OPNsense & pfSense Store
Cart 0

Run OPNsense in Proxmox

Introduction

Proxmox is an excellent virtualization platform based upon Debian Linux. OPNsense (and pfSense) will run nicely in a KVM based VM running on a Proxmox server. This guide will walk you through a simple install to get you started.

Disclaimer

There is a school of thought around if a VM can provide adequate isolation for a Firewall to provide network security. There is a similar school of thought as to if privileged and unprivileged VLAN's should share the same physical links and hardware. Flaws in the underlying software and hardware, as well as misconfiguration, can undermine the security of an entire ecosystem.

This guide should not be considered to endorse the suitability of OPNsense running on Proxmox for your systems. You should make this judgement yourself. This guide is also provided without warranty.

Download OPNsense DVD ISO on Proxmox

Using a convenient web browser running on your desktop of laptop:

  • Browse to https://opnsense.org/download/
  • Select the amd64 Architecture
  • Select the dvd Image
  • Select a mirror location suitable to your locale
  • Right click on the Download link/button and select  'Copy link location'. This may vary slightly depending on your browser
  • Take note of the SHA256 checksum

Use ssh to connect to a terminal on your Proxmox server and run commands as follows, placeholders are noted with <>:

  • cd /var/lib/vz/template/iso/
  • wget <download link>
  • sha254sum <opnsense-file.iso.bz2>
    Check your checksum matches the checksum on the OPNsense website
  • bunzip2 <opnsense-file.iso.bz2>

Create the OPNsense VM

Create VM Wizard

Log in to your Proxmox server's web interface, then click the Create VM button. Follow the following recommended settings.

Creat OPNsense VM in Proxmox 1

  • Node by default will be the Proxmox server you are logged in to. Change this as needed, if connecting to cluster
  • Insert a suitable VM ID, the default will probably be fine
  • Give your OPNsense VM a suitable Name
  • Enable the Start at boot check box
  • Optionally, select a suitable Resource Group
  • Optionally, enter suitable Startup and Shutdown options. Most likely this VM should be started first (Startup/Shutdown order value of 1)
  • Click Next

 

Creat OPNsense VM in Proxmox 2

OPNsense inherits excellent support for KVM from FreeBSD and Proxmox can simply consider it to be Linux as follows:

  • Select Use CD/DVD disc image
  • Select Storage as local
  • Select from ISO Image the OPNsense iso file
  • The VM Type will be Linux
  • The Version will be 4.X/3.X/2.6 Kernel
  • Click Next

 

Creat OPNsense VM in Proxmox 3

The defaults (show above) are adequate, so click Next

 

Creat OPNsense VM in Proxmox 4

  • The Bus/Device default should be adequate
  • Select suitable Storage and Disk Size to suit your needs
  • We recommend enabling IO thread
    which should improve IO performance by giving the disk its own worker thread
  • Optionally, configure other disk settings to suit your needs or return to them later

 

Creat OPNsense VM in Proxmox 5

For an example set up, the default CPU settings should be adequate. These can easily be adjusted as needed after installation. Click Next

 

Creat OPNsense VM in Proxmox 6

  • Setting Memory to 1024 is adequate for an example installation and can easily be adjusted after installation
  • Disable the Ballooning Device check box
  • Click Next

 

Creat OPNsense VM in Proxmox 7

  • Select from the Bridge drop down, your WAN network bridge
  • Disable the Firewall checkbox, as we do not want Proxmox to apply its own network policy on to our OPNsense VM
  • Select from Model the VirtIO option as OPNsense has excellent support for this device type
  • Optionally, specify a specific MAC address
  • Click Next

 

Creat OPNsense VM in Proxmox 8

Review the details selected, ensure that Start after created is not set, then click Finish

 

Creat OPNsense VM in Proxmox 9

Select the newly created VM, then click Hardware, then Add. A pop up will appear.

 

Creat OPNsense VM in Proxmox 11

  • From the Bridge drop down, select your LAN bridge
  • Disable the Firewall checkbox as before with WAN
  • Select from Model the VirtIO option as before with WAN
  • Optionally, specify a specific MAC address
  • Click Next

 

Creat OPNsense VM in Proxmox 12

KVM presents a tablet stylus pointer device to the Guest OS. This is convenient for Windowing systems but can cause high CPU usage even when idle. OPNsense has no Window system, so we recommend disabling it.

  • Click Options
  • Double click on Use tablet pointer, a pop up window will appear
  • Un-check the Enabled check box
  • Click OK

 

Creat OPNsense VM in Proxmox 13

Configuration of the VM itself is now complete. Click Start to run the VM for the first time and install the OPNsense software.

Creat OPNsense VM in Proxmox 14

Proceed as normal with the OPNsense installation process.

As pictured, you can use the MAC addresses of the Network interfaces to ensure you assign them to the correct LAN and WAN functions.

 

Post-Install Configuration

Disable Network Hardware Off-loading

Post install OPNsense configuration on Proxmox 1

Ensure hardware offload features on the network interfaces are disabled, as VirtIO interfaces have problems with NAT.

  • Click Interfaces
  • Click Settings
  • Ensure Hardware CRC, Hardware TSO, and Hardware LRO are all set to Disable
  • Click Save
  • Reboot the firewall

 

If not a VM, what should I run OPNense on?

For home, check out the A10 Dual Core or A10 Quad Core appliances in Desktop profile.

For business, check out the A10 Quad Core or the Xeon Quad Core Gen3 as Rackmount appliances.

Stuck?

We offer commercial support, why not contact us

Thanks?

If these steps have helped you, please put a 5 star review on our Facebook page



Older Post


Leave a comment

Please note, comments must be approved before they are published