory, an SSD and the losses of an external power brick, so the figure at the wall is meaningfully higher. Treat 6 W as the floor of the CPU’s contribution, not a system estimate.

The thermal question is more interesting. These chassis are fanless by design, with the case acting as the heatsink. That is fine in open air and less fine in a closed cabinet stacked on an ONT and a switch. Gracemont throttles rather than fails, so the symptom of a bad enclosure is not a crash but throughput that quietly degrades under sustained load. Give the case air on all sides.

When the N100 is the wrong answer

• You need 10GbE. The lane budget does not allow it. Buy a platform with a real x4 slot.
• You want full-ruleset inline IPS at multi-gigabit. Buy more cores. The eight-core i3-N305 is the obvious step up, and the N100 versus N305 and N5105 comparison covers what it costs in heat.
• You are terminating dozens of concurrent VPN tunnels. AES-NI helps per-tunnel throughput, but tunnel count scales with cores.
• You need out-of-band management, ECC memory, or a support contract. None of those exist on this class of hardware.

For everything else, which is most home and small-office deployments at or below 2.5 Gbps, a four-port i226 N100 box with 8 GB of RAM and a 120 GB SSD is a well-matched, quiet, low-power firewall platform that meets the specification OPNsense itself calls recommended.

Next steps

Once the box is chosen, the rest of the sequence is covered here:

• N100 firewall setup: OPNsense install and first boot — image choice, ZFS versus UFS, interface assignment and the settings worth getting right the first time.
• N100 vs N305 vs N5105: firewall CPU comparison — the specification table behind the buying decision, including the N200 and N150.
• i226-V link drops: fix 2.5GbE flapping on OPNsense — what to do when a 2.5GbE port will not hold a link.
• Appliance throughput and power estimator — a rough envelope for a given NIC, platform and feature set.

See also

• OPNsense rule tuning guides
• pfSense and pfSense Plus configuration guides
• OPNsense vs pfSense vs UniFi comparisons