My $75 Thin Client Ran My Home-Office Firewall for 90 Days: An OPNsense Diary
On August 13, 2026, I unplugged a consumer Wi-Fi router that had been rebooting during Teams calls and replaced it with a used HP t620 Plus thin client running OPNsense. The thin client cost $48 on eBay. An Intel dual-port NIC cost $27. Total: $75. I already had a spare 64 GB mSATA drive, which matters because the stock 16 GB flash is too tight for comfortable updates. This is the 90-day diary.
Day 0: The $75 Hardware Check
The t620 Plus came with 4 GB RAM, a power brick, and a small fan that is quieter than my old router. I added the Intel NIC because Realtek and OPNsense can work together, but the relationship is not always peaceful. The first gotcha: not every thin client is a firewall. Buy the model, not the category. You want AES-NI, a PCIe slot if you need more ports, and at least 4 GB RAM. A 2 GB machine with an 8 GB soldered flash drive is not a 2026-ready firewall.
Week 1: Install, WAN, and the Spouse Test
The OPNsense installer is friendly. The decisions are not. I picked the WAN and LAN interfaces, set a new password, and changed the LAN subnet to something less common than the default. The NIC ports came up in the opposite order from the labels, and I lost 30 minutes chasing a cable that was fine. The spouse test arrived quickly: OPNsense is not an access point. Wi-Fi disappeared, so I plugged in an old AP and promised to do VLANs later. Screenshot note: the interface overview looked clean once both ports were green, but the first attempt had WAN on the LAN side and vice versa.
Week 2: VLANs, DNS, and the First Video Call
I set up a trusted LAN, an IoT VLAN, and a guest network. Unbound handles DNS, and DHCP reservations keep the printers from moving. The first week of video calls was uneventful, which is the highest compliment I can give a router. I did not get magic bufferbloat removal until I added a traffic shaper. After that, upload-heavy file transfers stopped wrecking Zoom audio. This is the point where the project started to feel less like a hobby and more like infrastructure.
Week 3: WireGuard VPN and Remote Access
WireGuard was the feature that made the project worth it. Throughput topped out around 180 Mbps on this CPU, which is plenty for file access and remote desktop. The gotcha: firewall rules go on the WireGuard interface, not WAN. I learned that the hard way at 11 p.m. on a Tuesday. Once the rules were right, remote access was boring and fast, which is exactly what you want from a VPN.
Day 45: Power Bill Reality Check
A Kill-A-Watt meter showed 11 to 13 watts at idle and about 18 watts under VPN load. At a US average of roughly $0.17 per kWh, that is about $1.40 per month. My old consumer router pulled around 7 watts, so the difference is less than a dollar a month. The financial win is not power. It is not buying a $200 router every two years because the firmware went stale.
Day 60: The Update That Almost Broke My Sunday
A point release landed. I took a config backup, ran the update, and watched the dashboard come back without drama. Then I tried Suricata. On this CPU, full IDS/IPS is a trap. It could not inspect gigabit traffic without choking, and the fan became noticeable. I turned it off. If you need full intrusion detection, buy newer hardware. If you need a solid router with firewall rules and VPN, the thin client is fine.
Day 75: Where the Cheap Firewall Wins
Uptime is the big one. The box did not reboot during the 90 days. Visibility is the second: per-interface traffic, firewall logs, DHCP leases, and VPN status in one place. VLANs and WireGuard made the home office easier to separate from guest devices and IoT clutter. Replacement cost is low, and the config backup means a dead unit is an eBay order away, not a support call.
Day 90: Where It Wastes Time
Setup took me about seven hours across two weekends. Wi-Fi is a separate access point, so add that to the budget and the shelf space. Updates require reading release notes. Hardware quirks are on you. There is no support line. If you bill your time at $50 per hour, the first weekend costs more than a consumer router. The payoff is control, not raw savings.
What US Buyers Should Check Before Grabbing a Surplus Thin Client
Look for an Intel NIC if you can. Check for AES-NI. Get 4 GB RAM minimum and 32 GB of storage or a way to add it. Confirm the power brick is included. Clear any BIOS password before you rely on the machine. Ask about fan noise if it will sit in a living space. Check the return policy. Avoid models with soldered 8 GB flash and no expansion. And do not buy a thin client just because it is cheap; buy the model that fits OPNsense.
The Verdict
Would I do it again? Yes, for my home office. The $75 thin client is a better router than the box it replaced, and 90 days of power cost about $4.20. But I would not recommend it to someone who wants set-and-forget networking. This is a hobbyist firewall with real benefits and real homework. For a 2026 home office with VPN, VLANs, and a willingness to tinker, it is a solid deal.
