Tech Vault

Firewalls and router firmware

Your provider's router already blocks unwanted connections from the internet. Replacing it is worth the effort when you want separate networks for guests and smart gadgets, a VPN at the front door, or a connection that stays responsive while someone uploads.

Checked 9 November 2026

Our pick

OPNsense

Turns a small PC with two network ports into a full firewall and router. It installs from a USB stick through a few menus, with no commands to type, and everything after that happens in a clear web page. It handles separate networks (VLANs), WireGuard and OpenVPN, whole-house ad blocking through its DNS blocklists, and intrusion detection. It's free and open source, with two major releases a year.

opnsense.org
Cost
Free
Good for
Someone ready to give the internet connection its own small, always-on computer.
Watch out for
It needs its own hardware, ideally with Intel network ports, and it has no Wi-Fi, so keep your old router as an access point. A wrong setting can take the whole house offline, so make changes when nobody needs the internet.

What a firewall and router firmware are

A firewall decides which connections are allowed in and out of your home. Your provider’s router already has one, and by default it turns away connections from the internet that nobody inside asked for. That’s why most homes are reasonably safe without anyone touching a setting.

Router firmware is the software that runs the router. Providers’ versions are built to keep support calls down, so they often hide settings, update slowly, or stop updating once the model gets old. Replacing that software, or putting a proper firewall in front of the router, gives you control.

Do you need this at all? Decide first

For most homes the honest answer is “not yet”. Change the router’s admin password, turn off WPS (push-button Wi-Fi pairing) and UPnP (which lets devices open ports by themselves), install its updates, and you’ve covered what most households need. That’s the “provider’s router, tidied up” option below.

It’s worth going further when you want one of these:

  • Separate networks. Smart plugs, cameras and guests on a network of their own, so a cheap gadget with poor security can’t see your server or laptops. These are called VLANs: virtual networks that share the same cables but can’t see each other.
  • A VPN at the front door, for reaching the whole home network from outside.
  • A connection that stays usable when it’s busy. When one person uploads a large file, games and video calls for everyone else can stutter. This is called bufferbloat, and both OPNsense and OpenWrt have settings that fix it.
  • Updates again. If your router no longer gets security fixes, OpenWrt or OPNsense brings them back.

Which kind to choose

Your router, tidied up OpenWrt OPNsense
Hardware What you have Your router, if it’s on OpenWrt’s supported list A small PC with two network ports
Wi-Fi Built in Built in None. Keep a router as an access point
Time to set up Under an hour An evening A weekend, the first time
What you gain The basics VLANs, WireGuard, a smooth connection under load All of that, plus intrusion detection, detailed logs and room to grow

OpenWrt suits a router that’s on its supported list, with nothing to buy. OPNsense is the pick because it does everything on the list from one clear web page, on ordinary PC hardware you can replace or upgrade.

What OPNsense needs

  • A small PC with at least two network ports, one for the internet and one for your home. A used mini PC or a small box sold for the job both work. It must have an ordinary 64-bit PC processor (x86-64), so a Raspberry Pi won’t do. OPNsense recommends a multi-core processor, 8 GB of memory and a 120 GB SSD, and gives 3 GB of memory as its minimum.
  • Intel network ports, ideally. OPNsense’s own documentation calls them reliable, and some other makes have a history of trouble.
  • A Wi-Fi access point. OPNsense has no Wi-Fi. Most home routers can switch to access point mode, so your current one can do this job.
  • A USB stick of at least 1 GB for the installer, and a screen and keyboard to plug into the PC while you install.
  • A quiet evening. While you swap things over, the house has no internet.

How OPNsense fits in

Once it’s installed, everything happens in a web page:

  • Firewall rules. Decide what each network may reach, such as letting your laptop see the cameras but not the other way round.
  • VLANs. Separate networks for gadgets and guests, carried over the same cables and access points, as long as they support VLANs.
  • VPNs. WireGuard and OpenVPN, under the VPN menu.
  • Ad blocking. Its DNS service can use blocklists, so adverts and trackers are blocked for every device in the house.
  • Intrusion detection. It can watch traffic for known attack patterns, and warn you or block them.
  • Traffic shaping. Keeps the connection responsive while someone uploads.
  • Updates and backups. Updates install from the web page, and the whole configuration downloads as one file from System, Configuration, Backups.

The easy way to set it up

You don’t type commands to install OPNsense. The installer is a menu you move through with the arrow keys, and everything after it happens in your browser.

  1. Download the “vga” image from opnsense.org. It’s the USB stick version for a PC with a screen. The download is compressed, so unpack it first (7-Zip does this on Windows).
  2. Write it to a USB stick with balenaEtcher or Rufus, free programs with an ordinary window.
  3. Start the PC from the stick and log in with the user name installer and the password opnsense, which the official installation guide gives. Choose ZFS when it asks (the disk format the guide calls the most reliable), pick the PC’s drive, and set a new password for root, the administrator account. The drive is wiped.
  4. Tell it which port is which if it asks: LAN is your home, WAN is the internet. Label the ports with tape.
  5. Connect a laptop to the LAN port and open https://192.168.1.1. The browser warns about the certificate the first time, which is expected. Log in as root with your new password and follow the setup wizard.
  6. Avoid an address clash. If your provider’s router will stay in front and also uses addresses starting 192.168.1, change OPNsense’s LAN address in the wizard to something like 192.168.10.1.
  7. Swap it into place. Put the provider’s router into bridge or modem mode, which turns off its own routing, and connect it to the WAN port. Set your old router to access point mode, so it only provides Wi-Fi, and connect it to the LAN port.
  8. Download a configuration backup before you change anything else, and again after each big change.

If you’d rather keep your router and try OpenWrt, look up your exact model and hardware version in OpenWrt’s Table of Hardware, download the “factory” file for it from the OpenWrt Firmware Selector, and install it from your router’s own firmware update page. Its settings page then opens at 192.168.1.1. Some models need a more involved method, and the Table of Hardware says which.

Questions people ask

Will my internet be slower?

Not if the hardware suits the job. A modern mini PC with Intel ports keeps up with most home connections with the basic features switched on. Intrusion detection works the processor much harder, so run a speed test with it on and off before you leave it running.

What if I break the internet?

Keep the provider’s router and its cables. Plug them back the way they were and the house is online again while you work out what went wrong. With a recent configuration backup, you can then restore OPNsense to the last setup that worked.

Do I still need my provider’s box?

Usually, because it’s what connects to their line, and most have a bridge or modem mode that hands the routing over to OPNsense. With fibre there’s often a separate box on the wall, and OPNsense can plug straight into that. Some providers need a login or a VLAN number on the WAN port, which their support pages list. Failing both, OPNsense can sit behind the provider’s router, at the cost of “double NAT”, which upsets port forwarding and some online games.

Is OPNsense safer than my provider’s router?

Out of the box, both block unwanted connections from the internet. What OPNsense adds is control: separate networks, regular updates and a record of what’s happening. A wrongly set rule can make it less safe, so change one thing at a time and test after each change.

Also good

Skip

Next