Running OPNsense as a Virtual Firewall on Proxmox Dedicated Server

A common use case for OVH dedicated servers is running multiple virtual machines while keeping the environment securely separated behind a firewall.

Proxmox VE is an excellent hypervisor for this, but when you want proper network segmentation, DHCP, NAT, VPN access, and firewall rules, running a dedicated firewall appliance such as OPNsense inside Proxmox makes a lot of sense.

This guide explains how to build the following setup:

OVH dedicated server
Proxmox VE as the hypervisor
OPNsense running as a virtual machine
OVH additional/failover IP assigned to OPNsense WAN
Private LAN network for virtual machines
NAT and DHCP handled by OPNsense
Proxmox host remaining accessible for management

One important OVH-specific issue is covered at the end: the “Far Gateway” problem that prevents OPNsense from reaching the OVH gateway when using routed failover IPs.

Network Design Overview

The final topology will look like this:

                    Internet
                       |
                  OVH Network
                       |
              OVH Dedicated Server
                       |
        +------------------------------+
        |          Proxmox VE          |
        |                              |
        | Primary IP: a.a.a.222        |
        | vmbr0 → eno1                 |
        |                              |
        |                              |
        |       OPNsense VM            |
        |                              |
        | WAN: b.b.b.59                |
        | LAN: 10.0.0.1                |
        |                              |
        +-------------+----------------+
                      |
                    vmbr1
                      |
              Internal VM Network

              VM1 10.0.0.x
              VM2 10.0.0.x
              VM3 10.0.0.x

The idea:

OVH’s original IP stays on the Proxmox host.
The additional OVH IP is assigned directly to the OPNsense WAN interface.
OPNsense becomes the router/firewall for internal VMs.
Internal machines never directly touch the OVH network.

OVH Network Requirements

You need:

Primary OVH IP

Example:

IP:
a.a.a.222

Gateway:
a.a.a.254

Subnet:
255.255.255.0 (/24)

This IP belongs to the physical Proxmox host.

Additional OVH IP

Example:

IP:
b.b.b.59

OVH will provide:

Additional/failover IP
Virtual MAC address

The virtual MAC is extremely important.

OVH uses it to identify which virtual machine should receive traffic for that IP.

Configure Proxmox Networking

The Proxmox host keeps the main OVH IP.

Example:

/etc/network/interfaces

auto lo
iface lo inet loopback


auto eno1
iface eno1 inet manual


auto vmbr0
iface vmbr0 inet static
    address a.a.a.222/24
    gateway a.a.a.254
    bridge-ports eno1
    bridge-stp off
    bridge-fd 0


auto vmbr1
iface vmbr1 inet manual
    bridge-ports none
    bridge-stp off
    bridge-fd 0

Explanation:

vmbr0

This is the external bridge.

vmbr0
 |
eno1
 |
OVH network

Used for:

Proxmox management
OPNsense WAN interface

vmbr1

This is an internal-only bridge.

No physical NIC is attached.

Used for:

Private VM traffic
OPNsense LAN interface

You can also configure this from:

Proxmox GUI
→ System
→ Network

Changes are written to:

/etc/network/interfaces

Important: Do Not Configure the Failover IP on Proxmox

The additional OVH IP:

b.b.b.59

should NOT be added to:

eno1
vmbr0
Proxmox host networking

It belongs inside the OPNsense VM.

The OVH virtual MAC will be attached to the OPNsense WAN NIC.

Create the OPNsense Virtual Machine

Download the OPNsense DVD ISO.

Upload it:

Proxmox
→ local storage
→ ISO Images
→ Upload

Create a new VM.

Example settings (which I used this time):

BIOS

SeaBIOS

CPU

2 cores

RAM

4096 MB

Disk

8GB

Machine

Default i440fx

Controller

SCSI
VirtIO SCSI single

Add Network Interfaces

The VM needs two network adapters.

WAN Interface

Attach to:

vmbr0

Change MAC address to the OVH virtual MAC.

Example:

AA:BB:CC:DD:EE:FF

This is the MAC OVH assigned to:

b.b.b.59

LAN Interface

Attach to:

vmbr1

Normal Proxmox-generated MAC is fine.

The final VM should have:

Net0
 |
vmbr0
 |
WAN
 |
b.b.b.59


Net1
 |
vmbr1
 |
LAN
 |
10.0.0.1

Install OPNsense

Boot the VM from the ISO.

Important:

At the prompt do not accidentally just run the live environment using root (user) and opnsense (password).

Instead you need to login as

installer (and opnsense for password)

Otherwise:

root/opnsense

live mode starts from the CD, and after reboot, all changes disappear.

For filesystem:

UFS

works fine.

ZFS is possible but usually unnecessary for a small firewall VM.

