The two approaches serve different purposes.
OPNsense HA (CARP/pfsync) is designed for high availability. Two firewalls operate as a coordinated pair, synchronizing supported configuration settings and connection states, and allowing automatic failover with minimal interruption.
My solution is a
cold spare, intended primarily as insurance against hardware failure of the physical firewall.
Advantages over HA:
- No additional dedicated firewall hardware is required if you already have a Proxmox host.
- No CARP, pfsync, virtual IP addresses, dedicated synchronization interfaces, or special HA network setup.
- The physical OPNsense installation remains unchanged.
- The spare normally runs as an ordinary LAN client with its own IP and MAC addresses, so it can be maintained and updated independently.
- The solution is largely independent of the network topology, provided the VM can access the same networks as the physical firewall when needed.
Disadvantages compared to HA:
- Failover is manual, not automatic.
- There is an interruption while the VM takes over. In my first real-world test, connectivity was restored within minutes.
- Connection states are not synchronized, so existing sessions are lost.
- The emergency configuration is only as current as the last imported backup.
- The Proxmox host must be operational when the spare is needed.
Why not simply use HA with a virtual backup firewall?
That is certainly possible. You can run OPNsense HA with a physical primary and a virtual secondary on Proxmox, so HA doesn't necessarily require a second physical firewall appliance either.
However, this introduces additional complexity and some practical limitations:
- The existing physical firewall must be reconfigured for HA, including CARP addresses, configuration synchronization, and state synchronization.
- Mixed physical and virtual network interfaces can complicate state synchronization.
- PPPoE WAN connections are particularly problematic. The secondary cannot simply inherit an established PPPoE session, and reconnecting may introduce delays or complications, especially with IPv6 prefix delegation.
- Both systems must be maintained as members of a coordinated HA configuration.
In my case, the WAN connection uses PPPoE, making conventional HA even less attractive.
The main idea
I don't need high availability for my home network. I can tolerate a few minutes of downtime after a hardware failure. What I don't want is to discover that I have to buy, install, configure, and update another physical firewall before getting my network back online.
With this approach, I can keep the virtual spare updated and ready without maintaining a second production firewall or an HA cluster.
If near-zero downtime and automatic failover are requirements, a proper HA setup is the better choice, provided the network and WAN connection support it reliably.
