Selfhosted

I'd been running OPNsense in a VM for some time. I used xen as a hypervisor, but that shouldn't really be a requirement. Passed the nics through and it was golden! All the benefits of a VM - quick boot-up, snapshots on the hypervisor - it's truly glorious :)

Yes, this is totally possible and I did it for a couple of years with OPNsense. I actually had an OPNsense box and a pfSense box both on Hyper-V. I could toggle between them easily and it worked well. There are CPU considerations which depend on your traffic load. Security is not an issue as long as you have the network interface assignments correct and have not accidentally attached the WAN interface to any other guest VM's.

Unfortunately, when I upgraded to 1Gb/s (now 2Gb/s) on the WAN, the VM could not keep up. No amount of tuning in the Hyper-V host (dual Xeon 3GHz) or the VM could resolve the poor throughput. I assume it came down to the 10Gb NICs and their drivers, or the Hyper-V virtual switch subsystem. Depending on what hardware offload and other tuning settings I tried, I would get perfect throughput one way, but terrible performance in the other direction, or some compromise in between on either side. There was a lot of iperf3 testing involved. I don't blame OPNsense/pfSense -- these issues impacted any 10Gb links attached to VM's.

Ultimately, I eliminated the virtual router and ended up where you are, with a baremetal pfSense on a much less powerful device (Intel Atom-based). I'm still not happy with it -- getting a full 2Gb/s up and down is hard.

Aside from performance, one of the other reasons for moving the firewall back to a dedicated unit was that I wanted to isolate it from any issues that might impact the host. The firewall is such a core component of my network, and I didn't like it going offline when I needed to reboot the server.

I run it in a Proxmox VM, and since I have 3 nodes with the same hardware (2 NICS) I configure the networking identical for all three, and have used HA for OPNsense. It's triggered a couple times in fact, and the only way I know is that I get a notification that it's jumped nodes, because I couldn't tell just sitting there and streaming while it happened.

Big fan of virtualizing it, can take snapshots before upgrading and online backups are seamless. I've restored a backup when I had it act a bit weird after an upgrade. I restored the previous backup in an inactive state, then cut them over pretty much live as I started up the restored VM and downed the borked one.

Edit: I wouldn't use passthrough if you're running a multinode setup like this. Just configure network bridges with the same name and giv'er.

So you're planning to reuse the same hardware that the firewall is running on now, by installing a hypervisor and then only running opnsense in that?

Am I assuming correctly that if I bind the VM to hardware network interfaces for WAN and LAN respectively it should behave and be similarly secure to a bare metal firewall?

Correct.

I did that in my old playground VMware stack. I'll leave you with my cautionary tale (though depending on the complexity of your network, it may not fully apply).

My pfSense (OPNsense didn't exist yet) firewall was a VM on my ESX server. I also had it managing all of my VLANs and firewall rules and everything was connected to distributed vSwitches in vmware.. Everything worked great until I lost power longer than my UPS could hold on and had to shut down.

Shutdown was fine, but the cold start left me in a chicken/egg situation. vSphere couldn't connect to the hypervisors because the firewall wasn't routing to them. I could log into the ESX host directly to start the pfSense VM, but since vSphere wasn't running, the distributed switches weren't up.

The moral is: If you virtualize your core firewall, make sure none of the virtualization layers depend on it. 😆

Try VyOS. I run it on APU2 myself. No GUI no convolution.

I followed some guide to put Opnsense on Proxmox. I pass through 2 NICs and set the KVM (using the Proxmox make-a-VM GUI) to be the CPU arch it runs on for that extra speed (but that setting precludes easy transfer to a new box with a different arch). Plenty fast and I run another Linux VM on the same box that does stuff I’d want Opnsense to do (DNS, VPN, etc.).

If I did it again I’d prob do LXD (Incus now), Proxmox has a long startup time and is fiddly to use (to me at least). Looks like Incus can do the same KVM thing, just with less steps and stock Debian.

I can't remember all the details, but depending on the CPU you are running you may need some extra configuration on opnsense.

There were a few issues, on my servers, running on older Intel Xeon CPUs, but I eventually fixed them adding proper flags to deal with different bugs.

Other than that, running on a VM is really handy.

If you have a managed switch you can also just do vlan tags for your wan and not have to pass any nics to the VM.

I use a Proxmox Cluster and assigned dedicated NICs to my OPNsense VMs (also clustered). I connected the NIC ports I assigned to the OPNsense VMs directly with a cable and reserved it for CARP usage. I can easily download with 1GB/s and the VMs switch without any packet loss during failover, 10/10 would do it again.

Well I cant say specifically to your setup. But I have an old server that I use as a hypervisor running Proxmox. On it I have an OPNsense VM Ive been running for years now. I dont do any crazy pass thru stuff. I just added each NIC as a normal network device bridged to the specific hardware port. I also use it as a Reverse Proxy for all my internal service such as Emby.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

4 acronyms in this thread; the most compressed thread commented on today has 9 acronyms.

[Thread #638 for this sub, first seen 28th Mar 2024, 20:45] [FAQ] [Full list] [Contact] [Source code]