This New Device is 10x Better Than Your Router

NetworkChuck Technology Careers Career & Money

About this video

In the first episode of a series building a home network for his editor Mike, Chuck replaces a consumer ISP router with a mini PC running OPNsense, the free, fully open-source firewall/router OS. He notes the FCC router-ban context but concedes existing home routers are grandfathered and not actually illegal; the point is that mass-produced routers are slow, insecure, and out of the owner’s control. He chose OPNsense over pfSense because, he says, pfSense closed-sourced its best version in 2021 behind a paywall. Any x86 hardware works (spare laptop, VM, or appliance), but you need at least two Ethernet ports, and crucially the box is only a router/firewall: a separate switch and wireless access point are still required and come in part two. Two hookup options are explained: simply plugging the OPNsense box into the existing router (double NAT, fine for testing) or putting the old gateway in bridge/pass-through mode so OPNsense gets the public IP. The walkthrough covers flashing the OPNsense image to USB with Etcher, installing with ZFS, fixing a missing Realtek NIC driver, assigning WAN/LAN interfaces, and logging into the web GUI at 192.168.1.1. He then hardens DNS: DNSSEC on, DNS-over-TLS forwarding to Cloudflare (1.1.1.1 on port 853), the option that would let DHCP override DNS servers unchecked, and Unbound blocklists (AdGuard, abuse.ch, OISD and others) that visibly removed ads in his before/after test, with reporting showing about 10% of queries blocked. A sponsor skit covers Bitdefender’s scam-alert service. Finally, he hands management to ‘Pig,’ a Hermes AI agent on a Raspberry Pi, giving it an OPNsense API key and the documentation. The agent passes three tests: adding Google as an additional DNS server (it initially used query forwarding and had to be corrected to DNS-over-TLS), creating a static DHCP reservation for his desktop, and blocking China by loading country CIDR feeds into firewall aliases after finding the built-in GeoIP source unconfigured.

Key takeaways

OPNsense on any x86 box replaces a consumer router with a free, open-source, owner-controlled firewall; he picked it over pfSense over its 2021 move to closed source
The firewall is only one piece: you still need a separate switch and wireless access point
Easiest install path is double NAT behind the old router; bridge mode is the cleaner full replacement
Built-in Unbound DNS gives DNSSEC, encrypted DNS-over-TLS to Cloudflare, and whole-house ad blocking with no Pi-hole needed
An AI agent (Hermes, named Pig) successfully managed the firewall via API key, including a GeoIP block of China built from CIDR feeds

Episode details: published August 14, 2026 · 23:04 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: this Raspberry Pi belongs on your wall · Next: You need to switch to Linux RIGHT NOW!! →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube