These are the firewall and evidence-workflow checks from my V1610 Home SOC build: physical detection, inline blocking and rollback, isolated PF tests, Suricata replays, path measurements, temperature, retention and restart recovery. The local models run on the Minisforum, where their results are listed separately.
Protectli provided this V1610 for the project. CPU and firewall tests ran on the Vault; evidence collection, storage and dashboard recovery used the Windows host. These are recorded checks with their original test dates, not a live device-health feed.
I followed a harmless request from my Windows client into Suricata, changed only its test signature to drop, and then restored it to alert. HTTPS and DNS controls checked that ordinary traffic still worked while the selected request was blocked.
Open full testI used three temporary FreeBSD VNET stacks on the Vault to check a small PF policy with real packets, captures and counters. The eight cases cover allowed controls, NAT, unsolicited WAN traffic, spoofing and finite bursts.
Open full testI kept engine regressions separate from replays of the installed policy. That distinction matters here: the upstream regression cases passed, while the installed rules produced zero alerts on 20 unchanged upstream captures.
Open full testI measured short, certificate-validated downloads through the final IDS and IPS configurations using the same fixed endpoint. The individual trials stay here alongside their medians because the Internet path varied between requests.
Open full testI also transferred fixed payloads from a bounded server on the Vault to the owned LAN client, then retained the engine counters with their actual observation windows. Successful downloads and complete packet inspection are different measurements here.
Open full testFour owned CPU-load processes completed the 180-second check with five-second core-temperature sampling. The peak was 62 °C, followed by recorded cooling and process cleanup.
Open full testThe firewall records also need to survive review and a restart. These checks cover Vault event forwarding, the Windows evidence tools, rolling storage and recovery after sign-in, with the maintenance gaps and failed readings kept in the record.
Open full testEvery retained row
I followed a harmless request from my Windows client into Suricata, changed only its test signature to drop, and then restored it to alert. HTTPS and DNS controls checked that ordinary traffic still worked while the selected request was blocked.
This is a physical client-to-Vault check with exact connection evidence. The test signature verifies this inspection path; it is not a detection-rate study or inspection of decrypted HTTPS payloads.
Physical path · alert-only
Measured on Protectli V1610 · Owned Vault test
HTTP 200 returned the exact 39-byte UID body, and the original EVE record identified SID 2100498 with action allowed for the matching connection.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Physical path · alert-only
Physical path · inline Netmap drop
Measured on Protectli V1610 · Owned Vault test
curl timed out after ten seconds without a response body, while the exact corresponding EVE connection was recorded as blocked. Both observations are required for this result.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Physical path · inline Netmap drop
Physical path · HTTPS and DNS controls
Measured on Protectli V1610 · Owned Vault test
Certificate-validated HTTPS and a DNS lookup through the Vault both passed while the selected fixture rule was active.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Physical path · HTTPS and DNS controls
Physical path · test rule returned to alert
Measured on Protectli V1610 · Owned Vault test
The repeated UID request returned HTTP 200 and 39 bytes, with an exact allowed EVE match and the generated signature action back at alert.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Physical path · test rule returned to alert
Final installed snapshot
Measured on Protectli V1610 · Owned Vault test
Native validation exited successfully with dependency-complete selected rules. The final snapshot held 37,125 active rules: 37,121 alerts and four drops across ten enabled categories. Feed updates can change these counts.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Final installed snapshot
Recorded appliance configuration
Measured on Protectli V1610 · Owned Vault test
Listener, rule and console checks confirmed LAN-only HTTPS management, disabled SSH and password-protected console access. The off-device XML matched its device-side SHA256; five boot environments were retained on the SSD. The XML stays private because it contains secrets, and same-disk boot environments do not replace it.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Recorded appliance configuration
I used three temporary FreeBSD VNET stacks on the Vault to check a small PF policy with real packets, captures and counters. The eight cases cover allowed controls, NAT, unsolicited WAN traffic, spoofing and finite bursts.
