[SOLVED] OpnSense 23.7 - Virtualized as Gateway

[minimos]

Hi,

I have a physical host spun up with Proxmox 8.0.4 and running with a guest VM containing OpnSense.

At the moment I am in testing mode so things are being setup on an existing network with separate router. Eventually I will retire the old router and replace it with my standalone box run so that this becomes the router.

I have 3 linuxbridges passed to the guest VM at present vmbr0 with a physical port attached which is acting as WAN (pulling DHCP from existing router in a 10.0.0.x subnet), vmvr1 acting as a LAN with a subnet of 192.168.1.x. vmbr3 is passed to OpnSense so that a different subnet can be setup for a management network in the future, and I would like this to act as a gateway into OpnSense so the proxmox host can have access to the internet though its own guest VM.

I have fully connectivity from a virtual machine spun up on Proxmox on the lan side, and OpnSense can update itself from inside the VM.

However, I can't work out how to get vmbr3 working but here is what I have done.
1. Configured an interface in OpnSense for vmbr3.
2. Assigned a static ip in the address range 192.170.1.x and enabled it
3. Added a firewall rule of any on the bridge interface inside OpnSense to take all traffic during testing
4. Added the OpnSense interface address to the vmbr5 gateway setting.

Unfortunately any traceroute from the Proxmox host to 8.8.8.8 is blocked, I can't look up DNS on the gateway (but can get DNS if suffixing the address of my current LAN in the 10.0.0.x range which I'd expect as it is in the same subnet)

I've tried assigning the interface in OpnSense into the same subnet as my current LAN as well as using the 192.170 above.

What am I missing from this setup that will allow Proxmox to use the VM as the gateway?

 

[minimos]

Hi,

I have managed to resolve the issue and I am writing back should someone else come looking with a similar issue

In the example above I assigned the Linux Bridge vmbr3 with an IP in my current 10.0.0.X scope, and setup the interface on a 192.170.1.x scope.

Add the ip you assigned in OpnSense to the interface in the gateway of vmbr3. If like me you will find it does not work even after applying the configuration, a reboot is then required. I

On the OpnSense side of things you need a firewall rule on the new interface to acccept the traffic you want (any is probably best for testing but you will want to lock down later)

For DNS to resolve, you have to setup a NAT Port Forward rule from the ProxMox interface you setup and redirect it to your OpnSense management IP. You can then update the DNS setting in proxmox to resolve DNS names.