N100 vs N305 vs N5105: Firewall CPU Comparison

Three chips dominate the fanless firewall appliance listings: the Intel Processor N100, the Intel Core i3-N305, and the older Intel Celeron N5105. They appear in almost identical chassis at prices that can differ by a factor of two, and the listings rarely explain why. The specifications explain most of it.

The numbers that matter

Every figure below is from Intel’s own product specification pages.

	Celeron N5105	Processor N100	Core i3-N305
Launch	Q1 2021	Q1 2023	Q1 2023
Microarchitecture family	Jasper Lake	Alder Lake-N	Alder Lake-N
Cores / threads	4 / 4	4 / 4	8 / 8
Base frequency	2.00 GHz	not published	not published
Max turbo / burst	2.90 GHz	3.40 GHz	3.80 GHz
Cache	4 MB	6 MB	6 MB
Base power (TDP)	10 W	6 W	15 W
Max memory	16 GB	16 GB	16 GB
Memory channels	2	1	1
PCIe lanes	8	9	9
Lithography	10 nm	Intel 7	Intel 7
AES-NI	Yes	Yes	Yes

Five of those rows change a buying decision. The rest are trivia.

Cores are the ceiling on inspection, not on routing

Netgate’s sizing documentation puts it plainly: “The first bottleneck with firewall throughput is the CPU.” For plain routing and NAT, four cores of any of these three parts is enough at gigabit and generally enough at 2.5 Gbps with a good network controller. Core count starts to matter the moment packets have to be examined rather than forwarded.

That is where the i3-N305 separates itself. Eight cores against four is not a marginal difference for Suricata, Zenarmor or any other userspace inspection engine, because those workloads spread across available threads. A four-core N100 running a large IDS ruleset on a saturated 2.5GbE link is at its limit; an eight-core N305 has roughly twice the budget for the same work.

It is also where the N5105 falls behind both. Its four Tremont cores burst to 2.90 GHz against the N100’s 3.40 GHz, and it carries 4 MB of cache against 6 MB. Same core count, older architecture, less cache, lower clock. There is no workload where an N5105 outperforms an N100 on packet processing, which is the plainest possible reason to stop buying N5105 boxes new.

Memory channels: the one place the old chip wins

The N5105 supports two memory channels. Both Alder Lake-N parts support one. That is a genuine architectural regression and it is not a listing error.

For a firewall it is also mostly irrelevant. Packet forwarding, state table lookups and pf rule evaluation are latency- and cache-sensitive rather than bandwidth-hungry, and 6 MB of cache on the N100 offsets a good deal of the difference against the N5105’s 4 MB. Memory bandwidth becomes interesting if the same box is asked to be a NAS or a hypervisor as well, which is a different purchase.

The practical consequence is simpler than the architecture: on an N100 or N305 board, buying two memory sticks buys nothing. One 8 GB SODIMM is the correct configuration, whatever the product photo shows.

PCIe lanes decide how many ports you can have

The Alder Lake-N parts expose nine PCIe lanes; the N5105 exposes eight. Each 2.5GbE controller consumes one lane, so a four-port board spends four lanes on networking before anything else.

With nine lanes, four network ports plus an x4 NVMe link leaves one lane spare. With eight, something has to give, which is why N5105 boards more often pair four ports with a narrower storage link or a SATA-only configuration. Neither part has room for a 10GbE card, and no amount of chassis size changes that.

This is also the reason six-port N100 boards exist but are awkward: six controllers plus storage leaves nothing, and vendors sometimes solve it by putting several ports behind a PCIe switch. The build guide covers what to look for in the port and chipset description of a listing.

Power and the fanless problem

This is the row that catches people out.

The N100’s 6 W base power is what makes a genuinely fanless, genuinely silent firewall practical. The N5105’s 10 W is still comfortable in a passive chassis. The i3-N305’s 15 W is a different thermal proposition entirely, and it is being sold in the same aluminium fin-block enclosures as the 6 W part.

Base power is not system power. A four-port appliance adds four controllers at the 1.3 W Intel publishes for the Ethernet Controller I226-V, plus memory, an SSD and the losses of an external power brick. The chassis has to dissipate all of it with no moving parts.

Gracemont cores throttle rather than fail, so an N305 in an undersized passive case does not crash; it quietly loses clock speed under sustained load, which is exactly the condition under which a firewall is being asked to work hardest. If the purchase is an N305, the enclosure matters as much as the chip, and a box advertised as fanless deserves scepticism about whether it was designed for 15 W or 6 W. Some N305 appliances ship with a small fan for this reason, and that is a reasonable engineering choice rather than a defect.

The appliance throughput and power estimator is useful here for sketching the power envelope of a feature set before committing to a chassis style.

What about the N200 and N150?

Two other parts show up in the same listings and both are worth knowing.

The Intel Processor N200 is an N100 with a higher turbo: 3.70 GHz against 3.40 GHz, at the same 6 W base power and the same four cores, 6 MB cache, single memory channel and nine PCIe lanes. For firewall use it is an N100 with a small clock bump; buy it if the price difference is small and ignore it otherwise.

The Intel Processor N150 is the 2025 refresh of the same design: four cores, 6 MB of cache, a single memory channel, nine PCIe lanes and a 3.60 GHz turbo. Treat it as the current-generation N100 rather than as a new tier. Everything written about NIC choice, throughput expectations and thermals for the N100 applies to it unchanged.

None of these change the shape of the decision. The real fork is four efficient cores at 6 W versus eight at 15 W.

Which one to buy

Buy the N100 (or N150) if the deployment is a home or small-office firewall at or below 2.5 Gbps, running routing, NAT, DNS resolution, a VPN endpoint and selective IDS on one or two interfaces. This is the majority case and the N100 is well matched to it. It is the quietest option and the cheapest to run.

Buy the i3-N305 if the plan involves inline inspection with a large ruleset at multi-gigabit, a Zenarmor deployment, many concurrent VPN tunnels, or running the firewall as a VM alongside other workloads. Pay attention to the cooling design when you do.

Do not buy an N5105 new. Older architecture, less cache, lower clock, higher base power than the N100, and one fewer PCIe lane. Its only advantage is dual-channel memory, which a firewall does not use. Second-hand at a real discount it is a serviceable gigabit firewall; at parity pricing it is a worse N100.

Do not buy any of them if the requirement is 10GbE, ECC memory, out-of-band management, or a vendor support contract. The lane budget rules out the first and the market segment rules out the rest.

Sizing it against the documentation

OPNsense’s published recommended specification is a 1.5 GHz multi-core CPU, 8 GB of RAM and a 120 GB SSD, mapped to a 350 to 750+ Mbps band with all features enabled. All three of these parts clear that reference comfortably. The vendor tables stop there, so anything above it is an inference from packet-rate arithmetic rather than a published claim.

Netgate’s sizing page supplies the arithmetic that matters more than any core count: at 500,000 packets per second, 64-byte packets amount to 244 Mbps while 1500-byte packets amount to 5.59 Gbps. A firewall does per-packet work. The traffic mix on the link decides how far any of these three chips gets, and a slow chip on large packets can look faster than a quick one on small packets.

Related reading

• Intel N100 firewall build guide: NICs, throughput, power
• N100 firewall setup: OPNsense install and first boot
• i226-V link drops: fix 2.5GbE flapping on OPNsense