A Note from Zima
Thank you, Active_Learner05, for treating ZimaBoard 2 as a platform to learn from rather than a box with only one fixed role. Turning a ZimaBoard 2 1664 into an OPNsense firewall, then working through storage, boot order, interface assignment, access-point conversion, and security plugins, shows the kind of hands-on exploration that makes a homelab genuinely useful.
We especially appreciate that you shared the process while it was still a work in progress. The useful part is not only that the firewall came online, but that other users can see the decisions behind it: why OPNsense became the main OS, how the network was connected, which security services were enabled, what went wrong during setup, and what you learned by solving those problems yourself.
— Zima
Meet Active_Learner05
Active_Learner05 describes himself as a jack of all trades, with experience spanning arts, game development, space missions, ham radio, and programming. Even while stepping away from conventional work for health reasons, he has continued creating through writing, publishing books, selling digital items, and exploring new technical projects.
That curiosity is what brought two ZimaBoard 2 1664 systems into his setup. One became a dedicated home-network security appliance built around OPNsense. The second moved in a completely different direction with an eGPU and an older RTX 4060 Ti for Ollama, Plex, IT Tools, and other experiments. For this story, the focus is the first board: how he turned it into the firewall and router at the center of his home network.
You can follow Active_Learner05 on Reddit to see the project continue beyond this page.
Why ZimaBoard 2 Became the Firewall Platform
The choice started with the ZimaBoard 2 1664 specification rather than a single preplanned application. Active_Learner05 wanted hardware he could use to apply what he already knew while continuing to learn across networking, home security, programming, productivity, and other self-hosted workloads.
For the firewall project, that meant using the board as a dedicated OPNsense host instead of leaving ZimaOS as the primary operating system. His published configuration lists an Intel N150 processor, 16GB of memory, a 500GB Crucial SSD, and an OPNsense stack that includes Suricata, Unbound, Zenarmor, and CrowdSec.
Installing OPNsense on a SATA SSD
The first boot itself was straightforward. Active_Learner05 described the board as easy to start and close to plug-and-play, but installing OPNsense introduced the first real learning step.
He wanted OPNsense to run from a SATA SSD rather than simply continue using the factory system on the internal eMMC. That required changing the boot arrangement so the external SSD became the preferred operating-system disk. In his Reddit build log, he documented installing the ZimaBoard factory recovery environment for fallback access, creating OPNsense installation media, and then installing OPNsense from USB onto the SSD.
After installation, his preferred boot order became:
1. SSD
2. CasaOS recovery environment
This is also consistent with ZimaSpace's recovery documentation, which notes that systems installed to an external disk may require the BIOS boot sequence or boot device to be changed. The ZimaBoard factory recovery guide provides the official recovery path, while the OPNsense installation guide covers the firewall installation itself.
Assigning WAN, LAN, and the Extra Interfaces
Once OPNsense was installed, the next stage was turning Ethernet ports into a real routing layout rather than simply connecting cables and hoping the defaults matched the intended topology.
Active_Learner05 documented the initial WAN and LAN assignment, then added the remaining interfaces and configured additional ports as OPT1 and OPT2. That gave the firewall room to separate roles instead of treating every port as part of one flat network.
The upstream and downstream pieces were deliberately simple. An ASUS gaming router was converted into an access point without requiring a factory reset, while a D-Link DMS-105 plug-and-play 2.5GbE switch handled wired distribution. The ZimaBoard 2 sat between those components as the system responsible for routing, firewall policy, DNS, and network-security services.
Building the Security Stack Around OPNsense
Getting packets from WAN to LAN was only the beginning. The more interesting part of the build was the security stack Active_Learner05 layered on top of OPNsense.
Unbound handled DNS resolution. Suricata added intrusion-detection and inspection capabilities. Zenarmor provided application-aware traffic visibility and reporting. CrowdSec added another layer for identifying and responding to hostile behavior.
That combination made the ZimaBoard 2 more than a replacement for an ISP router. It became a machine he could actively inspect: services could be checked, resource usage could be watched, and network behavior could be explored rather than hidden behind a simplified consumer-router interface.
What the First Setup Taught Him
The project was not completely frictionless, and that is part of what makes the story useful. One challenge was moving away from the default eMMC boot path so OPNsense could live on the SATA SSD. Another appeared in a separate PCIe experiment: an extender cable used with an OCuLink card did not behave as expected, leading him to conclude that the cable length or compatibility was preventing reliable data transfer.
On the firewall itself, he later reported memory use moving from roughly the low-40% range into the low-80% range depending on activity, with CPU usage peaking around 50% in what he had observed at that point. He also noticed the board becoming warmer under the security workload and added an older AC Infinity 80mm temperature-controlled fan, which he said improved temperatures.
Those details matter because they turn the page from a clean installation summary into an actual homelab story: the system worked, but the process still involved learning how boot devices, interface assignments, plugins, thermals, and expansion hardware interact.
From Consumer Router to a Network You Can Inspect
The practical change in daily use was not simply replacing one router with another. OPNsense gave Active_Learner05 a network he could investigate.
The access point could focus on Wi-Fi. The 2.5GbE switch could focus on distribution. ZimaBoard 2 could focus on routing and security. Inside OPNsense, DNS, firewall services, traffic inspection, intrusion detection, and CrowdSec could be monitored independently instead of being bundled into an opaque appliance.
That separation also matched his original reason for buying the hardware: use the specifications as a place to apply existing knowledge and keep learning. The firewall was not the end of the experiment. It was one of the clearest examples of how a general-purpose x86 board could become a specialized network appliance.
Two ZimaBoard 2 Systems, Two Different Directions
The OPNsense system is only one side of Active_Learner05's setup. His second ZimaBoard 2 1664 took the opposite path, pairing the board with an external GPU and an RTX 4060 Ti for Ollama, GPU-accelerated Plex, IT Tools, and further experimentation.
That contrast helps explain his approach to ZimaBoard 2. He did not purchase two identical machines to run two identical workloads. One became network infrastructure; the other became a platform for GPU, media, and AI experiments. The common thread is exploration.
The Story Is Still Being Written
Active_Learner05 and Zima's story is still being written. He described himself as still new to single-board computers and still exploring what the hardware can do. That makes this OPNsense firewall less of a finished endpoint and more of a first serious networking project built around the board.
His one-sentence advice to future users was simple: "Try and explore." For the full work-in-progress firewall discussion, visit the original ZimaBoard 2 OPNsense build on Reddit. You can also follow Active_Learner05 on Reddit as the project continues.
