Fanless firewall mini PC for OPNsense: Protectli vs Qotom

A firewall box should be the quiet little computer you forget about—until you want to try a new rule, VPN or VLAN. Choose the Protectli Vault V1410 for a genuinely fanless, four-port OPNsense appliance. Choose the Qotom Q10922G6-S08 if six ports matter more than having no fan: the exact configuration linked here has an auxiliary micro-fan.

That distinction is worth catching before you order. Both give you Intel 2.5GbE controllers in a dedicated wired box, leaving your switch to handle ports and your access points to handle Wi-Fi. Buy the firewall for those jobs, not for a forest of antennas.

Specs from Protectli, Qotom and Intel; setup guidance from OPNsense and Netgate, checked October 25, 2026.

For a recovery connection outside the web interface, our USB serial console guide separates RJ45 RS-232, DB9 and integrated USB consoles, with the OPNsense line settings.

Pair the firewall with a managed switch for homelab VLANs to carry separate IoT, camera, guest and lab networks over one uplink.

Protectli vs Qotom: the configurations to compare

Appliance and best fit	Hardware and what you add
Protectli Vault V1410: the pick when you want a passive four-port appliance with a documented coreboot route.	Intel Celeron N5105, four cores/four threads, 2.0GHz base and up to 2.9GHz; AES-NI. Four Intel i226-V 2.5GbE ports. Fixed 8GB LPDDR4 RAM and 32GB eMMC; selected configuration has no NVMe SSD and no OS. M.2 2280 NVMe slot. Ships with AMI BIOS; coreboot supported. Fanless aluminum chassis; maker maximum power usage 27W.
Qotom Q10922G6-S08: the six-port alternative when you want more physical interfaces and accept hybrid cooling.	Intel N100, four cores/four threads, up to 3.4GHz; AES-NI. Six Intel i226-V 2.5GbE ports. Selected configuration is barebones: add DDR5 RAM, an SSD and the OS. One SO-DIMM, maker maximum 16GB; M.2 2280 NVMe, PCIe 3.0 x1. UEFI install route. Selected configuration has an auxiliary micro-fan. Maker adapter rating 12V/5A; Intel CPU TDP 6W.

The V1410 datasheet and Qotom family specifications supply the board details. Qotom’s family page says “fanless”; its own selected configuration description specifies the extra fan. For a no-fan requirement, pick Protectli.

Protectli V1410: four ports, fixed RAM, your SSD

The V1410 is the straightforward pick for a firewall with a WAN connection, a LAN connection and a couple of spare interfaces. You get the memory already fitted, but the 8GB is soldered. Choose a different platform if your plan needs more RAM later.

Add an M.2 2280 NVMe SSD for the OS. Protectli recommends NVMe rather than the onboard eMMC for demanding operating systems. That turns “32GB included” into the right buying decision: the eMMC is there, but an SSD belongs on your OPNsense shopping list. The maker product page documents both the fixed memory and storage recommendation.

The selected configuration ships with AMI BIOS. Protectli also documents coreboot support for the V1410 and its Flashli firmware tool. If open firmware is part of your project, that model-specific documentation is a reason to choose it. Install OPNsense on the supported firmware you have first; changing firmware can be a separate project.

Qotom Q10922G6-S08: buy it for six interfaces

Qotom’s attraction here is simple: six Intel 2.5GbE ports. You can keep more segments on separate cables, leave room for another WAN, or build a routing lab without immediately running out of sockets.

Match the full model name, Q10922G6-S08, to the N100 configuration. The maker’s series page lists several different CPUs under one family. A family name is the start of the search; the full model and configuration finish it.

This one needs a DDR5 SO-DIMM and an NVMe SSD before installation. Qotom lists a single memory socket supporting up to 16GB and an M-key 2280 SSD position with PCIe 3.0 x1 connectivity. Its published OS support uses UEFI. Keep to that install path rather than borrowing a coreboot image intended for a Protectli board.

Intel lists AES New Instructions for the N100. That is a useful CPU feature for encryption work; size the appliance around the VPN, filtering and inspection features you intend to enable. Clock speed and Ethernet link speed are different entries on the shopping list.

How many ports do you actually need?

Two physical interfaces cover the basic job: one WAN and one LAN. A managed switch can then fan out that LAN and carry several VLANs over a tagged trunk. More firewall ports are useful when you want physical separation, another upstream connection or a separate test segment.

