Building an OPNsense router on an HP ProDesk 400 G5 SFF for YouFibre

This is the hardware I use as my main router. The HP ProDesk 400 G5 SFF is a small, quiet, low-power desktop that you can pick up second-hand for very little. With a 10GbE PCIe NIC fitted, it handles the full YouFibre 2 Gbps connection without breaking a sweat. This guide covers the full process: fitting the NIC, creating an OPNsense USB installer, installing OPNsense, and getting it talking to YouFibre.

What you need

• HP ProDesk 400 G5 SFF - sourceable from eBay for around £50–80. Make sure it has the i3-8100 or better and at least 8 GB RAM. 16 GB is preferable.
• Intel X550-T2 dual-port 10GbE PCIe NIC - or any OEM equivalent (Dell, HP OEM versions of the same chip are identical). Look for the low-profile bracket variant, or a card that ships with both brackets. The SFF chassis requires a half-height card.
• A USB drive - 8 GB or larger. It will be wiped.
• A monitor and keyboard - needed for the initial install only.
• A Torx T15 screwdriver - the ProDesk uses a T15 for the chassis thumb screw and some internal mounts.
• An anti-static wrist strap - optional but good practice.

Part 1: Fitting the PCIe NIC

Open the chassis

Power the machine off completely and unplug the power cable. The SFF chassis opens via a single thumb screw (or T15 fastener depending on the variant) at the rear. Slide the left side panel rearward and lift it off. The interior is compact but accessible.

Check the bracket

The SFF chassis only accepts half-height (low-profile) PCIe cards. A full-height card will physically not fit - the bracket will foul the chassis. The Intel X550-T2 OEM cards typically ship with a full-height bracket fitted and a low-profile bracket included separately. If yours only has a full-height bracket, they are available to buy separately for a few pounds. Swap the bracket before fitting: remove the two screws holding the existing bracket to the card's faceplate, swap to the low-profile bracket, and refit the screws.

Locate the PCIe x16 slot

The ProDesk 400 G5 SFF has one PCIe 3.0 x16 slot and one PCIe 3.0 x1 slot. Use the x16 slot for the X550-T2. Remove the slot cover by unscrewing the single retaining screw at the top of the bracket opening, then sliding the cover out. Keep the screw - you'll reuse it.

Seat the card

Align the X550-T2's edge connector with the x16 slot and press down firmly until the slot's retention clip clicks into place. The card should sit flush with no visible gap between the connector and slot. Fasten the bracket to the chassis with the screw you removed from the slot cover. Give the card a gentle tug to confirm it is properly seated.

The X550-T2 is bus-powered; no additional power connectors are required.

Close up

Replace the side panel and reattach the power cable. The machine is ready for the next step.

Part 2: Creating a bootable OPNsense USB

Download OPNsense

Go to opnsense.org/download. Select the following options:

• Architecture: amd64
• Image type: dvd
• Mirror: any nearby mirror is fine

This downloads a .iso file. The “dvd” image works for both optical media and USB drives. Verify the SHA-256 checksum against the value listed on the download page before proceeding.

Write the image to USB (Windows)

Download Rufus (free, no install required). Insert your USB drive, then:

1. Open Rufus. Select your USB drive under Device.
2. Click Select and browse to the OPNsense ISO.
3. Leave Partition scheme as GPT and Target system as UEFI (non-CSM).
4. Click Start. If Rufus asks whether to write in ISO or DD mode, choose Write in DD Image mode.
5. Accept the warning that the drive will be wiped, and wait for the write to complete.

Write the image to USB (macOS / Linux)

Identify the USB device with diskutil list (macOS) or lsblk (Linux), then write the image:

sudo dd if=OPNsense-*.iso of=/dev/rdiskN bs=1m status=progress

Replace /dev/rdiskN with your actual USB device identifier. Double-check this before running - writing to the wrong device is unrecoverable.

