Top picks
oaknode 10GbE SFP+ Firewall
Firewall appliance · 2× 10GbE SFP+ · 4× 2.5GbE · barebone

oaknode 10GbE SFP+ Firewall

The MGNASN is the only box in the N100 firewall crowd with fibre-ready 10GbE: two SFP+ cages on an Intel 82599ES controller beside four i226-V 2.5GbE ports. It ships barebone, now with an N150, and adds a 4G LTE modem slot.

  • ProcessorN100 design; current barebones ship with the N150
  • Network2× 10GbE SFP+ (Intel 82599ES) + 4× 2.5GbE (Intel i226-V)
  • MemoryDDR5 SO-DIMM, up to 32GB, not included
  • Storage1× M.2 NVMe PCIe 3.0 x1 + 1× SATA 3.0, not included
  • CellularMini PCIe slot for a 4G modem, SIM slot
  • VideoHDMI 2.0 + DP 1.4 + USB-C (DP 1.2), three 4K@60Hz screens
Buy it for
  • A 10GbE fibre trunk from the router to a switch or NAS
  • Multi-gig ISP handoffs above 2.5Gbit/s
  • Adding LTE failover without a separate modem box
Skip it for
  • Anyone expecting full 10Gbit/s routed through firewall rules
  • Buyers who want memory and storage included
See today’s price

Two 10GbE SFP+ cages on Intel 82599ES silicon

Every other four-port N100 firewall tops out at 2.5GbE per port. The MGNASN adds two SFP+ cages driven by an Intel 82599ES, the long-serving 10GbE controller found on countless server NICs. That makes it the only box in this class that can take a fibre module or a direct-attach copper cable straight into the router.

The 82599ES is mature, well-documented hardware. FreeBSD drives it with the ix driver and Linux with ixgbe, so pfSense, OPNsense, OpenWrt, Proxmox and ESXi all recognise it without extra packages. oaknode's recommended releases for the full port set are pfSense Plus 23.0x or CE 2.7.x, OPNsense 22.1 and newer, RouterOS 7 and ESXi 8.

Mind the modules. The 82599 family is known for rejecting SFP+ modules that are not Intel-coded. Both drivers have an override: hw.ix.unsupported_sfp=1 as a FreeBSD loader tunable, allow_unsupported_sfp=1 as an ixgbe module option on Linux. Intel-coded optics or DAC cables avoid the question entirely.
  • DAC cable: cheapest and coolest for a switch in the same rack, up to a few metres.
  • SR optics over multimode fibre: the usual choice for a run to another room.
  • 10GBASE-T copper modules: possible, but they run hot and draw noticeably more power than DAC or optics.

The SFP+ side has a real job even when your internet plan is slower than 10Gbit/s: a fast link between the router, a 10GbE switch and a NAS, so inter-VLAN traffic stops crawling through a 2.5GbE port.

The 82599ES is also an older, warmer chip than the i226-V. It adds to idle draw and case heat, so leave the MGNASN more breathing room than a plain four-port box.

Hardware

What’s inside

SpecValue
ModelMGNASN
ProcessorIntel N100 (Alder Lake-N) design, 4C/4T, up to 3.4GHz, 6W TDP; current barebones ship with the N150
GraphicsIntel UHD Graphics
10GbE2× SFP+ cages, Intel 82599ES controller
2.5GbE4× RJ45, Intel i226-V
MemoryDDR5 SO-DIMM laptop module, up to 32GB, up to 5600MHz (not included)
NVMe1× M.2 2280, NVMe PCIe 3.0 x1 (drive not included)
SATA1× SATA 3.0 for a 2.5-inch SSD or HDD, mounted externally
Card slotTF card, bootable
CellularMini PCIe slot for a 4G LTE modem, SIM card slot
VideoHDMI 2.0 + DP 1.4 + USB-C (DP 1.2), three 4K@60Hz displays
EncryptionAES-NI
BIOS featuresPXE boot, Wake-on-LAN, watchdog, GPIO
Supported systemspfSense Plus 23.0x or CE 2.7.x, OPNsense 22.1+, OpenWrt, RouterOS 7, ESXi 8, Proxmox, CentOS
ConfigurationBarebone: no RAM, no storage
Warranty12 months

Six ports on nine PCIe lanes: where 10Gbit/s gets spent

Fast ports and fast routing are different things. The N100 platform exposes nine PCIe 3.0 lanes in total, and this board has to share them among four 2.5GbE chips, a dual-port 10GbE controller, an NVMe slot and a modem slot. oaknode does not publish the lane width given to the 82599ES, which natively wants a wide PCIe 2.0 link.

The processor is the second ceiling. Four Gracemont efficiency cores handle NAT and a sensible firewall rule set at multi-gigabit rates, but pushing a full 10Gbit/s through pf with filtering is a job for bigger silicon. Expect routed firewall throughput on the SFP+ ports to land short of line rate, and the exact figure to depend on packet size, rule count and whether IDS is running.

