Replace your ISP router with OPNsense — measured

Disclosure: this article contains affiliate links, including links to Proton VPN below. If you buy through them, Rack at Home may earn a commission at no extra cost to you. We test everything we recommend.

Tested on 2026-11-02 (OPNsense 26.7 install, boot and resource numbers machine-timed). Pricing rows fetched live on 2026-10-31.

Start with the box your internet provider gave you. It is a small computer, and quietly the weakest one in your house. It decides how your traffic is routed, when it updates (often: rarely), and what your home network even is — sometimes for five dollars a month. Its firewall is generic, its settings menu is a decade behind, and "have you tried restarting the router" is the entire support model.

There is a way out that costs nothing in software: OPNsense, a free, open-source router operating system, and its older sibling pfSense. Put it on a small box between your fibre termination point and your house, and from then on you run your network. We installed OPNsense 26.7 and measured the reality: boot times, memory, the setup gotcha, what NZ ISPs charge to keep their box, and what a real firewall box costs — including the field we honestly failed to measure.

What OPNsense (and pfSense) actually is, in plain words

A router is just a computer whose whole job is moving packets: from your fibre line to your laptops and back. Brand-name home routers run secretive, barely updated software for that job. OPNsense runs a proper, open operating system instead, with a real firewall you configure (not enable, configure), DNS you control, and network tools that businesses have used for years — all free. pfSense is its older sibling; Protectli-class appliances sold for either do the same job. The free part is the OS, not the box.

The box question matters: this is not a "flash it onto your old router" situation. OPNsense wants an x86 machine with two network ports — a mini-PC or, as here, a virtual machine. Two vCPUs and 1.5 GB ran everything we tested.

The numbers, as measured

We installed OPNsense 26.7 on a plain virtual machine — 2 vCPU, 1.5 GB — on a private test network with two small Linux clients. Every number below is machine-timed, raw traces kept. One honesty note: this was a test gateway on a virtual network, not our daily internet path — read these as what the software itself costs, not what your fibre speed becomes.

• 39 seconds from launch to a working text console.
• 329 seconds to the browser setup page — and that includes a manual fix, which is itself the finding: the preconfigured live image ships expecting one network port at a default address that didn't match our test network, so the web interface stayed unreachable until we corrected the port settings from the console. Roughly four minutes of detour, unprompted, on a first install. Expect one console-level correction on setup day; that is normal, not broken.
• Idle RAM: about 1.6 GB of host memory for the whole VM — allocation plus hypervisor overhead; the OS itself sits well under that.
• Idle CPU: negligible — about 0.1 s accumulated over 13 quiet minutes; a firewall doing firewall things barely notices.
• Throughput: unmeasured. Our iperf3 bandwidth test never completed — the second client never came up on the test network, and we stopped at our two-attempt budget. We won't print a gigabit number we didn't earn; anyone publishing one from a $500 box without a published method deserves your skepticism.
• Full disk install: not timed. The installer is interactive and resisted our automated setup inside the test's time budget. Treat "install to usable firewall" as an evening, not a coffee break.

What you're paying your ISP today (dated, live-fetched)

Pricing read from provider pages and comparison sources on 2026-10-31 (NZD); Canstar figures are "prices correct at 09/10/26".

Straight math: a $5/month rental is $120 over two years for a router you can't upgrade, keep, or sell. That is the honest argument against the rental — not that the ISP box is secretly costing a fortune. Which brings us to the other side.

What a real firewall box costs (dated, live-fetched)

Prices read from Amazon AU listings on 2026-10-31, in AUD via an import route — add shipping, expect import delivery times. Dated snapshots, not offers we stand behind.

Protectli's own shop page showed appliances "starting at $259" (USD) the same day, though we couldn't map that floor to a specific model. The cheap option is the one we used: a virtual machine. If you already run a small home server, OPNsense fits in 1.5 GB of it at zero extra cost — learn whether you like this setup before buying anything.

