Problems with VLANs on (OPNsense) VM: I need a sanity check


New Member
Nov 9, 2023

I am not sure if the problem lies with configuration in proxmox, or in the OPNsense configuration. I started on this forum because I have a feeling it has to do with virtualization, but mainly because I am not as familiar with it.

The Goal & current configuration

An OPNsense setup on a Proxmox VM with VLANs to a physical switch.
I visualized the setup and switch configuration i use to test VLANs with this image:
promox OPNsense.png

Interface assignments


The firewall on each VLAN interface has an allow any rule. DHCP servers are enabled.

What I understand to be true

1. VLAN aware means that the bridge given to the VM is able to be split into VLANs by the VM. This must be checked on at least the interface used for the Trunk port.
2. The Router Interface with the VLANs must be connected to a Trunk port on the physical switch with the native vlan (PVID?) set to an unused VLAN.

The issue

The VLANs are not functioning as I would expect. The configuration leaves everything unreachable (ping: destination host unreachable).
I feel like I need a sanity check. To my knowledge, the VLAN configuration on the Switch shown in the image should work as intended.
I can only think I am misunderstanding the workings of the Virtualization.

I have heard there is another way of making VLANs, where you would make them on ProxMox and then pass them to the VM so you could configure them as separate interfaces on the VM rather than VLANs. I do not think I prefer this method, I would want VLANs to stay inside the VM for both potential configuration migration to physical systems and the growing amount of VLANs.

Bonus question/issue

I did not make the bridge i use for WAN VLAN aware, but I did successfully create a VLAN on the WAN interface, attached it to a PPPoE network type and get connection from my ISP. Is VLAN aware not required if you only make 1 VLAN?
I do notice the speed is not optimal. I have fiber gigabit, but max speedtest was ~400mbit/s up and down. it's probably a separate issue.
Temporary solution

I temporarily gave up on this VLAN aware setup and decided to make the VLANs on proxmox itself.
With the same setup on the Switch, it successfully reaches the network on the VLANs. Which increases the chance of it being a proxmox configuration error/oversight on my side.

I still hope someone can point out the error/oversight I made, since I prefer a VLAN aware setup for reasons mentioned in the initial post.
A tagged port means that the device connected to this port must „speak“ the VLAN ID. So you can

a) add multiple vNICs from vmbr1 - each tagged with the desired VLAN ID - to the OPNSense and use them as „normal“ interfaces. PVE will tag the VLAN ID on each vNIC


b) like you did it now: create VLAN interfaces from your existing LAN interface with only one vNIC

Another approach would be to create bridges with VLAN IDs , for example vmbr1.10 , vmbr1.20 , etc. and add vNICs from there.
Last edited:


The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!