"Quote from: Maurice on September 25, 2023, 12:39:43 PM[/quote]Quote from: randomwalk on September 24, 2023, 08:16:56 AM
So the LAN traffic goes like this: LAN device (192.168.1.x) --> Ubuntu VM (192.168.1.10) --> out via Mullvad interface on the VM --> OPNsense gateway (192.168.1.1) --> internet.
Nope, it doesn't. If you use policy-based routing on OPNsense to achieve this, the LAN devices will keep using OPNsense as their default gateway, which then forwards the packets:
LAN device --> OPNsense --> Ubuntu VM --> OPNsense --> Internet
To avoid this, you can assign the Ubuntu VM as the default gateway via DHCP.
Making the VM multi-homed makes sense and it would be easy to add more virtual NICs.
I had not realized the above flow of traffic, which makes sense since if the traffic does not first hit OPNsense, then it can't do policy-based routing. I was thinking that because the VM and LAN devices are in the same subnet (192.168.1.1/24), then traffic between them wouldn't go through OPNsense.
I have two concerns about making the VM the default gateway (via DHCP or otherwise).
First, making the VM the default gateway would mean that none of the firewall rules or policy-based routing in OPNsense would have any effect, right? Since the traffic doesn't go to OPNsense first?
Second, since the VM currently forwards all incoming traffic on the LAN interface to wg-mullvad interface, LAN devices would not be able to access local subnets (devices in both the LAN and Guest nets) unless I somehow add iptable rules on the VM to direct "local" traffic to OPNsense. Effectively, I have to make the VM a router too?
It seems hard to decide whether making the VM the default gateway (so saving one hop to OPNsense for external traffic) is more efficient than the current setup where traffic across local subnets goes only through OPNsense without going through the VM, but external traffic requires an additional hop? Just trying to understand the pros and cons of having the VM be the default gateway.
