Advanced Networking

Network Segmentation covered VLANs on top of your existing consumer router. This page is about replacing that router entirely with something purpose-built - and being honest about when that's worth it.

Why replace your router at all

A consumer router (even a good one) usually can't do everything you might want: fine-grained firewall rules between VLANs, proper intrusion detection, multiple WAN failover, or routing between more than a couple of subnets without odd limitations. Running your router as a VM or dedicated box gives you a real firewall with rules you write yourself, rather than whatever the manufacturer's UI exposes.

pfSense vs. OPNsense

Both are free, open-source firewall/router distributions built on BSD, and either is a reasonable choice:

• pfSense - the longer-established option (Netgate), huge community and documentation base, but Netgate's community edition release cadence has slowed in recent years relative to OPNsense as they focus more on their commercial appliances - check the current release history before committing, since this has shifted before.
• OPNsense - a fork of pfSense with a cleaner, more modern web UI and more frequent releases. The more commonly recommended default for a new homelab setup as of this writing, but re-verify - this is exactly the kind of comparison that ages quickly.

Running it as a VM vs. dedicated hardware

Both run fine as a Proxmox VM, which is the natural fit if you're already running a cluster (see Proxmox Clustering and HA) - but think carefully about what happens to your entire network's internet access if that Proxmox node reboots for a routine update. Dedicated hardware (even a cheap fanless mini PC with two or more NICs) avoids that single point of failure, at the cost of one more physical box.

⚠️ Risk: if your router runs as a VM on the same cluster as everything else, a Proxmox node reboot takes down your entire network's internet access, not just one service. Either accept that trade-off consciously, or run the firewall on dedicated hardware separate from the cluster it protects.

Resource expectations: modest - 2 vCPU / 2-4GB RAM handles typical home internet speeds comfortably; multi-gigabit WAN or heavy IDS/IPS inspection (see below) wants more CPU headroom.

Extending VLAN trunking

With a real firewall in place, VLAN trunking becomes more capable than what a consumer router offers: distinct firewall rulesets per VLAN (not just "can/can't reach the internet," but specific port and protocol rules between segments), plus real logging of what's being blocked and why - useful when debugging why a device can't reach something it should. The underlying VLAN concept is unchanged from Network Segmentation; pfSense/ OPNsense just gives you a lot more control over what happens at the boundaries between them.

BGP and dynamic routing: usually not needed

Both platforms support BGP and other dynamic routing protocols, the kind of thing that automatically propagates route changes across multiple routers. This is genuinely rare to need at home - it exists to solve problems that show up with multiple routers exchanging routes automatically (ISPs, multi-site networks, large enterprise topologies), and a typical homelab has one router and one or two static routes at most, both trivially configured by hand. Only reach for this if you're specifically building a multi-site setup (see the "multi-site homelab" idea in the plan's backlog) or deliberately learning BGP for career reasons - not as a default homelab networking upgrade.

Next: Secrets Management.