A common use case for OVH dedicated servers is running multiple virtual machines while keeping the environment securely separated behind a firewall.
Proxmox VE is an excellent hypervisor for this, but when you want proper network segmentation, DHCP, NAT, VPN access, and firewall rules, running a dedicated firewall appliance such as OPNsense inside Proxmox makes a lot of sense.
This guide explains how to build the following setup:
- OVH dedicated server
- Proxmox VE as the hypervisor
- OPNsense running as a virtual machine
- OVH additional/failover IP assigned to OPNsense WAN
- Private LAN network for virtual machines
- NAT and DHCP handled by OPNsense
- Proxmox host remaining accessible for management
One important OVH-specific issue is covered at the end: the “Far Gateway” problem that prevents OPNsense from reaching the OVH gateway when using routed failover IPs.
Network Design Overview
The final topology will look like this:
Internet
|
OVH Network
|
OVH Dedicated Server
|
+------------------------------+
| Proxmox VE |
| |
| Primary IP: a.a.a.222 |
| vmbr0 → eno1 |
| |
| |
| OPNsense VM |
| |
| WAN: b.b.b.59 |
| LAN: 10.0.0.1 |
| |
+-------------+----------------+
|
vmbr1
|
Internal VM Network
VM1 10.0.0.x
VM2 10.0.0.x
VM3 10.0.0.x
The idea:
- OVH’s original IP stays on the Proxmox host.
- The additional OVH IP is assigned directly to the OPNsense WAN interface.
- OPNsense becomes the router/firewall for internal VMs.
- Internal machines never directly touch the OVH network.
OVH Network Requirements
You need:
Primary OVH IP
Example:
IP:
a.a.a.222
Gateway:
a.a.a.254
Subnet:
255.255.255.0 (/24)
This IP belongs to the physical Proxmox host.
Additional OVH IP
Example:
IP:
b.b.b.59
OVH will provide:
- Additional/failover IP
- Virtual MAC address
The virtual MAC is extremely important.
OVH uses it to identify which virtual machine should receive traffic for that IP.
Configure Proxmox Networking
The Proxmox host keeps the main OVH IP.
Example:
/etc/network/interfaces
auto lo
iface lo inet loopback
auto eno1
iface eno1 inet manual
auto vmbr0
iface vmbr0 inet static
address a.a.a.222/24
gateway a.a.a.254
bridge-ports eno1
bridge-stp off
bridge-fd 0
auto vmbr1
iface vmbr1 inet manual
bridge-ports none
bridge-stp off
bridge-fd 0
Explanation:
vmbr0
This is the external bridge.
vmbr0
|
eno1
|
OVH network
Used for:
- Proxmox management
- OPNsense WAN interface
vmbr1
This is an internal-only bridge.
No physical NIC is attached.
Used for:
- Private VM traffic
- OPNsense LAN interface
You can also configure this from:
Proxmox GUI
→ System
→ Network
Changes are written to:
/etc/network/interfaces
Important: Do Not Configure the Failover IP on Proxmox
The additional OVH IP:
b.b.b.59
should NOT be added to:
- eno1
- vmbr0
- Proxmox host networking
It belongs inside the OPNsense VM.
The OVH virtual MAC will be attached to the OPNsense WAN NIC.
Create the OPNsense Virtual Machine
Download the OPNsense DVD ISO.
Upload it:
Proxmox
→ local storage
→ ISO Images
→ Upload
Create a new VM.
Example settings (which I used this time):
BIOS
SeaBIOS
CPU
2 cores
RAM
4096 MB
Disk
8GB
Machine
Default i440fx
Controller
SCSI
VirtIO SCSI single
Add Network Interfaces
The VM needs two network adapters.
WAN Interface
Attach to:
vmbr0
Change MAC address to the OVH virtual MAC.
Example:
AA:BB:CC:DD:EE:FF
This is the MAC OVH assigned to:
b.b.b.59
LAN Interface
Attach to:
vmbr1
Normal Proxmox-generated MAC is fine.
The final VM should have:
Net0
|
vmbr0
|
WAN
|
b.b.b.59
Net1
|
vmbr1
|
LAN
|
10.0.0.1
Install OPNsense
Boot the VM from the ISO.
Important:
At the prompt do not accidentally just run the live environment using root (user) and opnsense (password).
Instead you need to login as
installer (and opnsense for password)
Otherwise:
root/opnsense
live mode starts from the CD, and after reboot, all changes disappear.
For filesystem:
UFS
works fine.
ZFS is possible but usually unnecessary for a small firewall VM.
