A dual-NIC mini PC running Proxmox is one of the most cost-effective home lab firewall platforms you can build. In this guide I’ll walk through installing Proxmox VE 9.1 on a GMKtec N150 mini PC, configuring its two network ports as dedicated WAN and LAN bridges, and deploying both pfSense and Sophos Home Firewall as virtual machines — giving you two fully functional firewalls to test, compare, and switch between.
🎥 Watch the Video Tutorial
💡 Why This Hardware?
The GMKtec N150 hits a sweet spot for a home lab firewall host. The Intel N150 processor is nearly passively cooled, draws very little power at idle — making it viable to run 24/7 — and the dual LAN ports are a genuine selling point. Most mini PCs ship with a single NIC, which means buying a USB network adapter and dealing with driver compatibility headaches. The N150 gives you a dedicated WAN port and a dedicated LAN port out of the box.
Running the firewall as a VM rather than bare-metal means you can snapshot before making changes, keep pfSense and Sophos side by side and switch between them, and run other VMs on the same host when the firewall doesn’t need all the resources.
🛠 What You’ll Need
- Proxmox VE ISO — free download
- pfSense ISO — Netgate AMD64 ISO image (free, requires account registration)
- Sophos Home Firewall ISO — free, requires name and email registration for a serial number
- A bootable USB with all three ISOs — Ventoy is the easiest method, or use Balena Etcher for individual USB sticks
- A Windows machine or laptop to access the Proxmox web UI after installation
📋 Step-by-Step Setup
1. Disable Secure Boot in the GMKtec BIOS
Power on the GMKtec and press F7 immediately to enter the boot menu. Go into Enter Setup → Security → Secure Boot and disable it. Proxmox will not install with Secure Boot enabled.
Press F7 again after saving to access the boot menu and select your Proxmox USB installer. Choose Normal mode at the Proxmox boot screen.
2. Install Proxmox VE using the terminal UI
If you don’t have a mouse connected, select Install Proxmox VE (Terminal UI) — it lets you complete the entire installation with keyboard navigation only. Work through the installer:
- Accept the EULA
- Select the 256GB internal SSD as the target disk
- Set your country, timezone, and keyboard layout
- Set a strong root password and administrator email address
- Hostname: give it something meaningful — e.g.
proxnick.ithomelab.local(the.localsuffix makes it a valid FQDN) - IP address: set a static IP on your LAN — e.g.
10.0.2.200/22. Your subnet mask will typically be/24(255.255.255.0) - Gateway: your router’s IP address
- DNS: your router or a public DNS like
8.8.8.8
Click Install. Proxmox takes a few minutes to install. When prompted, eject the USB and let it reboot.
3. Configure the WAN NIC for internet access
The Proxmox installer only configures one network interface (the LAN bridge). To give Proxmox itself internet access for updates, you need to enable DHCP on the second NIC. Log into the Proxmox console at the terminal and edit the network interfaces file:
nano /etc/network/interfaces
The file will show vmbr0 configured with your static LAN IP and gateway. You need to make two changes:
- Remove the
gatewayline fromvmbr0— the gateway should come from the WAN side once your firewall VM is running, not from the LAN bridge - Add a new entry for the second physical NIC (e.g.
enp2s0) configured for DHCP:
auto enp2s0\niface enp2s0 inet dhcp
Save the file (Ctrl+X → Y → Enter) and restart networking:
systemctl restart networking
ip link show to list all interfaces and identify the second one. It will typically be enp2s0 or similar.4. Run the Proxmox post-install script
The post-install script from tteck disables the enterprise subscription repository (which requires a paid licence), enables the free community repository, removes the subscription nag popup, and optionally disables high availability services you don’t need in a home lab:
bash -c \"$(wget -qLO - https://github.com/tteck/Proxmox/raw/main/misc/post-pve-install.sh)\"
Work through the prompts — disable the enterprise repo, keep the no-subscription repo, disable the subscription nag, skip high availability. When it asks to reboot, decline for now.
5. Update Proxmox
apt update && apt dist-upgrade -y
Once updates complete, reboot:
reboot
6. Upload ISO files to Proxmox
From a browser on your Windows machine, navigate to https://<proxmox-ip>:8006 and log in as root. Go to Datacenter → local → ISO Images → Upload and upload both the pfSense ISO and the Sophos Home Firewall ISO.
