Network Security — hobby stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
1. Firewall Platform - Virtual / Edge NGFW
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitspfSense CE: Free OSS unlimited, community support. pfSense Plus: $129/yr/instance. OPNsense: Free. FortiGate-VM: $0.80/hr = ~$576/mo PAYG, BYOL $600/yr + support. Palo Alto VM-300: $1.50/hr = ~$1080/mo PAYG, bundle $3000/yr with Threat Prevention. Free tier limits: Community edition unlimited throughput, no TAC.
2. VPN Gateway - Remote Access VPN
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWireGuard: Free OSS unlimited. OpenVPN AS: Free 2 concurrent users, $15/mo for 10 concurrent, $0.50/hr for 20. Tailscale: Free 100 devices/3 users, Pro $6/user/mo, Enterprise $18/user/mo. Pritunl: Free tier 1 gateway. Overage: Tailscale $6 per extra user.
3. Site-to-Site VPN / SD-WAN Edge Router
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsstrongSwan: Free OSS. ZeroTier: Free 25 nodes, Basic $50/mo 50 nodes. Fortinet SD-WAN: Included in FortiGate license $800/yr per edge. Meraki vMX: $600/yr + license. Palo Alto Prisma SD-WAN: $1.2k/yr per site. Free limit: WireGuard unlimited tunnels, manual mesh.
4. IDS/IPS Engine - Network Intrusion Detection/Prevention
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSuricata: Free OSS unlimited, community rules. Snort: Free community rules delay 30d, Subscriber Rules $29/mo, Snort 3 integrated $99/mo. Palo Alto Threat Prevention: $2000/yr per VM-300. FortiGate IPS: $1200/yr. CrowdStrike Falcon IDS: $59.99/host/mo. Free tier: Suricata/Snort handle 10Gbps on commodity HW.
5. Network Access Control (NAC)
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsPacketFence: Free OSS unlimited endpoints, community support. OpenNAC: Free 50 endpoints. Cisco ISE: Base $50k/yr + $4/endpoint/mo, ~$120k/yr for 1000 endpoints. Forescout: $50k/yr base + $8/endpoint. Aruba ClearPass: $15k starter + $10/endpoint. Free limits: PacketFence supports 10k nodes on 1 VM.
6. Network Segmentation / Microsegmentation Controller
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCalico OSS: Free. Illumio Core: $50k/yr starter 100 workloads, $500/workload/yr scale. Guardicore: 30-day free trial, then $60k/yr 100 workloads, $400/workload. VMware NSX microseg: $6k/CPU/yr. Free limits: Manual VLAN ACLs unlimited but no visibility.
7. Network Traffic Monitoring / NDR (Network Detection & Response)
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsZeek: Free OSS, needs 16GB RAM per 10Gbps. ntopng Community Free 30-day retention. Arkime: Free OSS. ExtraHop: $50k/yr base 1Gbps, $95k/yr 10Gbps. Darktrace: $100k/yr starter, $8k per 1Gbps sensor. Vectra AI: $70k/yr. Free limit: Zeek unlimited sensors community support.
8. DDoS Protection / Anti-DDoS Edge & Transit
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsFastNetMon OSS: Free. AWS Shield Standard: Free included. Cloudflare Free: Unlimited unmetered mitigation L3/4. Magic Transit: $5000/mo base includes 20TB, $0.05/GB overage, $10k/mo for 100TB commits. AWS Shield Advanced: $3000/mo + $0.05/GB + $0.10/hr WAF. Akamai Prolexic: $7500/mo. Imperva: $6000/mo. Free limits: Self-hosted handles <20Gbps with BGP blackholing.
9. Log Management / SIEM for Network Logs (Firewall, Flow)
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsElastic OSS: Free self-hosted unlimited ingest. Elastic Cloud: $95/mo 1GB/day, $0.15/GB overage. Graylog: Free 5GB/day, Enterprise $1500/mo. Splunk: $150/GB/mo, Cloud $2k/mo 5GB/day. Wazuh: Free. Devo: $80/GB. Free limits: ELK 100GB disk per node ~2TB/month flows on 1 node, retention 7 days.
10. Secrets Management for Firewall / VPN Credentials
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS: Free unlimited secrets, self-hosted. Infisical: Free 10 users, Cloud $20/mo. Doppler: Free 5 users/100 secrets, Pro $15/user/mo. HCP Vault: $0.03/hr cluster (~$22/mo) + $0.10/secret/mo >1000. CyberArk Conjur: $30k/yr. Free limits: Vault OSS 0$ but HA needs 3 nodes.
11. Network Infrastructure Monitoring / Uptime & SNMP
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsPrometheus/Grafana: Free OSS unlimited metrics. LibreNMS: Free. Zabbix: Free. Checkmk Raw: Free 750 services. Datadog: $15/host/mo infra + $30/host/mo network monitoring, $5/GB logs. SolarWinds NPM: $2.5k/yr 100 nodes, $15k/yr 1000 nodes. PRTG: Free 100 sensors, then $1800/yr 500 sensors. Free limits: LibreNMS monitors 10k ports on 4 vCPU.
How this hobby network security checklist works.
Each requirement below is something a hobby network security build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.