OPNSense Passthrough Ethernet or WAN - Having disconnections

[andrema2]

Hi all

I set up a OPNSense VM in a NUC machine. It has only one ethernet, so I added an USB-C dongle with another ethernet. This USB-C is passed through to the OPNsense as the WAN port.

It looks ok, but I'm getting a lot of disconnections or at least the gateway is unable to ping 8.8.8.8 and all device at the network can't access anything on the internet.

At the OPNsense all hardware offloading is checked.

The LAN is set as virtio and is recognized as 10G (it's not, it's a phisycal 1G), the WAN is recognized as 1G as it should.

Is I stop the bypassing and leave it all as virtio NICs I don't have any problem, but I understand it is less secure because the WAN is then available for Proxmox.

I know I'm missing logs to help here. Where and how can I get these information ?

My VM is set processor is set as host and as follows:


Thanks for your help

 

[Stefan_R]

I set up a OPNSense VM in a NUC machine. It has only one ethernet, so I added an USB-C dongle with another ethernet. This USB-C is passed through to the OPNsense as the WAN port.

If you use USB-passthrough, it most likely won't work reliably, as all data must then go through user space which severely limits performance (personal experience: 24 bit stereo audio is already too much, even on a high-end machine, so gigabit ethernet is clearly a no-go).

You could try PCIe passthrough of a USB controller, or just leave it be with the virtio NIC, since at gigabit speeds it really shouldn't matter that much (only maybe a bit for latency, but with a USB-to-ethernet adapter that ship has sailed anyway).

The LAN is set as virtio and is recognized as 10G (it's not, it's a phisycal 1G), the WAN is recognized as 1G as it should.

virtio NIC always reports 10G, and it technically *is* a faster-than-gigabit interface, as long as you use it only to talk to the host (PVE). Network performance is always limited by the weakest link in the chain, and the virtio developers just wanted to make sure that their driver isn't it

Is I stop the bypassing and leave it all as virtio NICs I don't have any problem, but I understand it is less secure because the WAN is then available for Proxmox.

That threat-model makes little sense, a compromised hypervisor will always have access to all connected hardware...