I am in the process of setting up a virtualized OPNsense firewall on Proxmox on a Thinkcentre 720q. The proxmox host has 3 network interfaces.

  • A dual NIC gigabit card where one interface is for WAN and other for LAN, say eth1 and eth2
  • Another interface which came with the PC itself, say eth3

PS: I also have a switch for all my other devices.

After some research, I have understood that

  1. Passing (pass-through) the NIC to the OPNsense VM is better for performance
  2. Passing it through removes the interface from the host OS
  3. If passing is not done correctly, you may lose access to Proxmox.

My questions are

  1. How do I set eth2 to be the LAN port and also use it connect to proxmox?
  2. If I use point #1 (eth2 for LAN), how much will the throughput of eth2 be affected? (My ISP provides me symmetrical 320 Mbps link speed)
  3. If I use point #1, will local traffic (traffic handled by my switch) be affected?
  4. (Optional/Experimental) Since I have a spare port (eth3), can I use it for special purpose (a dedicated management port which will work even if OPNsense is down)?
  5. If I use point #4, my switch will have two ethernet connections from the proxmox host. Will this cause loops and kill my network?

You can answer this selectively by mentioning the question number.

If you have a better idea regarding how to setup OPNsense on Proxmox, please share.

Edit #1: Thank you for all your responses! It seems I have to study a lot. Let me answer a few questions

  1. I am not managing workloads for a dozen of people with strict SLAs. I’m just doing it for my family and myself.
  2. I understand the point that something as critical as a firewall should have its own hardware. However, I just want to experiment with few VMs on Proxmox. I want to setup Proxmox once and let it be.
  3. I eventually want to get into VLANs but that is not a priority right now. My future plan is to integrate this with some Omada access points.
  4. I’ve added a diagram of what I want to do. Please forgive my crude drawing as it’s the best I can do for now.

Please let me know if you want some more information

Edit #2: Thank you for sharing your experience with Proxmox and OPNsense. I’m still reading and re-reading all of your comments to check if I have missed anything.

I have made a small mistake of not ordering the dual NIC + angled riser card before the host arrived, so my host is currently idle. When it arrives, and I manage to set it up, I will make a new post and share what i’ve learnt.

Thank you again!

  • HiTekRedNek@lemmy.worldEnglish
    1·
    51 minutes ago

    My OPNsense setup is on bare metal. It’s a Sophos SG135 rev 2 with 6GB of RAM and a 64GB NVme SSD.

    It can be upgraded to 16GB, but isn’t nice for my set up.

    I don’t use Proxmox, but I do make extensive use of ZFS across most of my entire homelab.

    My NAS/Media server has 48T of spinning SAS3 drives, runs FreeBSD 15.1, and has a BhyVE VM running Alpine Linux and docker for the 1 or 2 services I use that simply won’t run easily on FreeBSD.

    I run most of the rest of my services in jails on that host, jails are what linux’s entire container subsystem is based on, having been around for 26 years now. Yes, FreeBSD’s jail system was introduced in 2000.

    I have a raspi 5 running rasbian, with Adguard Home, and audiomuse-ai on it.

    And a Lenovo M700 Tiny running Home Assistant.

    Tying it all together is a managed brocade/ruckus switch in layer 3 routing mode, handling all routing, VLANs, subnets, etc…

    I had a Linux box with two 10Mbps NICs in it in the mid to early 2000s doing NAT so I could share the cable modem connection to my wife’s computer back when you were only allowed to have a single machine connected to the Internet at home.

    I say all that to lay out my experience level.

    With all that said, you can virtualize your primary router if you like. Personally, I’d rather that system critical piece of equipment be fully isolated from any possible virtualization shenanigans.

    Not to mention what happens when you fiddle with your Proxmox setup too much and oops, you have no Internet now.

    What happens when your main network goes down, and the only way you can access that Proxmox machine is over that network?