Lenovo M720q as a pfSense or OPNsense Firewall: The Build Guide
A 1-liter business PC with a hidden PCIe slot, a four-port Intel NIC, and the few parts that trip people up.
By Brandon Sheley · Updated
Short answer: a used Lenovo M720q plus a PCIe riser (part 01AJ940), Lenovo's rear baffle and an Intel I350-T4 card makes a quiet, five-port Intel firewall for pfSense or OPNsense, usually for less than a new multi-port mini PC. Use a 90W adapter and boot from M.2, because the card takes the 2.5-inch bay.
Search for this build and you mostly get GitHub READMEs and old forum threads. This pulls the parts list together from Lenovo's own spec sheet and a documented owner build, with live prices from my SFF tracker.
Why the M720q Works as a Firewall
Most 1-liter business PCs have one gigabit port and no way to add more. The M720q Tiny is the exception: Lenovo built it with a low-profile PCIe 3.0 x8 slot, reached through an optional riser card, and even sold a four-port Intel I350-T4 NIC as a factory option. Add that card and you have a quiet, low-power box with five Intel ports (four on the card plus the onboard I219-V), which is exactly what pfSense and OPNsense want.
| Spec (Lenovo PSREF) | M720q Tiny |
|---|---|
| CPU | 8th or 9th gen Intel Celeron, Pentium, Core i3/i5/i7 (and i9 on 9th gen), T-series |
| Chipset | Intel B360 |
| Memory | 2x DDR4-2666 SO-DIMM, 32GB max |
| Storage | 1x M.2 SSD slot, 1x 2.5" bay (the PCIe card and 2.5" drive are listed as mutually exclusive) |
| Expansion | 1x low-profile PCIe 3.0 x8 slot, via riser |
| Onboard network | Intel I219-V gigabit |
| Power adapters | 65W, 90W or 135W |
Source: Lenovo PSREF, ThinkCentre M720 Tiny. The M920q is the same chassis with a Q370 chipset and takes the same riser and cards.
The Parts List
- The M720q itself. Any CPU works for a basic firewall. A Core i3 or i5 is worth it if you'll run intrusion detection (Suricata or Snort) or Proxmox with other VMs alongside the firewall.
- A PCIe riser. The one you'll usually find is Lenovo part 01AJ940 (an x16-style riser). 01AJ902 (x8) and 01AJ929 are other part numbers owners report working. Buy from a seller that shows the part number, and expect the mounting screw to be missing sometimes.
- A network card. The proven choice is an Intel I350-T4 (four gigabit ports), the same card Lenovo offered. For 10G, Intel X520-DA2 or X710-DA2 SFP+ cards are the common picks. Stick to Intel chipsets: they have mature drivers on FreeBSD, which both pfSense and OPNsense run on.
- A rear bracket (baffle). A standard low-profile bracket doesn't fit the Tiny's rear opening. You need Lenovo's baffle plate for the slot, or an aftermarket or 3D-printed copy.
- A 90W power adapter. Lenovo offered 65W, 90W and 135W adapters, and a used unit can come with any of them. ServeTheHome saw a 65W adapter throttle the similar M920q, and a NIC adds load, so use 90W or more.
- An M.2 SSD. With the card installed you should plan on losing the 2.5" bay, so boot from M.2. Some owners report fitting a thin 2.5" SSD alongside a four-port card, but Lenovo lists them as mutually exclusive.
Putting It Together
- Update the BIOS first, while the box still boots Windows or a USB stick easily.
- Fit the card to the riser before it goes in the case. It's much easier than installing the riser first. Swap the card's bracket for the Tiny baffle, seat the riser, and screw it down. The loose 2.5" drive cable you'll see is normal.
- Set the BIOS for a router: set "After Power Loss" to Power On so it comes back after an outage, and turn on VT-d if you're going to run Proxmox and pass the NIC through.
- Check the card is seen. Non-Lenovo cards can occasionally trip a BIOS whitelist. One documented build used a generic, non-Lenovo I350-T4 without trouble, but confirm all four ports show up before you install anything.
- Install pfSense or OPNsense to the M.2 drive from USB, assign WAN and LAN to card ports, and keep the onboard I219-V as a management port.
Bare Metal or Proxmox?
Bare metal is the simple, reliable choice. The firewall owns the hardware, reboots in seconds, and nothing else on the box can take your internet down.
Proxmox makes sense if you want the firewall plus a few other services on one quiet box, or you want snapshots before every firewall update. Run OPNsense or pfSense as a VM and either pass the I350's ports through to it or bridge them. My pfSense and OPNsense on Proxmox guide covers bridges vs passthrough and the VirtIO settings that matter. If you go this way, a Core i5 and 16GB of RAM leave room for everything else.
Power and Noise
ServeTheHome measured 27W at idle and 68W at full load on an M720q with a six-core Core i5, which is on the high side for this class; their quad-core M920q idled at 12-15W. Expect the card to add a few watts. At the U.S. average electricity rate, every 10W running 24/7 is about $16 a year. The fan is quiet at idle and gets audible under sustained load, which a firewall rarely sees.
What It Costs
Current M720q and M920q listings are on the SFF tracker's Lenovo filter.
Add the riser, baffle and an I350-T4 (both commonly sold used on eBay), and a used M720q firewall usually still comes in below a new multi-port N100 or N305 firewall box, with a real PCIe slot and two RAM slots that those don't have. If you'd rather skip the riser hunt, the N305 vs N100 comparison covers the multi-NIC N-series boxes.
Related Resources
pfSense & OPNsense on Proxmox
Bridges vs NIC passthrough and the VirtIO settings for a firewall VM.
Lenovo Tiny Price Tracker
Live ThinkCentre Tiny listings, including M720q and M920q.
N305 vs N100 for Proxmox
The new-hardware alternative: multi-NIC N-series boxes.
Best Mini PC for Proxmox
Where the M720q fits among the other business minis.
Mini PC Idle Power Table
Measured idle and load watts for the M720q and other minis.
Network Switch Tracker
A switch to put behind it, including 2.5GbE models.
Frequently Asked Questions
Does the Lenovo M720q have a PCIe slot?
Yes. The M720q Tiny has one low-profile PCIe 3.0 x8 slot, which you reach by installing a riser card in the space normally used by the 2.5-inch drive bay. Lenovo even sold it with a four-port Intel I350-T4 network card as a factory option, which is why it's a popular pfSense and OPNsense box.
Which riser does the M720q need?
The riser you'll most often find is Lenovo part 01AJ940. Owners also report 01AJ902 and 01AJ929 working. You also need Lenovo's rear baffle plate, because a standard low-profile bracket doesn't fit the Tiny's opening.
What network card should I use in an M720q firewall?
An Intel I350-T4 is the proven choice: four gigabit ports, the same card Lenovo offered, and mature drivers on FreeBSD, which pfSense and OPNsense are built on. For 10G, Intel X520-DA2 or X710-DA2 SFP+ cards are the common choices. Use at least a 90W power adapter with a card installed.
Can I keep a 2.5-inch drive with a NIC installed in the M720q?
Plan on not. Lenovo lists the 2.5-inch drive and the PCIe card as mutually exclusive, because the card sits where the drive normally goes. Boot from the M.2 SSD slot instead. Some owners report squeezing a thin 2.5-inch SSD in next to a four-port card, but it's tight and unsupported.