VP2430 Hardware Overview
What You Have
The Protectli VP2430 is the higher-performance option in the OSS lineup. Like the V1410, it’s a small fanless computer purpose-built for network security. It runs your SecureNet OS firewall, handles all your network traffic, and is designed to run 24/7 with zero maintenance. The VP2430 has a more powerful CPU, more RAM, faster storage, and delivers higher throughput for homes with multi-gigabit internet or heavier network demands.
Protectli is a US-based hardware manufacturer with a 2-year warranty on all vault components. OSS configures the software. Protectli builds and ships the hardware.
What’s Inside
| Component | Specification |
|---|---|
| CPU | Intel N150 (4 cores, up to 3.6 GHz) |
| RAM | 16 GB DDR5 (upgradable) |
| Storage | 500 GB Kingston NV3 NVMe SSD |
| Network | 4x Intel i226-V 2.5 Gigabit Ethernet ports |
| Firmware | coreboot (open-source BIOS) with Intel ME disabled via HAP |
| Cooling | Fanless, passively cooled aluminum case |
| Power | 12V DC adapter (included) |
Intel ME Disabled
The VP2430 ships with Intel Management Engine disabled using the HAP (High Assurance Platform) method. Intel ME is a subsystem built into Intel CPUs that runs independently of the operating system and has deep access to system hardware. Most computers ship with it enabled and there’s no way to turn it off. The VP2430’s coreboot firmware uses the HAP bit to disable it, removing a layer of opaque firmware that you can’t inspect or control.
How It Compares to the V1410
| Spec | V1410 | VP2430 |
|---|---|---|
| CPU | Intel N5105 (up to 2.9 GHz) | Intel N150 (up to 3.6 GHz) |
| RAM | 8 GB DDR4 | 16 GB DDR5 |
| Storage | M.2 SATA or NVMe SSD | 500 GB Kingston NV3 NVMe |
| Intel ME | Enabled | Disabled (HAP) |
| Throughput (full security stack) | ~1.2 Gbps | ~1.7 Gbps |
| NICs | 4x Intel i226-V 2.5G | 4x Intel i226-V 2.5G |
| Best for | Gigabit internet | Gigabit with headroom or multi-gigabit |
Both vaults run the identical SecureNet OS configuration. The VP2430 has more processing power, more memory, faster storage, and Intel ME disabled.
The Ports
Looking at the back of the vault from left to right:
| Port | Label | What It Does |
|---|---|---|
| Port 1 (leftmost) | LAN1 | Connects to your wireless access point. Carries all WiFi networks (Admin, IoT, Smart, Guest, Kids, SafeNet) |
| Port 2 | WAN | Connects to your modem or ISP equipment. This is your internet connection |
| Port 3 | SafeNet Port | Physical VPN port. Plug a device directly into this for wired SafeNet VPN access |
| Port 4 (rightmost) | LAN2 | Backup admin port. Emergency failover if Port 1 fails |
Port 1 is the most important port. It carries all your WiFi networks through a single cable to the access point using VLAN trunking. If this cable comes loose, all WiFi goes down.
Port 4 is your safety net. If Port 1 ever fails, you can move the cable from Port 1 to Port 4 and your Home-Admin WiFi will continue working. You’ll lose the VLAN-based networks (IoT, Smart, Guest, Kids, SafeNet WiFi) but you’ll stay online until the issue is resolved.
The LEDs
Power LED: A solid blue or white light on the front means the vault is powered on and running.
Port LEDs: Each Ethernet port has a link light. A solid light means the cable is connected. A flashing light means data is flowing. No light means the cable is disconnected or the port has an issue.
Boot chime: When you power on or restart the vault, you will hear a chime after about 3-5 minutes. This means the operating system (OPNsense) has fully loaded and the vault is ready. If you don’t hear the chime after 5 minutes, something may be wrong.
Thermal Behavior
The vault has no fans. The entire aluminum case acts as a heatsink, pulling heat away from the CPU and radiating it into the air. The case will feel warm to the touch. This is completely normal and by design.
| Temperature | What It Means |
|---|---|
| 40-60°C | Idle or light use |
| 60-70°C | Normal load |
| 70-85°C | Heavy load, still normal for fanless design |
| 90°C+ | Thermal throttling (vault slows down to cool off) |
The vault is designed for 24/7 operation at 70-85°C. Don’t put it in an enclosed cabinet or stack things on top of it. Give it a little airflow and it will run for years.
