Virtual pfSense - Discussing the Options & Why

Here are my reasons for virtualising pfSense and some pitfalls to avoid.

00:00 - Benefits of Virtualising
03:33 - Setup & Configuration Options
10:06 - High Availability

[domikenobi]

Nice channel with good content - keep it up!

[le_travie]

I just found these videos as I am looking to expand my basic homelad that I have for hobby purposes. Loving the content and the 40k references in your proxmox set up XD

[happy]

We all love details explanation, Well Done Jim!

[andresvanvliet]

I have passed through a two port nic to my virtulized PFSense vm. That gives me enough feeling of a physical separation to keep me happy and still able to consolidate some hardware.

[johndroyson]

This video motivated me to actually document and label my NIC port locations.

[praetorxyn]

One of the reasons I got the MS-01 was with virtualizing Opnsense in mind, but really, I haven't tried it, as I didn't want my whole network to go down if I needed to update Proxmox or work on the hardware or something. I feel like virtualizing it only makes sense if you have a Proxmox cluster with HA so one of the other nodes can take over in that instance.

[bgorowski]

If you encounter errors during the initial boot ("BdsDxe: failed to load Boot0003 "UEFI PXEv4" from PciRoot" and similar) please uncheck "Pre-Enroll Keys" field in EFI disk creation box.

[PoeLemic]

Very helpful. I so want to do stuff like you've got set up. Maybe, over the Holidays, I'll have time to stop Life and have some "me time" to be able to play with this & get everything going.
> Yes, do cover the features of PfSense ... 16:00 ... because I think that would help a lot of people that are just waking up to realizing that they don't have to use Xfinity's hardware anymore.

[mistakek]

I started out virtualising it, and I still have a pfsense VM as a backup, but I just prefer to have it on bare metal now. Just less headaches, but it's completely a viable option if you want to make the most out of your hardware and are comfortable with the internet going down upon a reboot (without HA), or you just want to tinker.
EDIT: Ohh and snapshots can make your life less miserable with pfsense CE if you mess up. pfsense Plus has boot environments to revert back to.

[Nirmal-us]

Plz can you tell me, how can I access pfsense web GUI from windows machine which is in (VTNET1) on proxmox?

[strandvaskeren]

I've done pfsense virtualized for a couple of years, on bare metal for a couple of years and now I'm back virtualizing pfsense. As long as it runs both options are fine, but about a year ago a pfsense update killed my bare metal installation as the boot partition wasn't big enough for the update. For some reason the pfsence update function didn't bother to check if the boot partition was big enough for the update, so it crashed during update and left me with a miserable afternoon of trying to fix the install without internet access. So now I'm back to running pfsence virtualized so I can snapshot and roll back if an update breaks pfsense.

I really struggle to see the benefit of running pfsense on bare metal unless you have very minimal hardware. Even a thin client system like the Dell Wyse 5070 is plenty strong enough to run pfsense as a vm under proxmox, so why not get the benefit of doing backups of the pfsense vm, snapshots before updates, the ability to move the vm to another server while updating hardware and all that?

[repairmanbe]

Thanks for the video. I see you have Firewall=1 on the 2 network devices, is that required? My pfsense vm always stops at startup with some errors and the last line says masks and some hex code. I can stop the vm and then do a restore from my PBS and voila it boots all the way. Edit: Added a Serial Port in Hardware and checked that EFI - Attempt Secure Boot is unchecked.

[SY]

Is there a reason you aren't using SR-IOV with your intel x710?

[kitsunesuzuka]

Still having a dilemma regarding nics. Intel 2.5GB being buggy, 10GB being expensive for my use case. Is there any advice regarding 2.5GB? Thanks in advance! My current firewall setup is with the use of vlans with single gigabit nic with help of opnsense vids from jim

[Colebrath]

I'm running all my VMs on i440fx mostly SeaBIOS, passthrough two NICs on OPNsense VM and passthrough a Zigbee Dongle on Homeassistant VM without any problems. 🧐

[casperghst]

You do not need q35 for pfSense, it function just fine with the default. Also you cannot say that vmbr0 is vnet0 or vnet1 until you actually have looked it at - which is probably the most annoying part of the pfSense installation (I do not know opnsense).

[johnafterdeath]

How can I do this with two nics but I still want to access the node?

[espressomatic]

Moving my bare-metal install to VM this week, very coincidental. Mainly because as an edge device, the FreeBSD base system is problematic and difficult to maintain. Running VM it's easier to add other edge processes/features without mucking up pfSense. Small host with 2x 10G and 4x 2.5G NICs

But there's no way I'm doing it with ProxMox which is a horrible platform and UI for KVM. pfSense easy enough, but LXCs are especially where it falls down.

[brachisaurous]

i run virtual pfSense on a single node. im crazy that way....

[jacobnoori]

The timing of this video is unreal - I am debating this myself at this very moment. People who virtualize your firewall, are you running a physical firewall before your whole home network? Additionally, are you exposing any services to the internet?