I am in the process of setting up a virtualized OPNsense firewall on Proxmox on a Thinkcentre 720q. The proxmox host has 3 network interfaces.

  • A dual NIC gigabit card where one interface is for WAN and other for LAN, say eth1 and eth2
  • Another interface which came with the PC itself, say eth3

PS: I also have a switch for all my other devices.

After some research, I have understood that

  1. Passing (pass-through) the NIC to the OPNsense VM is better for performance
  2. Passing it through removes the interface from the host OS
  3. If passing is not done correctly, you may lose access to Proxmox.

My questions are

  1. How do I set eth2 to be the LAN port and also use it connect to proxmox?
  2. If I use point #1 (eth2 for LAN), how much will the throughput of eth2 be affected? (My ISP provides me symmetrical 320 Mbps link speed)
  3. If I use point #1, will local traffic (traffic handled by my switch) be affected?
  4. (Optional/Experimental) Since I have a spare port (eth3), can I use it for special purpose (a dedicated management port which will work even if OPNsense is down)?
  5. If I use point #4, my switch will have two ethernet connections from the proxmox host. Will this cause loops and kill my network?

You can answer this selectively by mentioning the question number.

If you have a better idea regarding how to setup OPNsense on Proxmox, please share.

  • xavier666@lemmy.umucat.dayOPEnglish
    0·
    28 days ago

    I have one more doubt.

    (Nothing setup as of now, just checking all possible angles)

    Since, as per your suggestion, I have passed the NIC to OPNsense, so Proxmox won’t see the dual NIC card. The onboard ethernet port eth3 is connected to a switch and Proxmox will use eth3.

    Here’s a fresh diagram

    You can see that I have a Ubuntu VM. How will the PC communicate with the VM? (Links E and D are hypothetical. I don’t know which one is better given my scenario). Will it be C -> B -> D or C -> A -> E?

    Case #1: C -> B -> D

    The switch must differentiate between uplink traffic/proxmox traffic/other physical devices connected to the switch (phone/TV). I prefer this solution because even if OPNsense is down, I can still access the Ubuntu server. But the switch must handle this complexity. I will be getting a managed switch anyway.

    Case #2: C -> A -> E

    The interface eth2, which OPNsense is using, must have some sort of routing table which redirects to links E or F depending upon destination IP (Probably implemented using virtual bridge or virtual switch). This is simpler for the switch but if OPNsense is down, i lose direct network access to the VM. I can probably access it via Proxmox web-interface.

    Can you tell me which one is preferred or which one you would have done?

    Sorry for my ramblings.