ZFS:
- requires more RAM
- provides benefits mostly with larger storage setups
Assign OPNsense Interfaces
During first boot:
Assign:
WAN → vmbr0 NIC
LAN → vmbr1 NIC
After installation:
Connect a VM to vmbr1 (I installed a Debian gui inside Proxmox temporarily) and access:
https://10.0.0.1
Login:
root
This is a good oppurtunity to reset the password if you didn’t already do so during the initial installation.
Lobby
→ Password
Once everything is completed it is good to come back around and add another user to handle standard day to day activities.
Configure the OPNsense WAN Interface
Go to:
Interfaces
→ WAN
Set:
IPv4 Configuration Type:
Static IPv4
Enter:
IPv4 Address:
b.b.b.59
Subnet:
/32
Example:
b.b.b.59/32
Why /32?
OVH failover IPs are routed addresses.
The IP itself does not belong to the same subnet as the gateway.
The server gateway:
a.a.a.254
is outside:
b.b.b.59/32
This is normal.
Configure the OVH Gateway
Go to:
System
→ Gateways
→ Single
Create a gateway.
Interface:
WAN
Gateway:
a.a.a.254
Enable:
Upstream Gateway
Most importantly:
Enable:
Far Gateway
The OVH + OPNsense “Far Gateway” Problem
This is the most common issue.
Everything looks correct:
- VM networking works
- Virtual MAC is correct
- WAN IP is correct
- Gateway is correct
But:
OPNsense cannot ping OVH gateway
Why?
Because OPNsense sees:
WAN IP:
b.b.b.59/32
Gateway:
a.a.a.254
The gateway is outside the subnet.
Normally routers expect the gateway to be directly reachable.
OVH’s routed setup works differently.
The Far Gateway option tells OPNsense:
“Yes, this gateway is outside this interface subnet. This is expected.”
After enabling:
Far Gateway
save and apply.
The WAN should immediately become functional.
Configure the LAN Network
Example:
LAN IP:
10.0.0.1/24
Go to:
Interfaces
→ LAN
Set:
IPv4:
10.0.0.1/24
Enable DHCP
Go to:
Services
→ DHCPv4
→ LAN
Enable DHCP.
Example range:
10.0.0.50
-
10.0.0.200
Now VMs connected to vmbr1 will automatically receive:
IP address
Gateway
DNS
from OPNsense.
Configure Firewall Rules
By default, LAN traffic may be blocked.
Create a rule:
Firewall
→ Rules
→ LAN
Add:
Action:
Pass
Direction:
Out
Protocol:
Any
Source:
LAN net
Destination:
WAN net
This allows:
LAN → Internet
To Check – Configure NAT
Go to:
Firewall
→ NAT
→ Outbound
Use:
Automatic outbound NAT
OPNsense will automatically translate:
10.0.0.x
into:
b.b.b.59
when accessing the internet.
To Check – Proxmox Firewall Considerations
Proxmox also has its own firewall.
For an OPNsense VM acting as the main firewall:
Usually disable Proxmox firewall on the OPNsense NICs.
VM settings:
Hardware
→ Network Device
→ Firewall
Disable
Why?
Because you now have:
Internet
|
OPNsense firewall
|
VM network
Adding another firewall layer can create unexpected blocking.
A Proxmox firewall rule could prevent OPNsense from reaching the OVH gateway.
Testing the Setup
Test Proxmox
SSH into Proxmox:
ping a.a.a.254
Then:
ping 8.8.8.8
Confirm the host works.
Test OPNsense WAN
In OPNsense:
Interfaces / Diagnostics
→ Ping
Test:
a.a.a.254
Then:
8.8.8.8
Test Internal VM
Within the test VM:
Network:
vmbr1
It should have already received:
10.0.0.x
Check:
ipconfig
or:
ip addr
Test:
ping 10.0.0.1
Then:
ping 8.8.8.8
Future Remote Access: WireGuard Backdoor
A good final design is:
Internet
|
Proxmox public IP
|
WireGuard
|
Private management network
|
OPNsense
|
VMs
Keep the Proxmox IP:
a.a.a.222
for emergency access.
Later:
- restrict web access
- disable unnecessary exposed ports
- use WireGuard VPN for administration
This provides a secure recovery path if OPNsense rules are accidentally misconfigured.
Final Notes
Running OPNsense inside Proxmox on OVH works very well, but there are a few OVH-specific details that are easy to miss:
- Use OVH virtual MAC on the OPNsense WAN NIC
- Keep the OVH primary IP on Proxmox
- Use /32 for failover IPs
- Use an internal bridge for your VM network
- Disable Proxmox firewall on OPNsense interfaces initially
- Enable Far Gateway in OPNsense
That last setting is the one that usually causes hours of troubleshooting:
OVH routed IP + OPNsense = Far Gateway required.
Once configured correctly, OPNsense becomes a full virtual edge firewall for your Proxmox environment.