Dashboard temperature warning: The OPNsense dashboard reports CPU temperatures 10-18°C higher than the actual hardware temperature. This is a known software reporting issue, not a hardware problem. If the dashboard shows a temperature that seems alarming, the actual temperature is lower. If you ever want to check the real temperature, you can run this command via SSH:
sysctl dev.cpu.0.temperaturePerformance
The VP2430 has been validated in the OSS Security Performance Lab with the full security stack enabled:
| Metric | Result |
|---|---|
| Throughput | ~1.7 Gbps with full security stack |
| Packet Loss | 0% |
| Added Latency | Less than 5ms |
| CPU at Sustained Load | ~25% (thermal plateau, this is normal) |
| Peak Temperature | 69°C |
Full security stack means: Suricata IDS/IPS with ~200,000 active threat signatures, DNS filtering blocking 1+ million malicious domains, IP blocklist blocking ~45,000 known malicious addresses, and traffic shaping. All running simultaneously.
What this means for you: The VP2430 delivers 500 Mbps more throughput than the V1410 under full security load. If you have multi-gigabit internet or want extra headroom for future ISP upgrades, the VP2430 handles it without breaking a sweat.
Real-world context: A typical household peaks at 150-200 Mbps even with 4K streaming, video calls, and gaming all going at once. The VP2430 handles 1,700 Mbps. You have 8-10x more capacity than you’ll ever need.
coreboot Firmware
Your vault ships with coreboot, an open-source BIOS replacement. Most computers use proprietary BIOS/UEFI firmware that you can’t inspect or verify. coreboot is open source, meaning the code that runs before your operating system even loads is publicly reviewable.
Combined with Intel ME disabled via HAP, OPNsense (open source), WireGuard (open source), and the published SecureNet configurations, the VP2430 runs the most transparent security stack available. From firmware through VPN tunnel, everything is open and auditable. No black boxes anywhere.
Storage
The VP2430 comes with a 500 GB Kingston NV3 NVMe SSD. OPNsense uses very little disk space:
| Timeline | Disk Used |
|---|---|
| Fresh install | 1-2% |
| After 1 month | 2-5% |
| After 6 months | 5-10% |
The NVMe interface means faster boot times and faster log writes compared to SATA, but in everyday use you won’t notice a difference. The vault boots, runs, and stays running. 500 GB is far more than you’ll ever need for firewall use.
The Intel i226 NIC
The vault uses Intel i226-V 2.5 Gigabit network chips. These are the same NICs as the V1410. They’re high quality but they are subject to lockups and failures as all NICs are.
Failure modes:
- Complete failure (link LED goes off and doesn’t come back)
- Lockup (link LED stays on but no data flows)
- Intermittent (works, stops, works, stops)
This is why Port 4 exists. If Port 1 fails, move the cable to Port 4 and keep going. The vault’s monitoring system (Monit) will send you an email alert if Port 1 goes down for more than an hour, often catching the problem before you even notice.
A recovery of the NIC is usually possible with a CMOS reset. A CMOS reset clears the BIOS cache and reloads the firmware typically resetting the NIC entirely. Please see Protectli’s Knowledge Base article for a tutorial: https://kb.protectli.com/kb/cmos-reset/
If a NIC dies within the 2-year warranty period, OSS coordinates the RMA with Protectli. You ship the old vault, receive a replacement, and restore from your backup.
Placement
- Place the vault on a flat surface with airflow around it or mount it
- Do not put it in a closed cabinet, drawer, or shelf with no ventilation
- Do not stack anything on top of it
- Keep it near your modem and access point to keep cable runs short
- The vault is silent so it can go anywhere you don’t mind seeing a small box
Warranty and Support
| Coverage | Details |
|---|---|
| Hardware warranty | 2 years from Protectli |
| RMA coordination | OSS handles communication with Protectli on your behalf |
| Hardware failure support | Included for all customers |
| Full support (everything OSS touches) | Included with SafeNet subscription |
What Comes in the Box
| Item | Included |
|---|---|
| Protectli VP2430 vault | Yes, pre-configured with SecureNet OS |
| Power adapter (12V DC) | Yes |
| Ethernet cables | 2x included |
| Wireless access point | Purchased separately (optional) |