Pfsense in a VM on ProxMox with single WAN DHCP IP

royehill

New Member
Mar 20, 2025
3
0
1
Hi All,
I'm very new to this so please don't beat me up too badly. I currently running pfsense in a VM on Proxmox sitting on a mini PC firewall appliance. I have made it far enough to have pfsense routing between my nighthawk router (192.168.x.0/24) and a private network space (172.16.xx.0/24) on a wired managed switch connected to the second physical interface on the appliance.

My next step is pretty much into the unknown. I want to replace my Nighthawk router and DHCP functionality with the appliance and run my Nighthawk in AP mode on a private LAN (either the existing one or I can create another subnet since the appliance has 4 physical ports.).

The two roadblock in the way for me are:
1. how to share a single IP on the WAN side with both proxmox and pfsense and still be able to get to the ProxMox web configurator. I "think" I need to create another bridge on vrmb0 which is the WAN port.
2. Eventually try to get VPN tunneling working on the pfsense with DHCP. I've read a bit about this and dynamic DNS is a topic that comes up.

I have attached some screenshots and a rudimentary drawing of my network that hopefully helps to make sense of it. I don't know how to set this up so both the proxmox IP and the pfsense IP are accessible on the private 172.16.xx.0/24 subnet while still connecting properly to the WAN .
 

Attachments

  • Untitled.jpg
    Untitled.jpg
    31.7 KB · Views: 6
  • pfsense firewall net.jpg
    pfsense firewall net.jpg
    18 KB · Views: 5
  • Proxmox network.jpg
    Proxmox network.jpg
    54 KB · Views: 5
You can't share a single IP...impossible. But you can share a NIC by making virtual network interfaces. Here's how I do it on my Proxmox boxes (this is my /etc/network/interfaces file. I am not sure how to do this via gui to be honest, I just edit this file)

auto lo
iface lo inet loopback

iface enp1s0f1 inet manual

auto vmbr0
iface vmbr0 inet static
bridge-ports enp1s0f1
bridge-stp off
bridge-fd 0
bridge-vlan-aware yes
bridge-vids 2-4092

auto vmbr0.1
iface vmbr0.1 inet static
address 192.168.1.2/24
gateway 192.168.1.1
You could in theory have as many virtual interfaces as you want on a NIC. This example also assumes you are using VLANs, and makes your bridge VLAN aware. To do this you need to be connected to a trunked port on your managed switch.