Running OPNSense on Proxmox on a Protectli FW4B (without IOMMU)

CharlieCortial

New Member
Sep 20, 2023
4
0
1
France
Hello everyone,

NOTE: in my message below, I make assumptions and guesses based on my research, but it’s very possible it’s full of mistakes and misunderstandings on my part…o_O

To preface:
I am pretty new to OPNsense (although I had just a bit of experience with pfSense), and entirely new to Proxmox VE.
In the past, I used this FW4B from Protectli as a Firewall/Router by installing pfSense directly on it. Recently, I started to discover and understand the possibilities and benefits of using something like Proxmox. In the coming future, I intend to build a DIY machine to run Proxmox with a few VMs, for my Homelab. For now, I just want to learn and become more comfortable with it (Proxmox) with hardware I already have. Hence, the use of this FW4B, on which I intend to run maybe just one other VM, since it’s a small machine.

The goal:
I have a good quality fiber internet uplink, and I’d like to put the internet router in bridge mode, and use the Protectli FW4B as my router/firewall instead. The FW4B would run Proxmox with an OPNsense VM, and OPNsense would be the router/firewall. The hardware has 4 NICs. I’d like to use the first as WAN, where my uplink arrives. Of the 3 other NICs, one should be used for a TP-Link AP that will serve WiFi in the house, and the 2 others will be used for the LAN network (maybe 2 different networks, but that’s a secondary and not pressing concern).

The Problem:
It’s already hard enough to understand all the new concepts and systems/softwares, on top of which I add the fact that I can’t seem to find tutorials or explanations for my specific needs. I already installed Proxmox, created a VM for OPNsense, but I’m stuck at understanding how to configure the network properly in the network part of the Proxmox node, to suit my needs. The CPU of the FW4B (an Intel J3160), doesn’t support vt-d, so I can’t use IOMMU, which means I need to use Linux Bridges instead, to be able to configure the network of Proxmox, and ‘transfer’ it to the OPNsense VM, so that I can configure the Network there.

Another Note:
I know that this setup might have bottlenecks, and that this hardware is not ideal. It’s not meant to last, but I’d like to learn how it works, and I think it will help me understand my network needs better, and choose hardware accordingly when I build my next Proxmox machine.

Thank you in advance to anyone that takes the time to read this message, and for any advice or explanation on how I should proceed.
Best regards,
Charlie
 
There is a very good example of this kind of setup on the netgate site, although it's talking about pfSense rather than opnSense, the general principals are the same.

pfsense on proxmox guide

Setup proxmox and give it an IP in the range you have chosen for your home lan - e.g 172.19.1.101 and set the gateway address to whatever you intend to allocate to the opnSense VM - e.g 172.19.1.1. You will need a laptop or something connected to the same lan subnet (172.19.1.x) so you can configure proxmox via the gui and upload the opnSense ISO file.

Upload the ISO file, and create a new bridge (vmbr1) for one of the other NIC ports - this will be the WAN port, connect this to your router.

Create a VM with two NIC's, first one linked to vmbr0 for LAN and a second one linked to vmbr1 for WAN. Install opnSense and setup vtnet0 as LAN with the gateway IP (e.g 172.19.1.1) and vtnet1 as WAN (usually this will be set to DHCP)

At this point, your host and lan clients should be able to reach the internet via your new opnSense VM

Good luck, HTH
 
  • Like
Reactions: CharlieCortial
Hello @bobmc , thank you for taking the time to answer, for your help, and for all those details.
I'm going to try to configure everything and I'll report back here.
Cheers!
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!