Intel N100 pfSense Firewall Build Review: Where It Tops Out

Intel N100 pfSense firewall build review verdict: buy the four-port Intel i226-V box for a WAN up to 1 Gbps. It can route 2.5GbE, idles at 10.5 to 12 W and runs pfBlockerNG and WireGuard. Skip it if you need multi-gig inline IPS, or WireGuard at full gigabit on pfSense CE, where one owner reports 700 to 750 Mbps.

The figures below come from Intel’s spec sheet, ServeTheHome’s review of the CWWK-designed fanless unit, Netgate documentation and Netgate forum owners. Forum results are community reports: one box, one config, each. Netgate’s sizing guidance warns that estimating white-box throughput “is difficult and inaccurate,” so read every number as a data point. Still deciding between DIY and an appliance? The appliance versus DIY comparison covers that first.

What is inside a typical N100 firewall box?

A typical N100 firewall is a fanless aluminum chassis around a four-core, four-thread Alder Lake-N CPU with a 6 W TDP, one SO-DIMM slot, M.2 NVMe storage and four Intel i226-V 2.5GbE ports. ServeTheHome paid $216 barebones in mid-2023 and measured 10.5 to 12 W at idle.

Two rows matter more than they look. One memory channel means one stick: 8 GB is plenty for routing, and 16 GB, Intel’s listed maximum, covers Suricata, which Netgate sizes at 1 GB minimum and 2 GB or more for some configurations. Each i226-V also hangs off a single PCIe lane, so four NICs use four of nine and leave the rest for NVMe. Everything here clears Netgate’s minimum requirements (64-bit amd64, 1 GB RAM, 8 GB disk) with room to spare; the pfSense hardware requirements guide covers sizing beyond that floor.

Two-SFP+ variants add an Intel 82599ES, and both 10G units STH reviewed had fans despite the heatsink styling. Treat “fanless” as a claim to verify.

How fast is an N100 running pfSense?

For routing and NAT, an N100 with correctly trained i226-V links fills a 2.5GbE port. Encryption and inline inspection are where it slows: owners report 700 to 750 Mbps of WireGuard on CE, 550 to 575 Mbps of OpenVPN after power tuning, and inline Snort falling to 200 Mbps down on a gigabit line.

Routing. The HUNSN owner’s 1.5 Gbps ceiling was not the CPU. pciconf -lcv showed igc0 and igc1 linked at speed 2.5(5.0), PCIe Gen 1, while igc2 through igc4 ran at the full 5.0 GT/s. A Gen 1 x1 link carries about 2 Gbps after 8b/10b encoding, short of 2.5GbE line rate. A vendor BIOS update fixed all five ports and raised the default PL1, PL2 and PL4 power limits.

WireGuard. In one CE throughput thread, a tunnel that saturated a 1 Gbps symmetric line with pfSense Plus at both ends dropped to about 700 to 750 Mbps once the home end became an N100 on CE 2.7.2. Replies pointed at different hardware crypto support between editions. The thread does not separate CPU from software, so it is one data point; the Plus vs CE breakdown covers the edition and licensing side.

Calibrate “saturate” against Netgate’s WireGuard math: on a 1 Gbps link WireGuard cannot exceed 910 Mbps after framing overhead, and Netgate measured 909 Mbps on a four-core C3558 Atom with kernel WireGuard and MSS set to 1380. WireGuard uses ChaCha20 with Poly1305, so AES-NI does nothing for it; AES-NI accelerates AES-GCM in IPsec. If you are still choosing a protocol, read the OpenVPN DCO vs WireGuard comparison.

IDS/IPS. Snort is the trap. On a Topton N100, inline mode cut a 940/940 Mbps line to 200 down and 420 up. Package maintainer bmeeks explained that “Snort is a single-threaded application, so it can only utilize a single CPU core” and pointed to multithreaded Suricata. Suricata inline on another Topton N100 held a gigabit uplink with a worst iperf3 run of 814 Mbps, at default 6 W / 25 W power limits after Speed Shift, PowerD and C-state changes. The Snort vs Suricata comparison covers the netmap inline requirements both engines share.

Where the N100 wins and where it loses

Wins:

• Efficiency. STH measured 10.5 to 12 W idle and 22 to 23 W peak, with temperatures that never reached 50 C.
• Generational jump. STH saw 30 to 40 percent gains over earlier E-core designs at the same core and thread count.
• Driver maturity. The i226-V gained support when pfSense CE 2.7 moved to FreeBSD 14, per STH’s release coverage. Realtek 2.5GbE variants are the worse bet: pfSense 2.8.0 shipped realtek-re-kmod 1.100.00, which a forum user reported hangs the interface when IPv6 is enabled. The workaround was a community-built package.

