Build a secure home network with a mini PC and OPNsense; and manage it with FrontierStack

Published 2026-08-29

There is a particular kind of frustration in renting a router you are not allowed to replace. Some ISPs lock their gateway down, throttle it, fill it with ads, or; as in the video that inspired this post; cut a customer off for daring to use their own hardware. The good news: you can put a real firewall in front of everything, keep the ISP happy, and run a genuinely private, monitored network at home. This is how, and how to keep it healthy afterwards.

We will skip the case and focus on what matters: the hardware, the OPNsense setup, the one clever trick that gets you past an ISP that checks which device is connected, and then the part most guides leave out; how to actually keep an eye on the thing once it is running.

The hardware: a small, silent firewall appliance

You do not need a rack or a noisy 1U server. A low-power x86 mini PC with at least two 2.5-gigabit network ports is plenty for a home line, and it runs cool and silent. A popular, well-matched choice is a ZimaBoard 2 (an Intel N150, passively cooled, with dual 2.5GbE on board); its firewall kit adds a PCIe Intel I226 card for extra ports, so you can carve out separate networks later. Any comparable fanless mini PC with Intel i225/i226 NICs works just as well; avoid cheap Realtek 2.5GbE ports, which are fussy under BSD.

A minimal, capable shopping list:

• The firewall box; a fanless x86 mini PC, 2+ Intel 2.5GbE ports, 8–16 GB RAM, a small SSD/eMMC. (A ZimaBoard 2 firewall kit is a clean turnkey option.)
• Your ISP's ONT or modem; kept in bridge/pass-through mode if it offers it, so the OPNsense box does the routing.
• A managed switch (VLAN-capable) if you want separate networks for trusted devices, work, IoT and guests.
• One or more access points; ideally ones that can broadcast multiple SSIDs mapped to VLANs.
• Ethernet cable, and a way to reach the box's console/web UI for the first-time setup.

Getting past an ISP that only trusts its own gateway

Here is the trick from the video, explained properly. Many ISPs authenticate the connection by the MAC address of the device plugged into their line; and they often expect that MAC to belong to their equipment. The first three bytes of any MAC address are the OUI (Organizationally Unique Identifier), which identifies the hardware maker. If you plug in your own router with a totally different MAC, the ISP may refuse to hand out a connection, or serve a captive "unauthorised device" page.

The workaround is to make your OPNsense WAN present the same MAC the ISP already trusts. In the video, Wireshark is used to watch the traffic between the ISP's own gateway and the line and read off that gateway's real MAC address (a random, made-up MAC won't do; its OUI wouldn't match a real vendor, which is a dead giveaway of spoofing). You then clone that MAC onto the OPNsense WAN interface. To the ISP, nothing changed; behind that address, you are now running your own firewall.

OPNsense makes the cloning itself trivial; the interface settings for WAN have a "MAC address" field; paste the captured address there (if your WAN is a VLAN sub-interface, set the MAC on the parent physical NIC). Reconnect, and the DHCP lease comes through as if the ISP box were still in place.

The OPNsense setup, step by step

Download the OPNsense installer, write it to a USB stick, and install it to the mini PC's SSD. On first boot, the console asks you to assign interfaces; one NIC becomes WAN (to the ISP), one becomes LAN (to your switch/APs). Then open the web UI from a machine on the LAN and work through:

• WAN; usually DHCP from the ISP. This is where you paste the cloned MAC from the step above. Leave the default block-private/block-bogon rules on.
• LAN & DHCP; pick your subnet, enable the DHCP server, and hand out the OPNsense box as the gateway and DNS resolver.
• VLANs; the real payoff. Create separate VLANs for trusted, work, IoT and guest, tag them on the switch, and map each to an SSID on your access points. Firewall rules then keep IoT and guests from reaching your trusted devices; a smart bulb should never be able to see your NAS.
• Firewall rules; default-deny between VLANs, allow only what each network needs out to the internet. Log the blocks so you can see what is trying to talk.
• DNS with ad-blocking; OPNsense's built-in Unbound resolver has DNS blocklists; point it at a few well-known lists and every device on the network gets ad- and tracker-blocking with nothing installed on the clients. (Or run AdGuard Home / Pi-hole alongside.)
• Intrusion detection; install the Suricata (Intrusion Detection) plugin, enable it on WAN, and subscribe to a ruleset. It watches for known-bad traffic and raises alerts; the difference between "something is off" and knowing exactly what tripped.
• A VPN home; add WireGuard so you can reach your own network securely from anywhere, instead of exposing services to the internet.

That is a complete, private, segmented home network on hardware you own; no rented gateway deciding what you may run.

The part guides skip: keeping it healthy

A firewall is not "set and forget." A WAN line can drop, an interface can lose carrier, a service can die, Suricata can start firing, someone can hammer the admin login, firmware can fall behind. On a home setup you usually find out when the internet is already down. This is exactly where FrontierStack earns its place; it turns your Mac into a quiet operations console for the network you just built.

Add the OPNsense box in FrontierStack's Router & Network pane with its address and an API key (create one under System › Access › Users), and it manages the firewall over the router's own REST API; nothing is installed on the appliance:

• Continuous monitoring; every alert sweep polls the firewall for WAN-gateway state, interface carrier and service health, so a dead ISP line raises a named alert (to Telegram, Slack, email, SMS…) instead of an unexplained outage.
• Intrusion & attack signals; FrontierStack reads Suricata's recent alerts over the same API and turns the router's dot orange the moment an intrusion is detected; it also flags an admin brute-force (naming the busiest source IP), resource stress, an unexpected reboot, or outdated firmware.
• Live status & sampling; version, uptime, load and per-interface throughput on demand, without opening the web UI.
• Reboot and drive it; reboot the router through its API from the pane (or ask the AI Administrator), and jump straight to its Firewall-rules or IDS page when you need to make a change; FrontierStack monitors these appliances but leaves rule edits to the router's own config system, so it hands you the native page rather than fighting it.
• Join it to your VPN mesh; one of the nicest touches: FrontierStack can onboard an OPNsense router to Tailscale without any browser login on the router. Sign in to Tailscale on your Mac, mint a pre-auth key, paste it in the device pane, and it installs the os-tailscale plugin and connects; a private path to your firewall from anywhere.
• Ask in plain language; the AI Administrator can report a router's status and security signals, reboot it, and offer to open its Web UI for a task that belongs there.

So the division of labour is clean: you build the network once; the mini PC, the MAC clone, OPNsense with its VLANs, IDS, DNS blocking and VPN; and FrontierStack keeps it observed, alerting and one click from action for as long as it runs.

Start with the remote & network guide, see the solutions for more build ideas, and download FrontierStack to manage the firewall you just built.