OPNsense® DEC3940 – 19-inch 1U rack appliance with dual power supply and 36.8 Gbps
Four 2.5-gigabit ports and two SFP+ at 10 Gbps, 36.8 Gbps firewall throughput, 12.5 Gbps IPsec across multiple tunnels, 32 GB DDR5, 512 GB M.2 flash and a redundant power supply.
The DEC3940 is the redundant enterprise model of the DEC3900 series: the same Netboard A20 Gen2 as the DEC3920, but with a dual power supply, 32 GB DDR5 and 512 GB storage. Deciso derives 31 million concurrent sessions from that memory. OPNsense® is preinstalled and one year of the Business Edition is included. The appliance is developed, manufactured and shipped by Deciso in the Netherlands.
Six reasons for the DEC3940
36.8 Gbps firewall throughput
3.07 million packets per second, 9 Gbps port to port, 67 µs average latency.
12.5 Gbps IPsec across tunnels
A single tunnel reaches 5.4 Gbps at 527 kpps, multiple tunnels 12.5 Gbps at 1,190 kpps.
7.93 Gbps threat protection
700 kpps, measured with 25,000 ET Open malware rules and 1500-byte packets.
WireGuard and OpenVPN DCO measured
4.23 Gbps over WireGuard and 2.81 Gbps over OpenVPN DCO – Deciso lists both separately.
Dual power supply at 30 watts
Two power supplies for redundant deployments. Around 60 to 80 euros of electricity per year with one active supply.
Made in EU, two-year warranty
Carry-in and return warranty direct from Deciso, including one year of OPNsense® Business Edition.
Typical applications
- Firewall and routing on connections up to 10 gigabit
- Central firewall with IDS/IPS at several gigabit of payload
- VPN concentrator with WireGuard or IPsec across multiple tunnels
- Fibre uplink over SFP+ without an additional network card
- Rack mounting in a server cabinet at 259 mm depth without the front panel
- Redundant operation with state synchronisation, two units required
Application scenarios are recommendations by inett based on the performance data, not statements by the manufacturer.
Full specifications
| Preinstalled software | OPNsense®, Open Source + 1 year Business Edition |
| Typical applications | Firewall / routing, VPN, IDPS |
| Board | Netboard A20 Gen2 |
| CPU cores | 8 |
| Memory | 32 GB DDR5 |
| Internal storage | 512 GB M.2 solid state flash |
| SFP28 ports (25 Gbps) | 0 |
| SFP+ ports (10 Gbps) | 2 |
| 2.5 GbE ports (100/1000/2500 Mbps) | 4 |
| USB-C | 1 |
| Console port | 1 |
| VLANs (802.1q) | 4,093 |
| Firewall throughput | 36.8 Gbps |
| Firewall packets per second | 3.07 million pps |
| Port-to-port throughput | 9 Gbps |
| IPsec VPN throughput (single / multiple tunnels) | 5.4 Gbps / 12.5 Gbps |
| IPsec VPN packets per second (single / multiple tunnels) | 527 kpps / 1,190 kpps |
| OpenVPN DCO throughput | 2.81 Gbps |
| OpenVPN DCO packets per second | 272 kpps |
| WireGuard throughput | 4.23 Gbps |
| WireGuard packets per second | 410 kpps |
| Threat protection (IDS/IPS) | 7.93 Gbps (700 kpps) |
| Concurrent sessions | 31 million |
| Firewall latency (average) | 67 µs |
| Firewall rules (recommended maximum) | 10,000 |
| High availability | with state synchronisation, two units required |
| Power supply unit | dual, redundant |
| Form factor | 19-inch rack mountable, 1U |
| Dimensions (H × W × D) | 43.65 × 482.6 × 287 mm (259 mm without front panel) |
| Weight (appliance only) | 3.18 kg |
| Power input | 100–240 V AC, 50–60 Hz |
| Maximum current (per power supply) | 1.52 A |
| Power consumption (typical, single power supply) | 30 W |
| Heat dissipation | 102.4 BTU/h |
| Operating temperature | 0 to +45 °C |
| Storage temperature | −20 to +70 °C |
| Humidity | 10–90 %, non-condensing |
| Certifications | CE, FCC part 15 Class A, RoHS, REACH |
Package contents
- 19-inch 1U rack appliance
- Matching power cord
- Configuration cable
- Quick start guide
Warranty and support
Two-year carry-in and return warranty from Deciso, including one year of the OPNsense® Business Edition with the commercial firmware repository, integrated GeoIP database, the free professional features and the e-learning course. Deciso lists the package contents uniformly for its rack appliances. inett supports sizing, commissioning and day-to-day operation, with monitoring and maintenance on request.
Frequently asked questions
Which internet connection can the DEC3940 serve?
Deciso states 36.8 Gbps firewall throughput at 3.07 million packets per second and 9 Gbps port to port. IPsec reaches 5.4 Gbps in a single tunnel and 12.5 Gbps across multiple tunnels, threat protection 7.93 Gbps.
How do the DEC3920, DEC3940 and DEC3960 differ?
Deciso positions them as follows: the DEC3920 has a single power supply and no SFP28 ports, the DEC3940 a dual power supply without SFP28, the DEC3960 a dual power supply with two SFP28 ports. In addition the DEC3920 has 16 GB DDR5 and 256 GB storage, the other two 32 GB and 512 GB.
Is OPNsense already installed?
Yes. OPNsense® is preinstalled and one year of the Business Edition is included. That covers the commercial firmware repository, the integrated GeoIP database, the free professional features and an e-learning course.
May 2.5 and 10 gigabit modules be mixed?
No. Deciso explicitly notes that 2.5/5 Gbps and 10 Gbps link speeds must not be mixed, because the hardware does not support it due to the different frequencies.
Shall we check the sizing together?
We compare line speed, number of users, VPN load and planned services against the performance data. A short message is enough.
25-gigabit ports needed?
All measurements refer to TCP traffic unless stated otherwise. Total firewall throughput is calculated from the maximum packet rate and 1500-byte packets. The maximum packet rate was measured with 500-byte packets. IPS performance was measured with 25,000 ET Open malware rules and 1500-byte packets. VPN was measured with AES256GCM16. Concurrent sessions follow from the available memory, where one state occupies 1 KB and 1 GB is reserved for system tasks. Latency is an average over 60 seconds. Source of all technical data: Deciso product page.