Geek.Click

Tag: OPNsense

  • Running OPNsense as a Virtual Firewall on Proxmox Dedicated Server

    A common use case for OVH dedicated servers is running multiple virtual machines while keeping the environment securely separated behind a firewall.

    Proxmox VE is an excellent hypervisor for this, but when you want proper network segmentation, DHCP, NAT, VPN access, and firewall rules, running a dedicated firewall appliance such as OPNsense inside Proxmox makes a lot of sense.

    This guide explains how to build the following setup:

    • OVH dedicated server
    • Proxmox VE as the hypervisor
    • OPNsense running as a virtual machine
    • OVH additional/failover IP assigned to OPNsense WAN
    • Private LAN network for virtual machines
    • NAT and DHCP handled by OPNsense
    • Proxmox host remaining accessible for management

    One important OVH-specific issue is covered at the end: the “Far Gateway” problem that prevents OPNsense from reaching the OVH gateway when using routed failover IPs.

    Network Design Overview

    The final topology will look like this:

                        Internet
                       |
                  OVH Network
                       |
              OVH Dedicated Server
                       |
        +------------------------------+
        |          Proxmox VE          |
        |                              |
        | Primary IP: a.a.a.222        |
        | vmbr0 → eno1                 |
        |                              |
        |                              |
        |       OPNsense VM            |
        |                              |
        | WAN: b.b.b.59                |
        | LAN: 10.0.0.1                |
        |                              |
        +-------------+----------------+
                      |
                    vmbr1
                      |
              Internal VM Network

              VM1 10.0.0.x
              VM2 10.0.0.x
              VM3 10.0.0.x

    The idea:

    • OVH’s original IP stays on the Proxmox host.
    • The additional OVH IP is assigned directly to the OPNsense WAN interface.
    • OPNsense becomes the router/firewall for internal VMs.
    • Internal machines never directly touch the OVH network.

    OVH Network Requirements

    You need:

    Primary OVH IP

    Example:

    IP:
a.a.a.222

Gateway:
a.a.a.254

Subnet:
255.255.255.0 (/24)

    This IP belongs to the physical Proxmox host.

    Additional OVH IP

    Example:

    IP:
b.b.b.59

    OVH will provide:

    • Additional/failover IP
    • Virtual MAC address

    The virtual MAC is extremely important.

    OVH uses it to identify which virtual machine should receive traffic for that IP.

    Configure Proxmox Networking

    The Proxmox host keeps the main OVH IP.

    Example:

    /etc/network/interfaces

    auto lo
iface lo inet loopback


auto eno1
iface eno1 inet manual


auto vmbr0
iface vmbr0 inet static
    address a.a.a.222/24
    gateway a.a.a.254
    bridge-ports eno1
    bridge-stp off
    bridge-fd 0


auto vmbr1
iface vmbr1 inet manual
    bridge-ports none
    bridge-stp off
    bridge-fd 0

    Explanation:

    vmbr0

    This is the external bridge.

    vmbr0
 |
eno1
 |
OVH network

    Used for:

    • Proxmox management
    • OPNsense WAN interface

    vmbr1

    This is an internal-only bridge.

    No physical NIC is attached.

    Used for:

    • Private VM traffic
    • OPNsense LAN interface

    You can also configure this from:

    Proxmox GUI
→ System
→ Network

    Changes are written to:

    /etc/network/interfaces

    Important: Do Not Configure the Failover IP on Proxmox

    The additional OVH IP:

    b.b.b.59

    should NOT be added to:

    • eno1
    • vmbr0
    • Proxmox host networking

    It belongs inside the OPNsense VM.

    The OVH virtual MAC will be attached to the OPNsense WAN NIC.

    Create the OPNsense Virtual Machine

    Download the OPNsense DVD ISO.

    Upload it:

    Proxmox
→ local storage
→ ISO Images
→ Upload

    Create a new VM.

    Example settings (which I used this time):

    BIOS

    SeaBIOS

    CPU

    2 cores

    RAM

    4096 MB

    Disk

    8GB

    Machine

    Default i440fx

    Controller

    SCSI
VirtIO SCSI single

    Add Network Interfaces

    The VM needs two network adapters.

    WAN Interface

    Attach to:

    vmbr0

    Change MAC address to the OVH virtual MAC.

    Example:

    AA:BB:CC:DD:EE:FF

    This is the MAC OVH assigned to:

    b.b.b.59

    LAN Interface

    Attach to:

    vmbr1

    Normal Proxmox-generated MAC is fine.

    The final VM should have:

    Net0
 |
vmbr0
 |
WAN
 |
b.b.b.59


Net1
 |
vmbr1
 |
LAN
 |
10.0.0.1

    Install OPNsense

    Boot the VM from the ISO.

    Important:

    At the prompt do not accidentally just run the live environment using root (user) and opnsense (password).

    Instead you need to login as

    installer (and opnsense for password)

    Otherwise:

    root/opnsense

    live mode starts from the CD, and after reboot, all changes disappear.

    For filesystem:

    UFS

    works fine.

    ZFS is possible but usually unnecessary for a small firewall VM.