7. Create the second Linux bridge for WAN
Before creating firewall VMs, set up a second network bridge that maps to the physical WAN NIC:
- Go to your node → System → Network → Create → Linux Bridge
- Leave the IP fields blank — the firewall VM will manage addressing on this interface
- Set Bridge ports to your second physical NIC (e.g.
enp2s0), which becomesvmbr1 - Click Create then Apply Configuration
After this: vmbr0 = LAN bridge, vmbr1 = WAN bridge.
🔥 Installing pfSense as a VM
8. Create the pfSense VM
Click Create VM and configure:
- Name: pfSense (or similar)
- OS: Netgate pfSense ISO, Type: Other
- System: Machine type:
q35, leave everything else default - Disk: 16 GB is sufficient — keeping it lean leaves room for snapshots. The 256GB SSD gives you space for several snapshots per firewall
- CPU: 2 cores
- Memory: 2048 MB — you’ll only run one firewall VM at a time so you can afford to be generous
- Network:
vmbr0(LAN) — model: VirtIO
After the VM is created, add the second NIC for WAN: select the VM → Hardware → Add → Network Device → Bridge: vmbr1.
9. Install pfSense
Start the VM and open the console. Work through the pfSense installer:
- Accept the agreement → Install pfSense
- When asked to assign interfaces:
vtnet1= WAN (the second NIC, connected tovmbr1),vtnet0= LAN - Set LAN IP to match your network (e.g.
10.0.2.1as the gateway your LAN devices will use) - Configure DHCP range for your LAN if needed
- Select Install — Community Edition, accept the default filesystem, confirm disk wipe
- Select the current stable release and let it download and install
After installation, reboot. Once pfSense is up, access the web interface from your browser at https://10.0.2.1 (or whichever LAN IP you set). Default credentials: username admin, password pfsense.
10. Shut down pfSense before starting Sophos
Both firewalls share the same WAN bridge. Only run one at a time to avoid routing conflicts. Shut down pfSense from the console with option 6, or from the Proxmox web UI.
🛡 Installing Sophos Home Firewall as a VM
11. Create the Sophos VM
Sophos requires slightly more resources and uses two disks:
- Name: Sophos-Home-Firewall
- OS: Sophos Home Firewall ISO, Type: Other
- System: Machine type:
q35 - Disk 1: 32 GB, type: VirtIO Block (
virtio), write-back cache - CPU: 2 cores
- Memory: 4096 MB
- Network:
vmbr0(LAN), model: Intel E1000 for guaranteed driver compatibility
After creating the VM, add a second disk: Hardware → Add → Hard Disk → 80 GB, VirtIO Block, write-back. This is the recommended storage spec from Sophos. Then add the WAN NIC: Hardware → Add → Network Device → Bridge: vmbr1, model: Intel E1000.
12. Install Sophos Home Firewall
Start the VM and open the console. Sophos installs its own operating system from the ISO — accept the prompts and let it run. It takes a few minutes. Press Y to reboot when prompted.
After rebooting, Sophos shows a console with the default management IP — typically 172.16.16.16. Since this won’t be reachable from your LAN, change it to match your network:
- Select the network configuration option from the Sophos console menu
- Set the LAN interface IP to the same address as your pfSense LAN IP (e.g.
10.0.2.1) — safe to reuse since they’ll never run simultaneously - Set the subnet mask to match your network
Once the IP is updated, access the Sophos web admin interface from your browser and log in with default credentials: username admin, password admin.
10.0.2.1) since you’ll only ever run one firewall at a time. Your LAN devices keep the same default gateway regardless of which firewall is active — no reconfiguration needed when you switch between them.✅ Conclusion
You now have Proxmox running on a low-power dual-NIC mini PC with both pfSense and Sophos Home Firewall available as virtual machines. The GMKtec N150 draws little enough power to run 24/7 without a meaningful electricity cost, and the snapshot capability means you can experiment with firewall configurations and roll back instantly if something goes wrong. Take a snapshot of each firewall VM after the base install before you start configuring rules.
Previous guide: Proxmox VE Home Lab Setup — Step-by-Step Installation Guide
📺 Watch the full video guide here: https://youtu.be/Eys-856aXxw
If you found this helpful, like and subscribe to IT HomeLab Online on YouTube for more tutorials.
☕ Support the channel: Patreon · Buy Me a Coffee