HEIGAOLAPC 4-Port Fanless Firewall

On Linux the RTL8125 family is handled by the in-kernel r8169 driver, so OpenWrt, iStoreOS, VyOS, Debian and Proxmox see all four ports without extra work. HEIGAOLAPC leans the same way and pitches iStoreOS as the showcase install, with its web UI for port editing and plugins. FreeBSD is the awkward one. OPNsense and pfSense both run on it, and Realtek 2.5GbE support there has leaned on Realtek's own vendor driver, which OPNsense packages as an optional plugin.

• OpenWrt / iStoreOS: the natural fit; drivers ship in the image.
• Proxmox, Debian, Ubuntu: works out of the box with r8169.
• OPNsense: install the Realtek driver plugin before trusting the box with your uplink.
• pfSense: check the current release notes for RTL8125 support first.

Hardware offloading is on the feature sheet too. On pfSense and OPNsense the long-standing advice is to leave checksum, TSO and LRO offloads switched off for a router anyway, so treat it as a Linux-side feature. VLAN tagging and link aggregation are standard on this chip and work on any of the systems above.

For a firewall, those numbers are more than enough. A router OS with DNS filtering, a VPN endpoint and a few plugins uses a fraction of 8GB, and a 128GB SSD holds years of logs. The limits appear when the box turns into a small server.

Inside sits an M.2 slot that takes NVMe or SATA drives, and on the case a TF card slot for cards up to 512GB. HEIGAOLAPC does not say plainly whether the 128GB drive occupies that M.2 slot or sits beside it. Plan on replacing the drive, not adding a second one, until you have opened the case.

• Keep the original 128GB drive with its Windows install as a recovery spare.
• Use the TF slot for log archives or ISO storage, not as the boot device.
• On a router that doubles as an N100 home server, 8GB is the first thing to outgrow.

The N100's 6W TDP keeps the thermal load small at idle, and a router spends most of its life idle. Under sustained load, such as an IDS scanning every packet or a VM compiling something, the case gets properly warm to the touch. That is normal for fanless hardware; the throttling point is set by the chip, and a cramped shelf reaches it sooner.

• Give it a few centimetres of clear air on the finned side.
• Do not stack it under a modem or a PoE switch that also runs hot.
• In a closed wall enclosure, a vented door or a small cabinet fan helps more than anything inside the box.
• Wall-mounting with fins vertical lets convection do the work.

Wall power depends on how many ports are linked, the SSD and the memory, rather than on the CPU alone. Typical idle and load ranges for firewall boxes like this one are laid out under N100 power consumption. The practical point: it costs very little to leave it running 24/7.

Two HDMI 2.0 ports at 4K@60Hz and a full-function USB-C port are unusual on a router box. They make the first install easy, because you plug in a monitor instead of fighting a serial console. They also give the box a second life as a quiet desktop or signage player if your network outgrows it, alongside the other fanless N100 mini PCs.

The CWWK firewall comes in a configured version with 8GB and 128GB on Intel i226-V ports, the closest like-for-like swap. The Dozlzyp and oaknode boxes are fanless i226-V units sold barebone, cheaper to start but needing parts. The whole field is lined up under N100 firewall mini PCs.

1. Decide the router OS first. Linux-based: this box fits. FreeBSD-based: budget time for the Realtek driver, or buy Intel.
2. Confirm your ISP handoff speed. Four 2.5GbE ports cover any residential plan up to 2.5Gbit/s.
3. Check that the configuration still reads 8GB and 128GB on the day you order.
4. Keep the Windows drive untouched if you want an easy return path within the one-year warranty.

One line of the maker's spec sheet names the graphics as UHD Graphics 600. That is an error: the N100 uses Intel UHD Graphics with 24 execution units, as set out in the N100 specs. It changes nothing for routing, but it shows how carefully to read the rest of the sheet.