How to organise WAN access for RPi with proxmox so it can run of mobile hotspot?

[niall.keller]

Assume the following current state:
* 8GB RPi with proxmox
* a physical router is used to control network access (allowing access only to a whitelisted hosts, VPN killswitch, adblocking, DoT to upstream resolver, etc)
* RPi hosts lightweight LXCs from Community scripts (webdav-like for contacts/calendars, git, etc) without WAN access, LAN-only.
* RPi hosts wireguard server to provide access only to LAN clients (a requirement that came from limitations of connecting clients)
(*) a semi-technical user to maintain it, who has limited experience with home-grade networking equipment like mikrotik (older versions) and openwrt, but no opnsense/pfsense, ubiquity etc. Not afraid of CLI in general, but prefer GUI.

Intention: make the RPi self-sufficient for WAN access and traffic control so it can be run by connecting to a mobile or hotel hotspot wired or wireless.

What would be the best and most lightweight way to implement it so more juice is left for LXCs and VMs running on RPi?

Ideally, I would prefer to have flexibility to run couple of "virtual routers" per group of usage patterns, so some LXC can access internet via Tor, others - via VPN, etc. RPi host itself must also access network via one of them.

I know there is a number of networking-related community scripts for VM like MikroTik RouterOS, Unifi OS server or OpenWRT, and even guides for LXC OpenWRT https://forum.proxmox.com/threads/h...rsion-of-openwrt-and-run-it-on-proxmox.64786/. But I understand there may be more ways to implement it, also more lightweight.

Let's put aside question how to get RPi connected via WiFi or how to get clients connected via LAN to RPi's without controlled wifi router.
Portable router is an option, but less preferred.

 

[Bob.Dig]

Is there anyone here who uses OpenWRT container (or other methods) to route all the WAN traffic, instead of relying on external router (for VPN, etc)?

I use an OpenWRT LXC for routing, VPN, etc.. but only on a VPS, which doesn't allow having another performant VM besides PVE. OpenWRT is not that easy to configure, but it is doable.
There is the risk though, that PVE doesn't run this type of LXC one day, it had happened before. So it is not for everyone. And my experience is only from x86.

 

[a3a]

I have set this up using an OpenWRT 25.12.5 (latest currently) VM on an x86 laptop. It "just worked" using a USB Ethernet for the WAN side.

I have done both a dedicated pass-through to the VM as well as making a bridge on the Proxmox side and then attaching a virtio nic to the OpenWRT VM. The most difficult part is needing to do everything via command line or setting up the right amount of ssh proxies and/or bridging on the proxmox side to get a browser to connect to the OpenWRT "lan" side.

I only spent 2-3 hours but I could not get the Wifi Client working correct inside the OpenWRT VM. It's not possible (at least not easily) to bridge the WiFi adapter, it must be shared into OpenWRT and then supplicated and routed. I could never get OpenWRT to initialize the wifi card. The kernel can see it, but it doesn't work. I did not try with an LXC due to earlier problem I had with OpenWRT LXC. But I may give that a try again this winter.

In the meantime I gave up on Proxmox on that Dell XPS 15 and installed OpenSUSE Tumbleweed, which works great.