ZFS:

requires more RAM
provides benefits mostly with larger storage setups

Assign OPNsense Interfaces

During first boot:

Assign:

WAN → vmbr0 NIC

LAN → vmbr1 NIC

After installation:

Connect a VM to vmbr1 (I installed a Debian gui inside Proxmox temporarily) and access:

https://10.0.0.1

root

This is a good oppurtunity to reset the password if you didn’t already do so during the initial installation.

Lobby
→ Password

Once everything is completed it is good to come back around and add another user to handle standard day to day activities.

Configure the OPNsense WAN Interface

Go to:

Interfaces
→ WAN

Set:

IPv4 Configuration Type:

Static IPv4

Enter:

IPv4 Address:

b.b.b.59

Subnet:

/32

Example:

b.b.b.59/32

Why /32?

OVH failover IPs are routed addresses.

The IP itself does not belong to the same subnet as the gateway.

The server gateway:

a.a.a.254

is outside:

b.b.b.59/32

This is normal.

Configure the OVH Gateway

Go to:

System
→ Gateways
→ Single

Create a gateway.

Interface:

WAN

Gateway:

a.a.a.254

Enable:

Upstream Gateway

Most importantly:

Enable:

Far Gateway

The OVH + OPNsense “Far Gateway” Problem

This is the most common issue.

Everything looks correct:

VM networking works
Virtual MAC is correct
WAN IP is correct
Gateway is correct

But:

OPNsense cannot ping OVH gateway

Why?

Because OPNsense sees:

WAN IP:
b.b.b.59/32

Gateway:

a.a.a.254

The gateway is outside the subnet.

Normally routers expect the gateway to be directly reachable.

OVH’s routed setup works differently.

The Far Gateway option tells OPNsense:

“Yes, this gateway is outside this interface subnet. This is expected.”

After enabling:

Far Gateway

save and apply.

The WAN should immediately become functional.

Configure the LAN Network

Example:

LAN IP:

10.0.0.1/24

Go to:

Interfaces
→ LAN

Set:

IPv4:

10.0.0.1/24

Enable DHCP

Go to:

Services
→ DHCPv4
→ LAN

Enable DHCP.

Example range:

10.0.0.50
-
10.0.0.200

Now VMs connected to vmbr1 will automatically receive:

IP address
Gateway
DNS

from OPNsense.

Configure Firewall Rules

By default, LAN traffic may be blocked.

Create a rule:

Firewall
→ Rules
→ LAN

Add:

Action:
Pass

Direction:
Out

Protocol:
Any

Source:
LAN net

Destination:
WAN net

This allows:

LAN → Internet

To Check – Configure NAT

Go to:

Firewall
→ NAT
→ Outbound

Use:

Automatic outbound NAT

OPNsense will automatically translate:

10.0.0.x

into:

b.b.b.59

when accessing the internet.

To Check – Proxmox Firewall Considerations

Proxmox also has its own firewall.

For an OPNsense VM acting as the main firewall:

Usually disable Proxmox firewall on the OPNsense NICs.

VM settings:

Hardware
→ Network Device
→ Firewall

Disable

Why?

Because you now have:

Internet
    |
OPNsense firewall
    |
VM network

Adding another firewall layer can create unexpected blocking.

A Proxmox firewall rule could prevent OPNsense from reaching the OVH gateway.

Testing the Setup

Test Proxmox

SSH into Proxmox:

ping a.a.a.254

Then:

ping 8.8.8.8

Confirm the host works.

Test OPNsense WAN

In OPNsense:

Interfaces / Diagnostics
→ Ping

Test:

a.a.a.254

Then:

8.8.8.8

Test Internal VM

Within the test VM:

Network:

vmbr1

It should have already received:

10.0.0.x

Check:

ipconfig

or:

ip addr

Test:

ping 10.0.0.1

Then:

ping 8.8.8.8

Future Remote Access: WireGuard Backdoor

A good final design is:

Internet
 |
Proxmox public IP
 |
WireGuard
 |
Private management network
 |
OPNsense
 |
VMs

Keep the Proxmox IP:

a.a.a.222

for emergency access.

Later:

restrict web access
disable unnecessary exposed ports
use WireGuard VPN for administration

This provides a secure recovery path if OPNsense rules are accidentally misconfigured.

Final Notes

Running OPNsense inside Proxmox on OVH works very well, but there are a few OVH-specific details that are easy to miss:

Use OVH virtual MAC on the OPNsense WAN NIC
Keep the OVH primary IP on Proxmox
Use /32 for failover IPs
Use an internal bridge for your VM network
Disable Proxmox firewall on OPNsense interfaces initially
Enable Far Gateway in OPNsense

That last setting is the one that usually causes hours of troubleshooting:

OVH routed IP + OPNsense = Far Gateway required.

Once configured correctly, OPNsense becomes a full virtual edge firewall for your Proxmox environment.