What does a firewall device need?
① Multiple independent network ports — at least WAN + LAN, and more for network segmentation;
② 24/7 stable operation;
③ The ability to run FreeBSD or Linux. Commercial firewall hardware meets these criteria, but the price is not low. An X86-based Embedded industrial pc satisfies all three naturally — at a lower cost and with richer interfaces.
OPNsense and pfSense are built on FreeBSD and require an x86 platform. An Embedded industrial pc happens to be exactly that: x86 architecture, fanless design, multiple Ethernet ports, and wide-temperature / wide-voltage tolerance for industrial environments. The two are a natural fit.
They share the same origin — OPNsense is a fork of pfSense — but each has evolved independently for years:
Community consensus: For a friendlier interface, go with OPNsense. For those accustomed to a traditional workflow, pfSense is equally reliable.
A network engineer at a small factory shared his approach. The problem was textbook: office computers, production-line equipment (PLCs, HMIs), and IP cameras all sat on the same subnet — compromise one device and the entire network was exposed.
His solution: run OPNsense on an X86 Embedded industrial pc and divide the network into isolated segments using multiple physical ports:
Core firewall rule logic:
Physical isolation is safer than pure VLANs — each port maps to a separate physical network, so even a misconfigured switch won't cause cross-segment traffic.
The primary hardware requirement for running OPNsense/pfSense is the number of Ethernet ports. Two ports handle only basic WAN/LAN isolation; multi-segment segmentation needs at least 4–5 ports.
PUSR EC500 is a strong match: Intel i5-7200U dual-core, four threads — more than enough for OPNsense + Suricata IDS. It has 5 RJ45 Gigabit Ethernet ports: WAN + 4 independent LAN segments, enabling physical isolation without an extra switch. DC 12–36V wide-voltage input, aluminum fanless cooling, and a -25°C to +75°C operating temperature range suit it for industrial sites.
For lighter scenarios — basic WAN/LAN isolation only —PUSR EC100 with an Intel 12th-gen J6412 and 2 RJ45 ports also works. Paired with an 802.1Q-capable managed switch, it can run a router-on-a-stick configuration and extend network segments via VLANs.
Not every scenario calls for a full OPNsense deployment. When the requirement is simply "routing + VPN + basic firewall," an ARM-based Embedded industrial pc ships with these capabilities built in.
PUSR EG528(RK3562 quad-core Cortex-A53 @ 2.0GHz, Ubuntu 24.04) includes the WukongEdge engine, which integrates routing, VPN, and firewall functions. Its two Gigabit Ethernet ports connect to WAN and LAN respectively; combined with iptables/nftables rules, it provides basic access control and network isolation. This fits remote-site gateways, edge data-acquisition nodes, and other lightweight isolation use cases.
Using EC500 + OPNsense as the example, the full process takes seven steps:
① Install the system— Download the OPNsense ISO, write it to a USB drive with Rufus, boot from USB, and follow the installer wizard. Assign WAN and LAN interfaces during setup.
② Initial configuration— Access the web interface via the LAN port (default: https://192.168.1.1), set the admin password, and configure the WAN port for PPPoE or DHCP.
③ Create network segments— In Interfaces → Assignments, assign each physical port to an interface and set the gateway IP for each subnet.
④ Configure DHCP— Enable the DHCP server on each segment. Bind static IPs to fixed devices (PLCs, NVRs) via MAC reservation.
⑤ Write firewall rules— The critical step. The default policy is deny-all; add allow rules one by one. Start with the most important rules (e.g., office-to-production Modbus access), then add DNS, NTP, and other essential service rules.
⑥ Enable IDS/IPS (optional)— Install the Suricata plugin. Run in IDS mode first to observe logs; once false positives are identified, switch to IPS for active blocking.
⑦ Configure VPN (optional)— Set up WireGuard. It outperforms OpenVPN and allows assigning different access levels to different users.
Prefer Intel NICs.OPNsense/pfSense has the best support for Intel network chips. Realtek chips may drop packets under heavy load. The EC500 uses an Intel platform, ensuring driver compatibility.
Don't run other services on the firewall.The firewall is the one device that must never go down. Community feedback is unanimous: let the firewall do only firewalling.
IDS before IPS.Enabling Suricata in IPS mode right away risks blocking legitimate traffic. Run in IDS mode for a week, review the logs, identify false positives, then gradually enable blocking rules.
Back up the configuration.OPNsense supports exporting an XML configuration file. Save a copy after every major change — restoration is a simple import, no need to rebuild from scratch.
