Richard is the PC Hardware Lead at XDA and has been covering the technology industry for almost two decades. He's been building PCs since young, and when not creating content, you can often find him inside a chassis somewhere.
There's a good chance you're running an ISP-supplied router. That's not something to be fearful of. There's nothing inherently wrong with doing so, but you could be losing out on some enterprise-grade functionality for making the most of your local area network (LAN). If you're serious about creating a home lab and self-hosting as much as you can to save money, building your own firewall and router may be a worthwhile project. It's what I did, and I just wish I did it sooner. All you need is a cheap, passively cooled mini PC.
For less than $200, you can have a custom router up and running in no time.
Why replace your ISP router?
It makes more sense than initially thought
I've been running my own router for a few years now. Prior to this, I relied on my ISP's routers. They aren't as bad as they used to be. I recall in the early 2000s when routers were often slow, featureless, and generally terrible to work with. Aftermarket options were generally better, especially when spending a little more, but ISPs would typically ship out subpar solutions. Internet access was slow back then, and smartphones weren't even a thing yet.
I had never attempted a custom firewall at home because I never felt like we had the need. Even with network-attached storage (NAS) and a powerful PC at the ready, I still didn't feel the need to make the switch. That was until I started to self-host much more than Plex and some movies and shows. Even at that point, we still relied heavily on streaming services. The same went for storage with cloud subscriptions and the rest. We were spending a lot each month to keep ourselves entertained and all our data safe.
I started firing up Proxmox containers and virtual machines, having self-hosted services from home allowed us to cut costs and take full control of our data, but I required something slightly more potent than a standard ISP router. So, I turned to AliExpress and Amazon to find the cheapest passively-cooled mini PC. I had built myself a firewall with nothing more than a USB drive for the OPNSense installer, a $100 passively-cooled Intel-powered mini PC, a RAM kit, a spare NVMe SSD, and 10 minutes of my time.
How to pick the right mini PC
It's easier than you think
Prices aren't doing us any favors for technology, and building a custom firewall is no exception. The price of RAM is astronomical at the moment, and I don't see things changing any time soon. There are countless choices when it comes to passively cooled mini PCs that are ideal for running software like pfSense or OPNsense, two fine options for a DIY router. For me, I prefer OPNsense, but really, both firmware will work just fine. The two things to bear in mind while shopping are CPU and power draw.
This thing will be running 24/7 after all. You don't want it to suck too much power and increase your utility bill. While OPNsense and network traffic won't be terribly demanding for a system to handle, it's when you start getting real busy with data transfers and running plugins on the OPNsense installation that the CPU can come under fire. Even logging everything to see what's being used on the network can grind less-capable Intel chips to a halt, causing performance issues with the web interface.
My mini PC has an Intel N3700 CPU with four cores capable of bursting to 2.4 GHz with a TDP of just 6 watts. A maximum of 8 GB of DDR3L RAM may not sound groundbreaking, and it certainly won't win me any overclocking awards, but it's perfect for an application such as this where one doesn't wish for system power draw to be too high. For connecting the network together, the front plays host to four 2.5 GbE Intel networking ports, one reserved for the WAN link to our fiber box. Make sure you get a device with more than two LAN ports, unless you're using dedicated switches.
Most of these mini PCs can be purchased as barebone units, which is the route I recommend. This allows you to use your own RAM and storage, saving as much as possible in the process.
It can make a massive difference
Completely changing your network for the better
I love tinkering with the network and everything on it. It may not be everyone's idea of enjoyment, but it can provide scope for learning new things. OPNsense and similar solutions also help provide additional features that aren't usually found on ISP-supplied routers. With OPNsense installed, it was possible to quickly configure the virtual private network (VPN) to connect to our provider and load up network-wide protection. I configured outbound NAT, created a few rules to isolate IoT devices on their own VLAN, and enabled DNS filtering to block known malicious domains using Unbound.
I could configure and use Dynamic DNS (DDNS) through a domain provider to overcome the issue of dynamic IP addresses where the ISP would switch the public-facing IP of the home. This caused issues with pointing domains to services hosted on my servers. Advanced firmware such as OPNsense even has beefier features like Intrusion Detection System (IDS), and everything can comfortably run on a mini PC costing less than $200. Building your own router may not yet have crossed your mind, but it's something I strongly urge you consider.
Building my own firewall with OPNsense transformed my network with the deployment of advanced features. Creating and using VLANs alone will help segment your network and keep everything protected within its respective groupings. If you're serious about launching a home lab and adding Internet of Things products to your household, I can't recommend this process enough. Having full access to stuff like Unbound, ACME, NGINX, VLANs, enhanced controls, and