Thinking about replacing my UDM-SE with OPNsense on a Dell R640. Worth it?

Hey everyone,

I'm thinking about replacing my UDM-SE with a dedicated OPNsense firewall and wanted to get some opinions before buying the hardware.

My current setup is a UDM-SE with a 1 Gbps fiber connection (AON with PPPoE). I'm running IPS, geo-blocking, honeypot and encrypted DNS. Everything works fine, but whenever my internet connection is under heavy load, the CPU usage goes up to around 97%. I'm currently getting roughly 930 Mbps.

The main reason I want to switch isn't really the speed, though. I'd like more control over my firewall rules and security settings, which is why I've been looking into OPNsense.

I also host a few services that are accessible from the internet, including web servers, some game servers and backup services for friends. So having a properly configured firewall with good IPS protection is pretty important to me.

I found a Dell PowerEdge R640 for €289 with:

– 2x Xeon Gold 6140 (36 cores / 72 threads total)
– 64 GB DDR4 RAM
– 2x 25G SFP28 ports
– iDRAC 9

I'm also considering an **Intel X710-DA2 (EX710DA2G1P5)** with 2x 10G SFP+ ports. This card would be used for the direct fiber uplink to my ISP, using my existing 1G AON SFP transceiver for now. The server's existing 25G SFP28 card would handle the 10G connection to my internal network.

The plan is to install OPNsense directly on the R640. I have multiple VLANs, a few Proxmox servers and VoIP running behind the firewall.

I'd like to run Suricata IPS permanently, along with PPPoE, DHCP, Unbound with encrypted DNS, inter-VLAN routing and fairly strict firewall rules.

I'm mostly wondering how well these older Xeons would handle all of that. I know 36 cores are probably overkill for a firewall, but I'm not sure how much of a difference the older single-core performance makes when running Suricata.

Has anyone here used similar hardware with OPNsense? I'd be interested in what kind of throughput you're getting with IPS actually enabled, especially with PPPoE.

I also have the option to upgrade my internet connection to 10 Gbps, but the monthly cost is still a bit too high for me right now. It's something I might consider in the future, though, so I'd like to have some headroom and avoid having to replace the firewall hardware again.

Power consumption isn't really a deciding factor for me. I'm more interested in getting a reliable firewall with good performance and plenty of room for additional security features.

Would you go with the R640, or would you recommend different hardware for this setup?

Thanks!