OPNsense® DEC4240 – 19-inch rack appliance with 21.1 Gbps firewall throughput
21.1 Gbps firewall throughput at 1,760 kpps, 4 × 10G SFP+ and 4 × 2.5G RJ45. Deciso states connectivity of 50 Gbps. 8 cores, 64 GB DDR4, 1 TB M.2, 1U.
At its heart sits the Netboard A30. The DEC4240 is OPNsense® Certified, ships preinstalled and includes one year of the Business Edition with OPNcentral. It is designed, manufactured and shipped by Deciso in the Netherlands.
Six reasons for the DEC4240
21.1 Gbps firewall throughput
1,760 kpps, 9 Gbps port to port, 100 µs average latency, 63 million concurrent sessions.
8 ports, 50 Gbps capacity
4 × 10G SFP+, 4 × 2.5G RJ45. Per the manufacturer, the SFP+ ports are cooled.
IDS/IPS at approx. 3.5 Gbps
291 kpps threat protection, measured with ET Open and Suricata 6.0.12 using 1500-byte packets.
Redundant power supply
Deciso states two supplies with automatic failover, 93 % typical efficiency, MTBF above 2,000,000 hours per Telcordia SR-332.
55 W typical draw
Heat dissipation 187.6 BTU/hr. Manufacturer figures: fans at 12.5 dB(A) each, total system noise below 42 dB(A).
64 GB DDR4 and 1 TB M.2
Identical to the DEC4280 in memory, storage, chassis and power supplies.
Typical deployment scenarios
- Perimeter firewall on 10 gigabit uplinks
- Segmenting large networks across up to 4,093 VLANs
- IDS/IPS with Suricata and ET rulesets
- IPsec site-to-site links at 2.5 Gbps throughput
- High availability with state synchronisation, two units required
- Central management of multiple sites through OPNcentral
Deployment scenarios are recommendations by inett based on the performance figures, not statements by the manufacturer.
Full technical specifications
| Preinstalled software | OPNsense®, Open Source + 1 year Business Edition |
| Certification | OPNsense® Certified |
| Mainboard | Netboard A30 (embedded) |
| CPU cores | 8, up to 3.1 GHz |
| Memory | 64 GB DDR4 |
| Internal storage | 1 TB M.2 solid state flash |
| SFP28 ports (25 Gbps) | 0 |
| SFP+ ports (10 Gbps) | 4 |
| RJ45 ports (100/1000/2500 Mbps) | 4 |
| Other ports | 1 × USB 3.0, 1 × console |
| Firewall throughput | 21.1 Gbps |
| Firewall packets per second | 1,760 kpps |
| Port to port throughput | 9 Gbps (1,220 kpps) |
| IPsec VPN throughput (AES256GCM16) | 2.5 Gbps (220 kpps) |
| Threat protection (IDS/IPS) | approx. 3.5 Gbps (291 kpps) |
| Concurrent sessions | 63,000,000 |
| New connections per second | 50,000 |
| Latency (average) | 100 µs |
| VLANs (802.1q) | 4,093 |
| Firewall policies (recommended maximum) | 10,000 |
| High availability | with state synchronisation, requires two units |
| Form factor | 19 inch, 1U, rackmountable |
| Dimensions (H × W × D) | 43.8 × 482.6 × 302 mm (274 mm excluding mount and handle) |
| Weight | 4.70 kg |
| Power requirements | 100–240 V AC, 50–60 Hz, max. 2.6 A per supply |
| Power consumption | 55 W typical (single supply) |
| Heat dissipation | 187.6 BTU/hr |
| Operating temperature | 0 to +45 °C |
| Storage temperature | −20 to +70 °C |
| Humidity | 10–90 %, non-condensing |
| Regulatory compliance | CE, FCC part 15 Class A, RoHS |
Package contents
- 19-inch 1U rack appliance
- Two matching power cords
- Configuration cable
- Quickstart guide
Warranty and support
Two-year carry-in & return warranty from Deciso. inett assists with sizing, commissioning and day-to-day operation – including monitoring and maintenance on request.
Frequently asked questions
Which uplink can the DEC4240 saturate?
Deciso states 21.1 Gbps firewall throughput at 1,760 kpps and 9 Gbps port to port. Over IPsec with AES256GCM16 it is 2.5 Gbps at 220 kpps, with threat protection roughly 3.5 Gbps. In our assessment that makes 10 gigabit uplinks serviceable.
How does the DEC4240 differ from the DEC4280?
In CPU and 25 gigabit ports: 8 cores without SFP28 versus 16 cores with four SFP28. Firewall throughput 21.1 instead of 60 Gbps, threat protection 3.5 instead of 7.5 Gbps, power draw 55 instead of 80 W. Memory, storage and chassis are identical.
Will it fit our cabinet?
19 inch, 1U. Deciso states a depth of 302 mm, or 274 mm excluding mount and handle.
What does the included year of Business Edition cover?
The commercial firmware repository, an integrated GeoIP database, the official OVA image and the professional plugins: Web Application Firewall, Proxy Access, Extended Blocklist and OPNcentral for central management.
Want us to check the sizing?
We match uplink speed, VLAN structure, IDS/IPS load and high availability requirements against the performance figures. A short message is enough.
More throughput and 25 gigabit ports?
View the OPNsense DEC4280 rack appliance
One class smaller in the rack?
All measurements are based on TCP traffic unless stated otherwise. Total throughput is derived from the maximum packet rate and 1500-byte packets. The maximum packet rate was measured with 500-byte packets. IPS performance was determined using ET Open and 1500-byte packets (Suricata 6.0.12, Netmap 14). VPN measured using AES256GCM16 and SHA512. Concurrent sessions follow from available memory, where one state consumes 1 KB and 1 GB is reserved for system tasks. Latency is an average over 60 seconds. Source of all technical data: Deciso product page.