Losses:

• Stock power limits. In the Topton “402 MHz” thread, owners traced weak OpenSSL results to a shipping PL1 of 6 W and efficiency-biased Speed Shift. Raising PL1 to 9 W helped. That 6 W matches Intel’s TDP, so going higher trades heat for speed in a passive chassis. Some of those menus were only reachable through a modified BIOS, a brick risk you should not take on your only gateway.
• Firmware quality. Gen 1 PCIe link training and infrequent BIOS releases are board-vendor problems no pfSense setting fixes.
• Single-core ceilings. Snort inline and single-tunnel VPN throughput depend on per-core speed, and the N100 tops out at 3.4 GHz.

How to build and verify an N100 pfSense box

Buy the barebones unit, add one SO-DIMM and an NVMe SSD, update the BIOS, then set Speed Shift and crypto options before measuring throughput through the firewall. STH’s configured unit cost $116 more than barebones for 16 GB DDR5 and a 512 GB NVMe, so price those parts separately before accepting a bundle. For the board-level NIC and power checks behind the purchase, read the Intel N100 firewall build guide.

1. Confirm “Intel i226-V” in the listing text. “2.5G” alone can mean Realtek.
2. Match the SO-DIMM to the board’s memory generation. Intel’s spec allows DDR4 or DDR5, and boards pick one.
3. Flash the latest BIOS from the board vendor’s own download page, then check PL1 and PL2 if the BIOS exposes them.
4. Install pfSense with the initial setup guide.
5. Under System > Advanced > Miscellaneous, enable Speed Shift at Core level. The Power Preference slider defaults to 80, biased toward efficiency; lower values favor performance. Load AES-NI and BSD Crypto Device, which Netgate calls the optimal configuration in most cases.

Then burn it in from a LAN client against a host on the WAN side. Running iperf3 to the firewall itself measures pfSense’s own stack, not forwarding.

pciconf -lcv igc0                       # want: link x1(x1) speed 5.0(5.0) on every igc port
sysctl dev.cpu.0.freq                   # check under load; should climb well past idle clocks
iperf3 -c 198.51.100.20 -P 4 -t 30      # LAN client -> WAN-side host, through the firewall
iperf3 -c 198.51.100.20 -P 4 -t 30 -R   # reverse direction

Repeat the iperf3 pair with Suricata running and with the WireGuard tunnel up. If a number collapses, check link speed and power limits before you buy a bigger box.

What you actually need

Most home networks need exactly the N100: a 1 Gbps WAN, a few VLANs and one VPN tunnel fit inside its envelope. Step up only where a profile below says so.

• 1 Gbps WAN, two to four VLANs, pfBlockerNG, WireGuard for phones: N100 with 4x i226-V, 16 GB and a small NVMe. Pair it with the VLAN setup guide and pfBlockerNG setup.
• 2.5 Gbps WAN, routing only: still an N100, once pciconf shows Gen 2 links on every port.
• Inline Suricata on every interface, or several gigabit VPN tunnels: the i3-N305 doubles the cores to eight at a 15 W TDP but keeps one memory channel and 16 GB. More cores help Suricata, not Snort.
• You want a vendor to call: buy a Netgate appliance with published numbers; see best pfSense hardware for 2026.
• You already run Proxmox: an N100 can host pfSense as a VM, per the Proxmox install guide, but every host reboot takes your gateway down with it.

FAQ

Does pfSense CE support the Intel i226-V?

Yes. pfSense CE 2.7, released in mid-2023, moved to FreeBSD 14 and brought driver updates including the Intel i226-V, which uses the igc driver. Current CE 2.9.0 is built on FreeBSD 16-CURRENT. Driver support does not fix board firmware, so still check each port’s PCIe link speed with pciconf after installing.

Why is my N100 pfSense box not hitting 2.5 Gbps?

The usual causes are a NIC link trained at PCIe Gen 1, a conservative BIOS power limit, or a bad test. Run pciconf -lcv and look for speed 5.0(5.0) on each igc port, update the board BIOS, and run iperf3 through the firewall to a WAN-side host rather than to pfSense itself.

Can an Intel N100 run Suricata inline on pfSense?

Yes, at around a gigabit with tuning. One Netgate forum owner held a 1 Gbps uplink in Suricata inline mode with a worst iperf3 run of 814 Mbps, after Speed Shift, PowerD and C-state changes. Prune the ruleset, and avoid Snort inline on an N100: it is single-threaded and cut another owner’s line to 200 Mbps down.

N100 vs N305: which suits pfSense?

Buy the N100 unless you run multithreaded inspection or several VPN tunnels at once. The i3-N305 has eight cores to the N100’s four and a 15 W TDP against 6 W, with the same single memory channel and 16 GB maximum. Plain routing and NAT on a gigabit or 2.5GbE line gain nothing worth the extra heat. The N100 vs N305 vs N5105 firewall CPU comparison sets the three chips side by side.

Related across the network

• Firewall Power Consumption: N100 Idle Watts and Annual Cost — n100firewall.com
• OPNsense vs pfSense on an N100: Throughput, IPS and Power — n100firewall.com
• Best NIC for OPNsense: Intel i226-V, i350, and 10G Picks — opnsenselab.com