Part 3: Installing OPNsense

Boot from USB

Connect the USB drive to the HP ProDesk, attach a monitor and keyboard, and power on. Press F9 during the HP POST screen to open the one-time boot menu. Select your USB drive from the list. If it doesn’t appear, enter BIOS setup with F10 and ensure USB Storage Boot is enabled and Secure Boot is disabled (OPNsense does not require Secure Boot and it can interfere with the boot process).

Run the installer

OPNsense boots to a live environment and presents a login prompt. Log in with username installer and password opnsense. The guided installer will launch automatically.

• Accept the default keymap (or select UK if preferred).
• Choose Install (UFS) for a straightforward single-disk setup. ZFS is also available if you prefer it, but UFS is perfectly adequate for a router workload.
• Select the internal drive (typically sda or ada0) as the installation target. The USB drive will appear separately - do not select it.
• Confirm and allow the installer to write to disk. This takes about two minutes.
• When prompted to set a root password, set a strong one and note it down.
• Reboot when instructed, and remove the USB drive.

Part 4: Basic configuration for YouFibre

Initial interface assignment

On first boot, OPNsense presents a console menu. Before accessing the web interface you need to assign your network interfaces. Select option 1) Assign interfaces.

With the HP ProDesk and the Intel X550-T2 fitted, you will typically see three interfaces detected:

• em0 - the onboard Intel I219-LM Gigabit port
• ix0 and ix1 - the two 10GbE ports on the X550-T2

Plug a cable from your YouFibre ONT into the first 10GbE port on the X550-T2, and a cable from your LAN switch into the second port. OPNsense will show the MAC addresses for each interface; you can use these to confirm which port is which. Assign as follows:

• WAN: ix0 (connected to the YouFibre ONT)
• LAN: ix1 (connected to your switch)

The onboard em0 can be left unassigned for now, or assigned as a second LAN or management interface later. When prompted about VLANs, answer No - YouFibre does not require VLAN tagging on the WAN.

Set a LAN IP (optional)

OPNsense defaults to 192.168.1.1/24 on the LAN. If that suits your network, leave it as is. If you need a different subnet, select option 2) Set interface IP address from the console menu and change the LAN address now, before connecting clients.

Access the web GUI

Connect a device to the LAN side and open a browser to https://192.168.1.1 (or whatever LAN IP you set). Accept the self-signed certificate warning. Log in with username root and the password you set during installation.

The setup wizard will launch on first login. Run through it:

• Set your hostname and domain (anything you like - these are internal only).
• Set your preferred DNS servers, or leave them as defaults to use OPNsense’s Unbound resolver.
• On the WAN step: select DHCP. No username, no password, no PPPoE - YouFibre uses a plain DHCP handoff from the ONT. Leave all other WAN settings at their defaults.
• On the LAN step: confirm or adjust the LAN IP and subnet.
• Set a new admin password when prompted.

After completing the wizard, OPNsense will apply the settings and reload. Your WAN interface should come up within a few seconds and pull a DHCP lease from YouFibre. You can verify this under Interfaces → Overview.

Confirm connectivity

Go to Interfaces → Overview and confirm the WAN interface shows an IPv4 address in the YouFibre range. Then run a quick ping test from the console: select option 7) Ping host and ping 8.8.8.8. If you get replies, the connection is working.

At this point your router is up and passing traffic. Clients on the LAN will receive DHCP addresses from OPNsense and reach the internet through YouFibre.

MTU

Leave the WAN MTU at the default 1500. The YouFibre ONT does not support jumbo frames on the WAN side. On the LAN side and between internal hosts, jumbo frames are fine if your switch and NICs support them, but for the WAN interface, 1500 is correct.

Firewall defaults

OPNsense ships with sane defaults: all inbound traffic on WAN is blocked by default, and outbound traffic from LAN is permitted through NAT. You don’t need to add any rules to get basic internet access working. Additional rules (port forwards, VPN, etc.) can be added later as needed.

What next

From here the obvious next steps depend on your use case. I cover a few in other posts on this site:

• Dual-WAN failover configuration in OPNsense - adding a second ISP as automatic standby
• Adding a static IP to your YouFibre connection - useful if you self-host services