ok, so the host specs are as follows:
Intel NUC11TNHi50L
Intel i5-1135G7 (4c/8t) bsae clock 2.4 GHz, turbo is 4.2GHz
32 GB (2x16GB) Mushkin Redline DDR4 3200MHz, CL16
1TB Samsung 970 Evo Plus
2x 2.5Gb Intel i225-LM NIC
I'm currently using ESXi v8.0U1a, but I'm considering moving to Proxmox (working on getting a test system up with Proxmox).
OPNsense is running as a VM. Originally I had it running with 2 vCPU, 512 MB RAM, and 30 GB HDD space. Recently I bumped it up to 4vCPU, and 1 GB RAM, due to using openvpn and having several concurrently connected users, I was seeing higher utilization and wanted more headroom. I may need to assign more RAM still, I'm at 60% utilization there still.
Having this as a VM is nice, because:
Resource assignment changes are easy. shut down the VM, add/remove CPU/RAM, power up.
Rolling back from a failed upgrade is easy. Take a snapshot of the VM, install update(s), test, roll back to snapshot if needed. Delete snapshot if everything works fine.
My favorite part... the VM reboots in ~23 seconds.
I don't do anything too crazy right now in OPNsense, here's what it's doing:
OpenVPN setup for some friends to connect to game servers.
VLANs are routed here so I can use firewall rules instead of switch ACLs to manage traffic.
QoS to manage bufferbloat is in place.
Everything in my home that uses NTP syncs to OPNsense as the local time server (for now).
I've got netflow setup, but that really needs to be ingested elsewhere instead of it running on the firewall. Basically I need to setup another stack for monitoring and export netflow data from the firewall.
DDNS configured to update cloudflare for my domain
GeoIP filtering
In progress project is getting Wireguard configured for my phone, as OpenVPN, while nice, dstroys battery life on mobile devices in my experience.