The honest part this niche rarely admits: at NZ rental prices, a $500–800 box never pays for itself in cancelled fees. Don't buy OPNsense as savings. Buy it for what the rental box can't give you: a firewall you control, your own DNS and rules, a network that survives changing ISPs, and hardware you update yourself instead of waiting for a firmware push that may never arrive.

What we won't pretend about

• Speed. We failed to measure throughput and said so. Real-world numbers depend entirely on which box and which ports you buy; the entry class handles typical home fibre with headroom, but shop by other people's published methods, not their headline numbers.
• CGNAT. If your ISP hands you a shared public address (common in NZ on some plans), a better router doesn't fix that by itself — you'll want to ask your provider for a public IP, and OPNsense won't force their hand.
• Voice over fibre / landline. Some ISP phone services only work through their own box. Before replacing anything, ask exactly how your phone service terminates, or budget for a second fiddly project.
• Support and warranty. With your own gear, your ISP's support line gets shorter — "is it the ONT or your router?" becomes your problem to answer. An import mini-PC means a warranty you chase yourself, versus an ISP swap. And there is a real learning curve: OPNsense exposes every setting because it is a real firewall — one that can lock you out of your own house if you misconfigure it. Same feature, both ways.

The VPN question: run your own WireGuard, or pay for one?

OPNsense has WireGuard built in — free, open VPN software. People reach for it for one of two different jobs, and conflating them causes disappointment.

Job one: reach your home network from outside. WireGuard on OPNsense does this beautifully — it's free, the keys are yours, and the setup is one evening. The catches are yours too: your home upload speed caps the experience, CGNAT can block it outright (see above), and the box has to stay up. For "get to my files and cameras from anywhere," self-hosted WireGuard is genuinely the best tool.

Job two: protect yourself on public networks and pick your exit country. Self-hosting is the wrong shape for that — traffic through your house borrows your home's upload and reputation. A commercial VPN earns its keep here: fixed monthly fee, apps on every device, servers in dozens of countries, zero maintenance. The pick we'll name: Proton VPN (the company behind Proton Mail) — usable on phone and laptop, or as a VPN client on your OPNsense box so the whole house exits through it. If the ask is only "reach my house from outside," skip it and use free WireGuard. If it's "protect the family's traffic everywhere," a reputable paid VPN is the honest answer.

How we measured

Method, so you can repeat or audit it: OPNsense 26.7 as a serial-console image on a KVM virtual machine (2 vCPU, 1.5 GB), with two small Linux client VMs on a private virtual bridge — no physical network or uplink was touched. Single-interface gateway with packet forwarding enabled. Boot milestones were timed by script against UTC timestamps; idle memory came from the hypervisor process's resident size, sampled over 13 quiet minutes; the failed iperf3 attempt is retained. One note for tinkerers, because it cost us real time: the DVD ISO booted to a silent console under headless virtualisation in two boot-argument variants; the serial-console image booted clean first try. Automators: take the serial image. ISP and hardware prices were read from live public pages on 2026-10-31, not cached reviews. What we did not have this run: a physical box inline as a live household gateway, and a completed throughput test. The two timed boot rows and the idle rows are ours; the rest is labelled as unmeasured.

Verdict

OPNsense is free, boots in under a minute, sleeps on 1.5 GB, and gives a home network the controls the ISP box was always hiding. It is not savings — at NZ rental prices the hardware never pays for itself — and it is not plug-and-play: expect one console-level fix on day one, an evening of learning, and shorter ISP support calls the moment you go BYO. A virtual machine is the zero-cost way to try it; if it clicks, an entry-class mini-PC makes it permanent.

One rule outlives every configuration choice: change one thing, test it, keep a screenshot of the working config before the next change. Home firewalls don't fail politely — a wrong rule can isolate the whole house, and the fix is at a console screen. Treat OPNsense as furniture and you'll be frustrated; treat it as a small network you now own and you'll wonder what the rental box was ever for.