Virtualizing OPNsense on Proxmox as Your Primary Router

Are you curious how to set up OPNsense on Proxmox as your primary router? In this video, I show one way you could go about doing it using the Protectli VP6650, but you may adapt this guide to the hardware you wish to use.

This guide assumes you have an existing network and that you are planning to migrate to a virtualized instance of OPNsense. The guide also does not do a full network configuration in OPNsense in an effort to keep the video shorter. Once you have OPNsense up and running, you can use other guides I have created to configure OPNsense for your network.

The focus of this video is getting Proxmox configured properly, creating the OPNsense virtual machine, and showing how to physically connect everything to your network. You must be careful to not conflict with your existing network once you have the OPNsense VM set up (conflicting IP addresses, multiple DHCP services running on the same network, etc).

I recommend disconnecting the Proxmox server from your network or connecting it to a dedicated VLAN with different IPs to avoid issues with your existing network if you wish to do more testing before swapping out hardware.

For a written version of this guide, please visit:

Hardware used in the demonstration (affiliate links):

Chapters:
01:32 Physical connections
05:36 Configure Proxmox server
20:54 Create OPNsense VM
35:54 Demostration of assigning VMs/CTs to VLANs

EP42

[ivanfig]

Finally, a video that shows what the REAL WORLD looks like, and takes it from step ZERO. Well done

[jojokispotta]

Thank you for showing the physical real world implementation. As a beginner, I've always struggled with this and this is the only video that shows from "zero to one to 100"

[spoonman]

Using OPNsense for years, I never knew you could delete the interface which holds the vlans. Nice video. 👍🏼

[peterruzevich]

Fantastic video. I learned a ton watching and following along. Thank you so much. I appreciated you walking through each option and briefly discussing why or why not you had chosen said option. Cheers!

[lgic]

Excited to watch in full, now, for learning and entertainment.... Already saved to watch again as a guide

[TheCreat]

Great detailed overview for anyone starting out.
Just some comments on the options when setting up VMs in Proxmox:
If you're on using thin provisioned storage, you always want "Discard" checked. It's what makes the guest OS emit TRIM commands necessary to actually free space on the host that was free'd in the VM. SSD emulation just tells the guest that it's flash storage, it doesn't enable TRIM. I have no idea why this isn't a default setting.
For anyone setting up a single host, so not a Proxmox cluster: Just always use "host" as the CPU type for a measurable performance gain. All features and abilities are passed through accordingly, and there is no need to enable or disable instruction sets like AES, and there won't happen any translation either. This setting does imply that a VM can't be live-migrated using HA on a cluster, which means the VM is switched from one Proxmox host to another WHILE RUNNING. This is an incredibly rare requirement for a home lab. Even when "host" is selected, it's perfectly fine to shut down a VM, transfer it to another host, then start it again: the "host" CPU will just change meaning during the transfer to represent the other hosts CPU, no problem.

Finally, when virtualizing a firewall, it is highly recommended to pass through the actual PCIe hardware directly so it has direct access to the hardware. Yes, this does make a difference. No, it's probably not critical in a home lab, but if you're using 10g you probably want to use that. If it matters, or how much, when using 1g networking depends on the hardware (both system/platform and network). The only exception for me would be when using RealTek network cards. Anything based on BSD (pfSense, OPNsense) has bad enough compatibility that having Proxmox (Linux) handle it and use a bridge like you have shown.

[TheBitHero]

Perfect timing on this. This is exactly how I plan to setup the mini PC that is out for delivery right now. :)

[cameroncrossley]

Fantastic that you release this video literally the day i get everything together to do exactly this myself, you also helped me with the PCI pass through that nobody else talks about. Thankyou!

[userou-igze]

Just when I needed the video, no excellent info available on Youtube IMHO, this _is_ _great_

[linuxpirate]

This is the video that gave me the reassurance to switch my own home network over from firewalla to a virtualized OPNsense instance this past weekend. It genuinely surprised me that it was a clean cutover with all of my vlans/APs, Thank you!

OPNsense has 4 Performance cores of a 14700T, 32GBs of ram and a bridged Intel X550 T2 dedicated.

[markstanchin]

Hello just found your channel and really enjoying your videos. You teach advanced networking with simplified understandings. Much appreciated!

[ddorbuck]

thanks for all the opnsense and proxmox content. As a opnsense / Truenas scale home user and a vmware enterprise user @ work i enjoy all this content. Proxmox and ncp-ng are in our work test labs for possible move to from vmware. Thank you again!

[anirbanbhattacharya]

Brilliant work. I'm building my own home network and your guides are excellent.

[kazhmyr]

I lust got my PVE/ OPNSense machine running and in my rack a couple days ago, and I just found this today! I also used your Pi Hole PVE guide and set that as my DSN server. I used an 8th gen Dell OptiPlex with a dual 2.5gb card, and am thinking of setting up a second machine for a HA cluster.

[ppyc]

This video shows step by step installation Proxmox to OPnsense.
Thanks

[ZWortek]

This is an awesome video. I am trying to learn about this stuff so I can do it in a few months after a move.

[Smoothy]

well done, many thanks for this great video. Will help me a lot on the way to my first home-lab :)

[NoiseEverywhere]

Thanks for the content. Playing with some similar setup on mini pc's right now.

[aimebob]

OMG right in time ... Thank you a lot :)

[heselmas]

I use this on my server in the datacenter. Works perfect!