Hello beautiful people of this community!

I asked for your help a month back about setting up OPNsense on Proxmox. I went through all the comments in the post.

I got a bit distracted by IRL commitments but I sat down with it properly last week. After a lot of studying, and a bit of trial and error, I have done it!

My Journey

This was my first time with Proxmox, so I spent a few weeks with Proxmox initially before undertaking OPNsense. OPNsense took me a week to install and deploy. I did a staggered deployment over multiple days, i.e., installed the VM first, check connectivity, check DHCP, and then make it part of my homelab.

Architecture

The diagram might look complicated, but it’s simple.

• My host has 3 interfaces, onboard NIC and a dual NIC card.
• I made a LAN and WAN interface out of the dual NIC card, and made the onboard NIC as a management interface.
• I connected all of the interfaces to dedicated Linux bridges and the underlying OS/VMs only use the Linux bridges.
• The onboard NIC was converted into a management interface and is only used to configure Proxmox in case something catastrophic happens.
• The other VMs can communicate with the OPNsense VM via the virtual LAN interface.

I initially was thinking of going through the pass-through option, but after some research, I saw the upsides were very low and you lose a bit of flexibility.

Challenges

1. KEEP TRACK OF YOUR NIC TO LINUX BRIDGE MAPPING - This caused me a lot of stress and trails. I thought I was trying to ping the LAN interface, was connected to the WAN bridge.
2. The Chicken & Egg Problem - During boot, Proxmox needs an IP but the DHCP service inside OPNsense is not up yet. Without that IP, I cannot log into Proxmox. I solved it using a hard-coded IP for Proxmox.
3. Options galore - Coming from standard routers, OPNsense is a different beast; it has so many options that it becomes a crazy labyrinth. Had to read again and again to understand what the options meant.
4. Where is dark mode? - The first change that I wanted to do was set dark mode and I don’t know why but it an ungodly amount of time for something so simple. It’s present in such a weird location (System -> Settings -> General -> Theme)
5. This ain’t Kansas anymore - This is FreeBSD, not Linux. So the same commands won’t work. There is drill, no dig.
6. PLEASE CLICK APPLY - Many times I just forgot to click Apply after making a change and I got super confused.
7. DNS, YOU DEVIL - This was the setting which made me question my own sanity. I have a simple but non-standard setup for DNS. I am running Pihole (Ad-blocking + Local domains) + Adguard DNS Proxy (Supports encrypted DNS). I wanted to tell OPNsense “Hey, use this IP to resolve all internal and external DNS queries”. OPNsense was just not having it. It took me two days of experimentation to finally figure out the right approach (Disable WAN populated DNS, turn off Unbound, and use DHCP options).

Thanks to these people

Their comments really helped me out (Technical and encouragement)

• @[email protected]
• @[email protected]
• @[email protected]
• @[email protected]

Closing remarks

I am still documenting the entire process. I will publish the entire process of how I got a bare Lenovo M720Q working as a virtualized OPNsense router. Remember, if I can do it, anyone else can do it.

Edit: FreeBSD, not OpenBSD

I am in the process of setting up a virtualized OPNsense firewall on Proxmox on a Thinkcentre 720q. The proxmox host has 3 network interfaces.

• A dual NIC gigabit card where one interface is for WAN and other for LAN, say eth1 and eth2
• Another interface which came with the PC itself, say eth3

PS: I also have a switch for all my other devices.

After some research, I have understood that

1. Passing (pass-through) the NIC to the OPNsense VM is better for performance
2. Passing it through removes the interface from the host OS
3. If passing is not done correctly, you may lose access to Proxmox.

My questions are

1. How do I set eth2 to be the LAN port and also use it connect to proxmox?
2. If I use point #1 (eth2 for LAN), how much will the throughput of eth2 be affected? (My ISP provides me symmetrical 320 Mbps link speed)
3. If I use point #1, will local traffic (traffic handled by my switch) be affected?
4. (Optional/Experimental) Since I have a spare port (eth3), can I use it for special purpose (a dedicated management port which will work even if OPNsense is down)?
5. If I use point #4, my switch will have two ethernet connections from the proxmox host. Will this cause loops and kill my network?

You can answer this selectively by mentioning the question number.

If you have a better idea regarding how to setup OPNsense on Proxmox, please share.

Edit #1: Thank you for all your responses! It seems I have to study a lot. Let me answer a few questions

1. I am not managing workloads for a dozen of people with strict SLAs. I’m just doing it for my family and myself.
2. I understand the point that something as critical as a firewall should have its own hardware. However, I just want to experiment with few VMs on Proxmox. I want to setup Proxmox once and let it be.
3. I eventually want to get into VLANs but that is not a priority right now. My future plan is to integrate this with some Omada access points.
4. I’ve added a diagram of what I want to do. Please forgive my crude drawing as it’s the best I can do for now.

Please let me know if you want some more information

Edit #2: Thank you for sharing your experience with Proxmox and OPNsense. I’m still reading and re-reading all of your comments to check if I have missed anything.

I have made a small mistake of not ordering the dual NIC + angled riser card before the host arrived, so my host is currently idle. When it arrives, and I manage to set it up, I will make a new post and share what i’ve learnt.

Thank you again!