OPNsense DEC4280 Firewall Appliance
OPNsense® DEC4280 – 19-inch rack appliance with 60 Gbps firewall throughput
60 Gbps firewall throughput at 5,000 kpps, 4 × 25G SFP28, 4 × 10G SFP+ and 4 × 2.5G RJ45. Deciso states connectivity of up to 150 Gbps. 16 cores, 64 GB DDR4, 1 TB M.2, 1U at 274 mm depth.
At its heart sits the Netboard A30. The DEC4280 is OPNsense® Certified, ships preinstalled and includes one year of the Business Edition with OPNcentral. It is designed, manufactured and shipped by Deciso in the Netherlands.
Six reasons for the DEC4280
60 Gbps firewall throughput
5,000 kpps, 21 Gbps port to port, 100 µs average latency, 63 million concurrent sessions.
12 ports, up to 150 Gbps capacity
4 × 25G SFP28, 4 × 10G SFP+, 4 × 2.5G RJ45. Per the manufacturer, the SFP+ and SFP28 ports are cooled.
IDS/IPS at approx. 7.5 Gbps
625 kpps threat protection, measured with ET Open and Suricata 6.0.12 using 1500-byte packets.
Redundant power supply
Deciso states two supplies with automatic failover, 93 % typical efficiency, MTBF above 2,000,000 hours per Telcordia SR-332.
Below 42 dB(A)
Manufacturer figures: fans at 12.5 dB(A) each, total system noise below 42 dB(A). Heat dissipation 273 BTU/hr at 80 W typical draw.
274 mm mounting depth
19 inch, 1U, 274 mm deep excluding mount and handle. Deciso states under 28 cm in the description.
Typical deployment scenarios
- Perimeter firewall on 10 or 25 gigabit uplinks
- Segmenting large networks across up to 4,093 VLANs
- IDS/IPS with Suricata and ET rulesets
- IPsec site-to-site links at 2.5 Gbps throughput
- High availability with state synchronisation, two units required
- Central management of multiple sites through OPNcentral
Deployment scenarios are recommendations by inett based on the performance figures, not statements by the manufacturer.
Full technical specifications
| Preinstalled software | OPNsense®, Open Source + 1 year Business Edition |
| Certification | OPNsense® Certified |
| Mainboard | Netboard A30 (embedded) |
| CPU cores | 16, up to 3.1 GHz |
| Memory | 64 GB DDR4 |
| Internal storage | 1 TB M.2 solid state flash |
| SFP28 ports (25 Gbps) | 4 |
| SFP+ ports (10 Gbps) | 4 |
| RJ45 ports (100/1000/2500 Mbps) | 4 |
| Other ports | 1 × USB 3.0, 1 × console |
| Firewall throughput | 60 Gbps |
| Firewall packets per second | 5,000 kpps |
| Port to port throughput | 21 Gbps (1,450 kpps) |
| IPsec VPN throughput (AES256GCM16) | 2.5 Gbps (220 kpps) |
| Threat protection (IDS/IPS) | approx. 7.5 Gbps (625 kpps) |
| Concurrent sessions | 63,000,000 |
| New connections per second | 50,000 |
| Latency (average) | 100 µs |
| VLANs (802.1q) | 4,093 |
| Firewall policies (recommended maximum) | 10,000 |
| High availability | with state synchronisation, requires two units |
| Form factor | 19 inch, 1U, rackmountable |
| Dimensions (H × W × D) | 43.8 × 482.6 × 274 mm |
| Weight | 4.85 kg |
| Power requirements | 100–240 V AC, 50–60 Hz, max. 2.6 A per supply |
| Power consumption | 80 W typical (single supply) |
| Heat dissipation | 273 BTU/hr |
| Operating temperature | 0 to +45 °C |
| Storage temperature | −20 to +70 °C |
| Humidity | 10–90 %, non-condensing |
| Regulatory compliance | CE, FCC part 15 Class A, RoHS |
Package contents
- 19-inch 1U rack appliance
- Two matching power cords
- Configuration cable
- Quickstart guide
Warranty and support
Two-year carry-in & return warranty from Deciso. inett assists with sizing, commissioning and day-to-day operation – including monitoring and maintenance on request.
Frequently asked questions
Which uplink can the DEC4280 saturate?
Deciso states 60 Gbps firewall throughput at 5,000 kpps and 21 Gbps port to port. Over IPsec with AES256GCM16 it is 2.5 Gbps at 220 kpps, with threat protection roughly 7.5 Gbps. In our assessment that makes 25 gigabit uplinks serviceable.
How does the DEC4280 differ from the DEC4240?
In CPU and 25 gigabit ports: 16 cores and four SFP28 versus 8 cores without SFP28. Firewall throughput 60 instead of 21.1 Gbps, threat protection 7.5 instead of 3.5 Gbps. Memory, storage and chassis are identical.
Will it fit our cabinet?
19 inch, 1U. Deciso states a depth of 274 mm excluding mount and handle, and under 28 cm in the description text.
What does the included year of Business Edition cover?
The commercial firmware repository, an integrated GeoIP database, the official OVA image and the professional plugins: Web Application Firewall, Proxy Access, Extended Blocklist and OPNcentral for central management.
Want us to check the sizing?
We match uplink speed, VLAN structure, IDS/IPS load and high availability requirements against the performance figures. A short message is enough.
Smaller site?
All measurements are based on TCP traffic unless stated otherwise. Total throughput is derived from the maximum packet rate and 1500-byte packets. The maximum packet rate was measured with 500-byte packets. IPS performance was determined using ET Open and 1500-byte packets (Suricata 6.0.12, Netmap 14). VPN measured using AES256GCM16 and SHA512. Concurrent sessions follow from available memory, where one state consumes 1 KB and 1 GB is reserved for system tasks. Latency is an average over 60 seconds. Source of all technical data: Deciso product page.