The authored policy mirrors core LAN pass, WAN deny, NAT and anti-spoof behavior. It does not import every OPNsense anchor or table, and the finite bursts are blocking checks rather than a DoS-capacity measurement.
Isolated VNET · core PF mirror
Measured on Protectli V1610 · Virtual packet exchange on the Vault
HTTP 200 returned the exact 39-byte body/hash; allowed LAN traffic and the NAT peer were verified.
Protectli V1610 · FreeBSD VNET / authored PF mirror · Virtual packet exchange on the Vault · Isolated VNET · core PF mirror
Isolated VNET · core PF mirror
Measured on Protectli V1610 · Virtual packet exchange on the Vault
The same endpoint and body/hash passed over HTTPS, with no plaintext UID string in captured TCP payloads.
Protectli V1610 · FreeBSD VNET / authored PF mirror · Virtual packet exchange on the Vault · Isolated VNET · core PF mirror
Isolated VNET · core PF mirror
Measured on Protectli V1610 · Virtual packet exchange on the Vault
Three requests received three replies, with six packets on the allow counter.
Protectli V1610 · FreeBSD VNET / authored PF mirror · Virtual packet exchange on the Vault · Isolated VNET · core PF mirror
Isolated VNET · core PF mirror
Measured on Protectli V1610 · Virtual packet exchange on the Vault
Eight distinct SYN packets arrived, caused eight deny increments and were not forwarded to the virtual LAN.
Protectli V1610 · FreeBSD VNET / authored PF mirror · Virtual packet exchange on the Vault · Isolated VNET · core PF mirror
Isolated VNET · core PF mirror
Measured on Protectli V1610 · Virtual packet exchange on the Vault
Five UDP datagrams with a LAN-range source alias arrived on virtual WAN and caused five anti-spoof increments.
Protectli V1610 · FreeBSD VNET / authored PF mirror · Virtual packet exchange on the Vault · Isolated VNET · core PF mirror
Isolated VNET · core PF mirror
Measured on Protectli V1610 · Virtual packet exchange on the Vault
All 200 packets at a configured 100 packets per second reached the deny counter, with none forwarded.
Protectli V1610 · FreeBSD VNET / authored PF mirror · Virtual packet exchange on the Vault · Isolated VNET · core PF mirror
Isolated VNET · core PF mirror
Measured on Protectli V1610 · Virtual packet exchange on the Vault
One hundred finite attempts produced 100 captured SYNs and 100 deny increments, with none forwarded.
Protectli V1610 · FreeBSD VNET / authored PF mirror · Virtual packet exchange on the Vault · Isolated VNET · core PF mirror
Isolated VNET · core PF mirror
Measured on Protectli V1610 · Virtual packet exchange on the Vault
Three echo requests arrived on virtual WAN, caused three deny increments and were not forwarded.
Protectli V1610 · FreeBSD VNET / authored PF mirror · Virtual packet exchange on the Vault · Isolated VNET · core PF mirror
I kept engine regressions separate from replays of the installed policy. That distinction matters here: the upstream regression cases passed, while the installed rules produced zero alerts on 20 unchanged upstream captures.
These are offline engine runs on the Vault. Upstream cases carry their own rules and assertions; installed-policy runs use the appliance snapshot. Offline drop records show rule selection, while physical-wire blocking is documented in the separate inline test.
