Proxmox as a router?

[plato79]

I have a N5105 motherboard with 4x2,5GbE.

Now, I do have a PVE setup on a Xeon machine. I want to configure this as a mini/backup NAS with the router capability.

So, the question is how do I use the additional ports on this motherboard for accessing the network? I don't want a very complex setup ( with VLANs etc.. ). It should only give access to the network it's connected to.

 

[Dunuin]

I would recommend a OPNsense VM. Then create 4 bridges, one bridge for each physical NIC and create 4 virtual virtio NICs for the OPNsense and attach one virtual NIC to each bridge.

 

[plato79]

Ok, now I'm confused. This MB has 4 ports only. I'm not sure I could give all 4 ports on MB to OPNsense. Though from what I understand you want me to create bridges on PVE side, and share all 4 of these with OPNsense right?

Also AFAIK the better solution is to give PCI devices of NICs directly to VM right?... or wrong?

 

[Dunuin]

Ok, now I'm confused. This MB has 4 ports only. I'm not sure I could give all 4 ports on MB to OPNsense.

Yes. Your not passing through NICs. It just allows the VM to also use those NICs. Without a bridge a VM/LXC can't be attached to that NICs network. Think of a bridge like a virtual switch.

Though from what I understand you want me to create bridges on PVE side, and share all 4 of these with OPNsense right?

Correct.

Also AFAIK the better solution is to give PCI devices of NICs directly to VM right?... or wrong?

Thats also possible but then the PVE host won't be able to use those NICs any longer and it might not work at all, depending on how your mainboard is organizing its IOMMU groups.
As you need at least one NIC for PVE, the VM then only could use 3 passthroughed NICs.

Performance-wise there shouldn't be a benefit passing through the NICs in case they are just Gbit NICs. But could be beneficial when using 10+ Gbit NICs.

 

[plato79]

Thats also possible but then the PVE host won't be able to use those NICs any longer and it might not work at all, depending on how your mainboard is organizing its IOMMU groups.
As you need at least one NIC for PVE, the VM then only could use 3 passthroughed NICs.

Performance-wise there shouldn't be a benefit passing through the NICs in case they are just Gbit NICs. But could be beneficial when using 10+ Gbit NICs.

I thought I could share the first port ( where PVE gets its' IP ) with VM and give direct access to other 3 ports. These are "2.5 GbE" ports though I'm not sure of the performance yet. I'm still in build phase and making experiments with it. Though I'm sure every NIC has its' own PCIe interface and I can give all of them to VM without any problem.

PVE itself wouldn't need more than one port. If I could integrate router part directly on proxmox I wouldn't bother with OPNsense at all. Though I'm not sure I'm ready to configure forwarding, routing part of the NICs.

I did install docker directly on Proxmox on my primary server ( I know all the security conundrums but I don't have really important data there ) so if at all possible I don't want to manage an additional VM for the NICs.

 

[plato79]

Though what I want is to use those other ports to connect other PCs ( ex. primary server, my main PC, my daughter's PC etc.. ). The devices should access to internet/LAN through these connections. That means proxmox should manage the connection to the internet. While OPNsense is for that purpose, I want it to keep as simple as possible.