Messages

ok thanks, good to know. I might give VM a try and if it's too much trouble do bare metal.
Are you doing backups/snapshots somehow?

Is your machine running stable now and which changes were you referring to, Reply #9?
I'm about to setup Proxmox on a Topton N5105...

[Fibre ONT > WAN router from provider > N5105 Router (12GB RAM, 256 SSD, x4 intel 226 NICs) > Netgear GS716T Switch]

I'm about to setup a new OPNSense on a Topton N5105 and I'm looking for some guidance/best practice and help. Right now I've an APU running pfSense but that had a few crashes in the last months and had problems running pfBlockerNG, probably underpowered. While setting up the new box I would also simplify my network setup.

Alltogether maintenance should be simple because there's limited time to look after it and family cursings getting loud quickly when the internet is down ;-)

Base setup is simple:
Fibre ONT > WAN router from provider > N5105 Router (12GB RAM, 256 SSD, x4 intel 226 NICs) > Netgear GS716T Switch

1) First on the agenda, virtual or bare metal? The APU with pfSense runs bare metal but every time something went wrong (e.g. failed upgrade, broken hardware) it took a lot of time to get everything back up and running again.

I'm running Proxmox on a NUC and really appreciate the snapshot/backup facility. That's probably the main reason why I like the idea of running OPNSense as VM. That way you could also roll back changes easily when misconfigurations happened. I read you can can also do backups with ZFS but fiddling on the command line, setting up CronJobs etc. doesn't sound easier and it won't help if something during an OS update went wrong.

Of course using Proxmox would be exposed it to the internet (problem?) and it adds some complexity to the setup. I read that there are sometimes issues with Proxmox and assigning NICs to the VM?

So, does Proxmox really add that much complexity? On my NUC it runs stable. At the moment I only plan to run an OPNSense VM, maybe if necessary a PiHole and that's it.


2) LAN setup
At the moment the LAN runs on subnet 192.168.1.x, wired devices are straight forward and are all plugged into the Netgear Switch.


3) WiFI setup
At the moment I use a Archer C7 with Gargoyle which could be changed to OpenWRT or so if necessary and it's plugged in at its own port in the pfSense firewall but could of course it can be plugged into the switch. The WiFi subnet is currently 192.168.3.x. For most things that's fine but DLNA and other services that need broadcasting(?) just don't work across subnets and are a pain, hence I would put all on the same subnet 192.168.1.x

Now for security concerns I would like to separate IoT devices and Guest WiFi devices from most other devices in the LAN.
IoT devices only need to see my HomeAssistant (LAN) and maybe my PC on the LAN so I can manage them. They probably also should be isolated from each other?

Other WiFi devices like my phone, laptop, tablet should have access to all devices (except IoT).
What would be the best (maintenance friendly) approach to set this up, VLANs? I mean the IoT devices could theoretically have their own subnet and then I can route them in OPNSense. My only problem in this case would be, that I only want to use 1 WiFi AP and that probably can't handle 2 separate WiFi networks with different subnets, or? Then VLAN tagging could be an option but I'm also not sure if OpenWRT could handle 2 WiFi networks with different VLAN tags?

Is OPNSense 23.x the version to go with? I read you need at least 22.1 because of the intel 226 NICs?