Upstream fixtures and their own rules
Measured on Protectli V1610 · Owned Vault test
23 distinct cases passed. One SSH case was skipped because it requires Suricata 9; it is not included as a pass.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Upstream fixtures and their own rules
Unchanged PCAPs · appliance rule snapshot
Measured on Protectli V1610 · Owned Vault test
All 20 replays completed with zero alerts. These captures and the installed policy did not produce alert coverage in this run.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Unchanged PCAPs · appliance rule snapshot
Original invalid TCP checksums retained
Measured on Protectli V1610 · Owned Vault test
The HTTP UID fixture produced one allowed signature alert and other cases produced no alerts. Invalid TCP checksums prevent using this original replay to infer HTTPS stream inspection.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Original invalid TCP checksums retained
Only invalid TCP checksum fields changed
Measured on Protectli V1610 · Owned Vault test
All eight corrected replays completed with zero invalid TCP checksums. HTTP produced three allowed alerts including the UID signature; HTTPS produced one TLS event without a UID alert.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Only invalid TCP checksum fields changed
Inert offline SNI positive and negative fixtures
Measured on Protectli V1610 · Owned Vault test
Four exact names produced blocked matches and drop records. Four suffix negatives and one reserved-domain control avoided those matches; all nine met the authored expectations.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Inert offline SNI positive and negative fixtures
I measured short, certificate-validated downloads through the final IDS and IPS configurations using the same fixed endpoint. The individual trials stay here alongside their medians because the Internet path varied between requests.
These rates include connection and TLS setup. Upstream conditions, endpoint behavior and other client traffic were not isolated, so the difference does not measure inspection overhead or maximum forwarding capacity.
Routed Internet · three complete 25 MB requests
Measured on Protectli V1610 · Owned client routed through the Vault
Individual payload rates were 537.017, 533.622, 549.84 Mbps. Every request completed under the same final-platform protocol; the median describes this endpoint/path observation.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned client routed through the Vault · Routed Internet · three complete 25 MB requests
Routed Internet · three complete 25 MB requests
Measured on Protectli V1610 · Owned client routed through the Vault
Individual payload rates were 493.027, 480.639, 623.063 Mbps. Every request completed under the same final-platform protocol; the median describes this endpoint/path observation.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned client routed through the Vault · Routed Internet · three complete 25 MB requests
I also transferred fixed payloads from a bounded server on the Vault to the owned LAN client, then retained the engine counters with their actual observation windows. Successful downloads and complete packet inspection are different measurements here.
This workload terminates on the Vault, so it is not WAN forwarding throughput. PCAP kernel drops span its full runtime without an isolated pre-LAN boundary; the Netmap stream-discard snapshot uses a different window and cannot serve as a matched loss comparison.
LAN-terminating server · four 128 MiB payloads
Measured on Protectli V1610 · Owned Vault test
Four complete rates were 2370.291 Mbps each under the recorded timer. The sampled core maximum was 60 °C.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · LAN-terminating server · four 128 MiB payloads
LAN-terminating server · four 128 MiB payloads
Measured on Protectli V1610 · Owned Vault test
Four complete rates were 848.137, 827.866, 848.808 and 848.137 Mbps. The sampled core maximum was 55 °C.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · LAN-terminating server · four 128 MiB payloads
Different engine windows · preserve each denominator
Measured on Protectli V1610 · Owned Vault test
PCAP cumulative counters cover 40+ minutes without a pre-LAN boundary. Netmap counters cover 5m14s after restart; its 188 discards were stream errors of unproven cause. No emitted kernel-drop counter is not a zero-loss certificate.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Different engine windows · preserve each denominator
The firewall records also need to survive review and a restart. These checks cover Vault event forwarding, the Windows evidence tools, rolling storage and recovery after sign-in, with the maintenance gaps and failed readings kept in the record.
This is a two-machine workflow: the Vault supplies events and native observations, while Windows receives, indexes and serves them. Scheduled recovery requires Windows sign-in, and USB sampling needs an authenticated appliance console after a Vault reboot. The Hub is a saved result record, not a live health monitor.
Isolated loopback receiver and evidence builder
Tested system: Protectli Vault + Windows evidence host · Two-machine evidence workflow; isolated host replay
17 cases delivered 153 datagrams with the expected SID/action counts; seven original references verified and the report/source routes returned HTTP 200. These were replay receipts, without model inference. The separate local pipeline/fault lane passed 75 software tests using temporary stores and mocked failure conditions.
