Menu

Show posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Show posts Menu

Messages - Kieros

#1
General Discussion / Opnsense on VM Truenas Scale
November 04, 2025, 06:32:50 PM
I have truenas scale gold eye and opnsense has been running from the start in a VM so truenas scale 22.12 or so. I upgraded all the time even got vlans up and running since last year and it is still working fine.

I think however that the setup can be improved or restyled since I learned a bit along the way. However now I am stuck on how to do it properly.
I didn't pass through the NICS via pci passthrough, instead I created bridges on the nics and used them instead.

So right now I have these issues I need to fix or think I need to improve.
I read it is better to pass through the nics directly to opnsense.
So I have:
enp5s0 (ISP) > br1 > VM NIC (Opnsense)
enp1s0 (network) > br0 > Static NAS IP 192.168.7.2 > br0 > Opnsense VM

enp1s0 (Physically) > VLAN switch

In opnsense I have these VLANS which I would like to change in numbers to more commonly used numbers
I now have
192.168.7.1/24 nLAN in opnsense
192.168.10.1/24 VLAN10 truenas scale containers
192.168.72.1/24 VLAN72 LAN
192.168.73.1/24 VLAN73 GUEST
192.168.74.1/24 VLAN74 Iot
192.168.75.1/24 KVM (kvm module connected so if network is not good I can connect to the truenas scale menu or management network)

So the setup is bit of a mess right now.
The 72, 73, 74 and 75 networks are broadcasting ok on the TP-LINK  1x EAP615 and 2x 725 wall modules that I have.
Also the containers on truenas are in a MACVLAN network which is also 192.168.10.X/24 Somehow I managed to bridge this so that truenas has access to the containers and my pc and everything can connect to eachother. Don't know how I done this in the past, I think it was making a dummy IP or something like that.

What I would like is to have a network (management) for example the 192.168.10.1/24 that has the TNAS scale, the router addresses in it and the EAP and just for management
I would like to move the containers to 192.168.20.x/24 together with the vm's and have DHCP to the containers and VM's
30 as Iot DHCP or statics
40 perhaps for the kvm module
and 50 as guest

Attached are some settings. Truenas/opnsense vm's

Is it better to pass the nics through?
If it doesn't matter much how can I get the IP's to change without much trouble?
I tried setting up a new vlan on enp1s0 vlan20 (containers and vm's) to convert all the containers to it but hereá a catch opnsense is a vm and running on 192.68.7.1
I wanted to add a HAOS as a VM, now runs in docker, but I could not get bluetooth to pass through on the core version.
Most apps I run are custom made because the MACVLAN.

How should I approach this without having much downtime?
I also have adguard on container
nginx proxy manager a working
wireguard vpn connection towards home

I do not like to install everything over. There should be a way to set it up properly and all help and tips are welcome.
I am even considering the get the opnsense on a protecli or something with 2 NICS. With a N150 or something?
But this saves power as the nas is already running anyways.

The current system is this
OS Version:25.10-RC.1
Product:X570 I AORUS PRO WIFI
Model:AMD Ryzen 7 PRO 4750G with Radeon Graphics
Memory:31 GiB

enp5s0 (ISP)   
enp1s0 (netwerk)   
enx4a03acfe1576    (don't know)
br0 (netwerk + NAS IP)    192.168.7.2/24
br1 (ISP)   
di-b95febd57e23    (don't know)
enx0050b611d7af (backup network adapter if access is lost)    192.168.8.20/24

Thank you for your time in advance! For taking the time to read and answer this.









#2
Truenas scale:

Version:OPNsense 23.7.8_1-amd64 running in a VM
Opnsense IP 192.168.1.1
Adguard IP 192.168.1.210 (Docker)

I have done these steps I skipped step 1-3 as it is running in container

Quote3 - Opnsense - System - Settings -General

      DNS Servers: 192.168.1.210

      Untick: Do not use the local DNS service as a nameserver for this system

      Untick: Allow DNS server list to be overridden by DHCP/PPP on WAN

4 - Services – DHCPv4 – [LAN] : DNS Servers all empty

5 – Opnsense – Services - Unbound DNS – General

       Tick: Enable Unbound ( Listen Port: 5353 )

       Tick: Enable DNSSEC Support
       
       Network Interfaces: All

6 - Skipped using unbound to resolve or might add later.

7 - Activate and start AdGuardHome from Services --> AdGuardHome

8 - Navigate to http://192.168.1.210:3001 to complete the setup Adguard

9 - Adguard Home - DNS Configuration - Upstream Servers:

      Add Opnsense ip:5353  ( 192.168.1.1:5353 ) Delete those that exist

10 – Adguard Home – DNS Configuration – Bootstrap DNS servers

      Add Opnsense ip:5353  ( 192.168.1.1:5353 ) Delete those that exist
     
11 - Adguard Home - DNS Configuration - Private reverse DNS servers:

           192.168.1.1:5353

I followed all steps, but like I mentioned my adguard is running remote on another IP in the same network.
I run truenas and have containers running all working fine when I use only unbound.
When I start to use above setup with adguard. I can search the internet etc.

Can someone explain me the addidiontal steps or what am I doing wrong?

System - Settings - General - DNS servers list - 192.168.1.210
Services - DHCPv4 - [LAN] DNS servers - 192.168.1.210

As soon as I put back unbound back to 53 everything is working just fine on homeassistant.
When I use adguard with above settings somehow tuya stops working for the lights and there seems to be problems from homeassistant reaching 443 for example lights running with tuya and solardedge and soem cloud services running on 443 seem to sto pworking.

Unboud is set at 5353 and adguard at 53
I tried forcing DNS to redirect to 192.168.1.210. By creating NAT forward rules.
Nothing seem to help and if I use such rules nothing works?
Please provide me with an example. And perhaps I make this rule wrong because the example are all on opnsense ip or 127.0.0.1.