    ZFS:

    • requires more RAM
    • provides benefits mostly with larger storage setups

    Assign OPNsense Interfaces

    During first boot:

    Assign:

    WAN → vmbr0 NIC

LAN → vmbr1 NIC

    After installation:

    Connect a VM to vmbr1 (I installed a Debian gui inside Proxmox temporarily) and access:

    https://10.0.0.1

    Login:

    root

    This is a good oppurtunity to reset the password if you didn’t already do so during the initial installation.

    Lobby
→ Password

    Once everything is completed it is good to come back around and add another user to handle standard day to day activities.

    Configure the OPNsense WAN Interface

    Go to:

    Interfaces
→ WAN

    Set:

    IPv4 Configuration Type:

Static IPv4

    Enter:

    IPv4 Address:

b.b.b.59

    Subnet:

    /32

    Example:

    b.b.b.59/32

    Why /32?

    OVH failover IPs are routed addresses.

    The IP itself does not belong to the same subnet as the gateway.

    The server gateway:

    a.a.a.254

    is outside:

    b.b.b.59/32

    This is normal.

    Configure the OVH Gateway

    Go to:

    System
→ Gateways
→ Single

    Create a gateway.

    Interface:

    WAN

    Gateway:

    a.a.a.254

    Enable:

    Upstream Gateway

    Most importantly:

    Enable:

    Far Gateway

    The OVH + OPNsense “Far Gateway” Problem

    This is the most common issue.

    Everything looks correct:

    • VM networking works
    • Virtual MAC is correct
    • WAN IP is correct
    • Gateway is correct

    But:

    OPNsense cannot ping OVH gateway

    Why?

    Because OPNsense sees:

    WAN IP:
b.b.b.59/32

    Gateway:

    a.a.a.254

    The gateway is outside the subnet.

    Normally routers expect the gateway to be directly reachable.

    OVH’s routed setup works differently.

    The Far Gateway option tells OPNsense:

    “Yes, this gateway is outside this interface subnet. This is expected.”

    After enabling:

    Far Gateway

    save and apply.

    The WAN should immediately become functional.

    Configure the LAN Network

    Example:

    LAN IP:

10.0.0.1/24

    Go to:

    Interfaces
→ LAN

    Set:

    IPv4:

10.0.0.1/24

    Enable DHCP

    Go to:

    Services
→ DHCPv4
→ LAN

    Enable DHCP.

    Example range:

    10.0.0.50
-
10.0.0.200

    Now VMs connected to vmbr1 will automatically receive:

    IP address
Gateway
DNS

    from OPNsense.

    Configure Firewall Rules

    By default, LAN traffic may be blocked.

    Create a rule:

    Firewall
→ Rules
→ LAN

    Add:

    Action:
Pass

Direction:
Out

Protocol:
Any

Source:
LAN net

Destination:
WAN net

    This allows:

    LAN → Internet

    To Check – Configure NAT

    Go to:

    Firewall
→ NAT
→ Outbound

    Use:

    Automatic outbound NAT

    OPNsense will automatically translate:

    10.0.0.x

    into:

    b.b.b.59

    when accessing the internet.

    To Check – Proxmox Firewall Considerations

    Proxmox also has its own firewall.

    For an OPNsense VM acting as the main firewall:

    Usually disable Proxmox firewall on the OPNsense NICs.

    VM settings:

    Hardware
→ Network Device
→ Firewall

Disable

    Why?

    Because you now have:

    Internet
    |
OPNsense firewall
    |
VM network

    Adding another firewall layer can create unexpected blocking.

    A Proxmox firewall rule could prevent OPNsense from reaching the OVH gateway.

    Testing the Setup

    Test Proxmox

    SSH into Proxmox:

    ping a.a.a.254

    Then:

    ping 8.8.8.8

    Confirm the host works.

    Test OPNsense WAN

    In OPNsense:

    Interfaces / Diagnostics
→ Ping

    Test:

    a.a.a.254

    Then:

    8.8.8.8

    Test Internal VM

    Within the test VM:

    Network:

    vmbr1

    It should have already received:

    10.0.0.x

    Check:

    ipconfig

    or:

    ip addr

    Test:

    ping 10.0.0.1

    Then:

    ping 8.8.8.8

    Future Remote Access: WireGuard Backdoor

    A good final design is:

    Internet
 |
Proxmox public IP
 |
WireGuard
 |
Private management network
 |
OPNsense
 |
VMs

    Keep the Proxmox IP:

    a.a.a.222

    for emergency access.

    Later:

    • restrict web access
    • disable unnecessary exposed ports
    • use WireGuard VPN for administration

    This provides a secure recovery path if OPNsense rules are accidentally misconfigured.

    Final Notes

    Running OPNsense inside Proxmox on OVH works very well, but there are a few OVH-specific details that are easy to miss:

    • Use OVH virtual MAC on the OPNsense WAN NIC
    • Keep the OVH primary IP on Proxmox
    • Use /32 for failover IPs
    • Use an internal bridge for your VM network
    • Disable Proxmox firewall on OPNsense interfaces initially
    • Enable Far Gateway in OPNsense

    That last setting is the one that usually causes hours of troubleshooting:

    OVH routed IP + OPNsense = Far Gateway required.

    Once configured correctly, OPNsense becomes a full virtual edge firewall for your Proxmox environment.