Protectli V1610 · Windows Python receiver, evidence builder and dashboard · Two-machine evidence workflow; isolated host replay · Isolated loopback receiver and evidence builder
Current policy · fixture-tested expiry and live activation
Tested system: Protectli Vault + Windows evidence host · Windows evidence storage
The live migration preserved all setup bytes and returned new Vault receipts without a full/storage-error state. Hot originals roll at 32 MiB into a verified compressed cold tier; ordinary sealed segments expire seven days after sealing or earlier under capacity pressure.
Protectli V1610 · Windows Python / rolling-v2 / SQLite · Windows evidence storage · Current policy · fixture-tested expiry and live activation
Separate pins · exact hashes · visible expiry
Tested system: Protectli Vault + Windows evidence host · Windows evidence storage
New operator notes preserve their cited raw records under a separate 64 MiB / 4,096-record budget. A full pin budget refuses another note while collection continues; an expired unpreserved source returns HTTP 410. The pre-activation suite passed 250 tests, including storage and recovery fixtures.
Protectli V1610 · Windows Python / rolling-v2 / SQLite · Windows evidence storage · Separate pins · exact hashes · visible expiry
Recorded appliance reboot and newer Windows boot
Tested system: Protectli Vault + Windows evidence host · Vault + Windows sign-in recovery
The Vault reached its login prompt in about 59 seconds. After Windows reboot and sign-in, recovery started the owned components and the next check reused them without duplicates. Original log prefix, notes and backup hashes matched; certificate-valid HTTPS, direct Vault DNS and exact UID/EVE correlation passed.
Protectli V1610 · Vault boot / Windows Task Scheduler and PowerShell · Vault + Windows sign-in recovery · Recorded appliance reboot and newer Windows boot
Later ownership-receipt repair, without a new reboot
Tested system: Protectli Vault + Windows evidence host · Windows sign-in and five-minute recovery
A manual receiver launch had left a stale recovery-owner receipt. After exact ownership reconciliation, the scheduled task restored the dashboard and reporting runtime, then repeated the restoration after an idle dashboard stop without stopping collection. Original files/prefixes verified. This repair was not a new sign-out/sign-in or reboot test.
Protectli V1610 · Windows Task Scheduler / PowerShell 7 · Windows sign-in and five-minute recovery · Later ownership-receipt repair, without a new reboot
Historical snapshot, not current live health
Tested system: Protectli Vault + Windows evidence host · Vault + Windows evidence workflow
352 observations recorded sampled cores at 30–56 °C, with no sampled full/storage-error/capacity-warning state. Five gaps exceeded ten minutes, including an 11h57 host interruption; one native reading had unknown fields and another was stale. Maintenance and UDP receipt uncertainty remain visible.
Protectli V1610 · Vault native sensors / Windows observation journal · Vault + Windows evidence workflow · Historical snapshot, not current live health
Point-in-time host/appliance clock comparison
Tested system: Protectli Vault + Windows evidence host · Vault + Windows evidence workflow
The Windows time-service repair completed a successful resync and cleared its synchronization warning. A direct comparison then showed about 46 ms difference from the Vault. Earlier records with roughly 20 seconds of skew stayed unchanged; these offsets are not network latency or a clock-drift study.
Protectli V1610 · Windows W32Time / Vault clock · Vault + Windows evidence workflow · Independent clock check after repair
Four owned CPU-load processes completed the 180-second check with five-second core-temperature sampling. The peak was 62 °C, followed by recorded cooling and process cleanup.
Thirty-six samples from one short load, not independent thermal trials. This is a CPU-core observation, not case-surface temperature, thermal equilibrium, longevity or an overheating guarantee for every environment.
Four owned load processes
Measured on Protectli V1610 · Pentium Silver N6005
Highest core 62 °C, final readings 53/53/53/52 °C, cooldown 47 °C. No thermal stop; all owned children exited. This does not measure thermal equilibrium or case surface.
Protectli V1610 · Native FreeBSD core sensors · Pentium Silver N6005 · 180-second bounded CPU load