Port groupChipSpeedBest job
2× SFP+Intel 82599ES10Gbit/s eachTrunk to a 10GbE switch or NAS
4× RJ45Intel i226-V2.5Gbit/s eachWAN, LAN, guest, IoT, DMZ
Mini PCIe + SIMYour 4G modemCarrier-dependentBackup WAN
  1. Put the ISP handoff on an i226-V port unless your plan is faster than 2.5Gbit/s.
  2. Use one SFP+ port as the LAN trunk to a 10GbE switch, and let the switch do the heavy local switching.
  3. Keep the second SFP+ port for a direct NAS link or a second trunk.

Laid out that way, the router only routes what crosses networks, while bulk local traffic stays on the switch. More layouts for multi-port boxes sit under N100 firewall mini PCs.

Market position

How it fits the lineup

N100 mini PC models by type, September 2026. Highlighted: oaknode 10GbE SFP+ Firewall.

A 4G LTE slot, a SIM tray and three display outputs

Inside is a mini PCIe slot meant for a 4G LTE modem, with a SIM card slot on the case. Fit a modem card and the router gains its own cellular backup, with no separate LTE box, power brick or extra cable in the cabinet. That is rare on a firewall appliance and useful for a home office that cannot afford an outage.

Failover is the natural use: the cable or fibre line stays primary, and the LTE link takes over when it drops. OpenWrt handles common modem cards through QMI or MBIM. pfSense and OPNsense treat them as PPP interfaces, which works but needs more manual setup. Check your modem card's chipset against your chosen OS before buying it.

  • Memory: one DDR5 SO-DIMM, laptop type, up to 32GB and 5600MHz. oaknode's text mentions DDR4 in the same sentence, so confirm the module type before ordering.
  • Storage: one M.2 2280 NVMe on PCIe 3.0 x1, plus a SATA 3.0 port for a 2.5-inch drive mounted outside the case.
  • Boot options: TF card boot and PXE, useful for rescue images.
  • Control: watchdog, Wake-on-LAN and GPIO headers.

A SIM in the router also keeps remote access alive during an outage. A WireGuard tunnel over the LTE link lets you reach the network, or the box itself, when the main line is down and you are not home.

Video runs through HDMI 2.0, DisplayPort 1.4 and a USB-C port carrying DP 1.2, three 4K@60Hz outputs in all. For a router that is excess, but it means the first install needs nothing more exotic than whatever monitor is nearby. A 10GbE-capable box with this many outputs also makes a credible compact N100 home server if routing duty ends.

Other options

Three other routes

It ships as an N150 barebone: what to buy with it

The MGNASN is designed around the N100 and named that way, but current barebones ship with the Intel N150. The N150 keeps four cores and the 6W TDP and lifts the burst clock to 3.6GHz, so nothing a firewall relies on gets worse. It arrives with no memory and no storage, so the order list is longer than the box alone.

The chip swap is covered in detail under N100 vs N150. For a router, treat the two as interchangeable, and update the BIOS before the first install; oaknode supplies BIOS updates, drivers and OS installation help on request.

  1. A DDR5 laptop SO-DIMM: 8GB for a pure firewall, 16GB with IDS, up to 32GB for VMs.
  2. An M.2 2280 NVMe drive; the x1 link makes a premium drive pointless.
  3. Intel-coded SFP+ optics or DAC cables for the 10GbE side.
  4. Optionally, a mini PCIe 4G modem card and a data SIM.

Power at the wall climbs with every linked port and module, and the 10GbE controller and any SFP+ optics add to what the chip alone would draw. Hedged idle ranges for firewall boxes, and what raises them, are under N100 power consumption.

If 10GbE is not on your roadmap, cheaper boxes do the same routing. The UDPTCP 6-port gives six 2.5GbE ports instead. The UDPTCP industrial box keeps the LTE slot, SIM and GPIO without the SFP+ cages. Buy the MGNASN when a fibre trunk or a faster-than-2.5G handoff is the whole point. oaknode backs it for 12 months.

FAQ

Owner questions

Can the oaknode MGNASN route 10Gbit/s?

Its SFP+ ports link at 10Gbit/s, but routed firewall throughput is bounded by four efficiency cores and the board's PCIe lanes. Use the SFP+ ports as trunks to a switch or NAS for best results.

Which SFP+ modules work with the Intel 82599ES?

Intel-coded optics and DAC cables work by default. Other modules may need the unsupported-SFP override in FreeBSD or Linux.

Is it an N100 or an N150?

The board is designed around the N100, but current barebones ship with the N150, which has the same core count and TDP with higher clocks.

Does it include RAM and storage?

No. It ships barebone; add a DDR5 SO-DIMM and an M.2 NVMe drive or a 2.5-inch SATA drive.

Can it take a 4G SIM?

Yes. It has a mini PCIe slot for a 4G LTE modem card and a SIM slot; the modem card is a separate purchase.