Port plan	What remains on the appliance
V1410: one WAN + one LAN/trunk	Two spare physical ports
Q10922G6-S08: one WAN + one LAN/trunk	Four spare physical ports
Three logical networks over one tagged LAN trunk	One physical LAN link, shared by those networks

OPNsense’s VLAN guide explains how multiple tagged networks share a link and how firewall rules control traffic between them. For its recommended firewall-to-switch design, use a tagged-only trunk, with only the intended VLAN memberships on the switch port. Keep console access available while moving management onto the new layout.

You can start with a plain LAN, learn the firewall, then introduce VLANs. Our 2.5GbE switch guide separates unmanaged plug-in models from managed options. If VLANs are the plan, choose the latter; extra firewall ports don’t add management features to an unmanaged switch.

RAM, thermals and power: buy for the workload

OPNsense’s recommended hardware table lists 8GB RAM and a 120GB SSD, alongside a multi-core processor. Its sizing guide makes the intended feature set central: inspection, connection counts and other services change the work the CPU, memory and disk must do.

Start with the firewall features you need, then test that workload before adding every available plugin. For a dedicated appliance, it is nice to keep experiments that need lots of RAM on another host.

Give the passive V1410’s fins open air. Avoid sandwiching it between warm boxes or enclosing it in an unventilated cupboard.

Keep power figures in their lanes. Protectli’s 27W is a published maximum system figure; Intel’s 6W is the N100 CPU TDP. Qotom’s 12V × 5A adapter rating works out to 60W of rated output capacity. None of those is an idle reading for a complete installed firewall. Put your finished appliance on a wall meter when you want to calculate its running cost.

First boot: get the boring bits right once

Use the official OPNsense installation instructions for the current release. Here is the short path for a display-and-keyboard install:

1. Fit the storage and memory. V1410 already has its RAM; add the NVMe SSD. Fit the Qotom’s DDR5 module and SSD. Connect a display and keyboard so you can see boot and interface assignment directly.
2. Prepare the installer. Download the amd64 VGA USB image, verify the download as the OPNsense guide describes, decompress it and write the image with a supported tool such as Etcher. Choose the USB drive carefully.
3. Boot that USB in UEFI mode. In the live environment, use the installer login with password opnsense to start installation. Select the internal SSD as the target, follow the filesystem prompts and set a new root password.
4. Finish installation and remove the USB. Reboot into the SSD installation. Keep the display attached until the appliance boots cleanly.
5. Assign WAN and LAN deliberately. Use the interface-assignment prompt or the console’s Assign interfaces option. Match interfaces to the actual connected sockets and link state; work through one cable at a time. Don’t assume a printed WAN label or the first interface name is your finished assignment.
6. Open the web interface from LAN and complete setup. Confirm that management works from the intended LAN connection before building the VLAN layout.
7. Update. Open System → Firmware → Status, choose Check for updates and install the available production updates. The OPNsense update guide covers that workflow.
8. Export the working configuration. Use System → Configuration → Backups, protect the export with a password and keep the XML somewhere you can reach if this appliance is down. The backup documentation explains export and restore.

Then test a reboot, LAN management access and the traffic rules you intended. Export another configuration after the VLAN and VPN work. That small file is a much better recovery plan than trying to remember which checkbox made everything work.

Prefer pfSense? Follow Netgate’s official installer-download route, using the AMD64 memstick image for these x86-64 appliances. The download uses a Netgate Store account. Keep its installation procedure separate from the OPNsense steps above.

Build the rest around the firewall

A dedicated wired appliance leaves Wi-Fi to an access point. Our Omada vs UniFi PoE AP guide covers that route; the Wi-Fi 7 router guide covers the combined-router alternative if you prefer fewer boxes. Decide which device owns routing before adding the wireless side.

For remote access, use our Tailscale vs Cloudflare Tunnel decision guide to choose the access model. For power protection, the small-rack UPS guide helps you keep the firewall, upstream equipment and switch running together.

Buy the V1410 when four ports and fixed 8GB RAM fit your plan and you want passive cooling. Buy the Qotom Q10922G6-S08 when six ports earn their space and you’re happy to supply RAM and storage. Label the cables, save the configuration and give the little box some air. That’s a good start to a pleasantly uneventful firewall.