Messages

Hi,

You are assuming that "hardware" must be faster than "software". That is not generally true.

If OPNsense itself runs as a VM on that host, the traffic has to pass through a VM anyway, so adding physical NICs and an external switch only adds another network path.

You are correct. If traffic is within server, virtual switch would be faster vs any hardware based approach for VM to VM traffic.

In my case client machines will be connecting to gaming VM over LAN, so traffic has to leave VM Host server.

Sorry I should have mentioned.
OPNSense router is a separate system(M720q) with a 4 port NIC.

In either case, I would start with virtio + a Linux bridge and only change that if measurements show an actual problem.

I'll definitely try this, right now I am gathering information and exploring my options so that I can compare what works best.

Thank you

I can only tell you how I am doing that kind of thing with PVE (which also uses KVM, so this should be similar enough):

I have one bridge vmbr0 connected to a physical ethernet adapter that connects to the "real" network and it also has the IP of the PVE host.
A second bridge interface vmbr1, is VLAN-aware and is purely virtual, in that it has no physical NICs attached to it at all.
For each VM, I create a separate VLAN X with a an associated subnet, say 10.0.X.0/24. The VM X itself has 10.0.X.2/24 as its IP address and 10.0.x.1 as gateway and DNS server.

I use one OpnSense VM that has its virtio "WAN" attached to vmbr0 and thus gets an IP on my LAN. It also has a virtio "VLANBRIDGE" interface, off of which I define "VLANX" interfaces accordingly with VLAN X and IP address 10.0.x.1/24.

Each of the VLANXs is allowed to access the internet, but not RFC1918, so it cannot access either LAN devices or other VMs.

On the other hand, I can create rules that allow access from the "WAN" (aka LAN) to each VM (or the whole 10.0.0.0/16 range).

You can use such a setup in a datacenter or at home, like described here: https://forum.opnsense.org/index.php?topic=44159.0

Thank you for sharing your approach.

From what I understand, you are using virtual switch (software) and subnet. I want to explore hardware option before using virtual switch to reduce latency for gaming VM's.

Hi,

I am using M720q as a router with OPNSense with no monitor connected.

M720q
8100T
8GB RAM
128GB SSD Patriot
4 port Intel network card IBM/Intel
Been running for over a year without any issue.

Hi OPNSense team,

Just want to share my feedback.

I was on a very old version (1 year back) of OPNSense and wanted to move to 26.7. I had to update firmware a number of times, it went through multiple subversions example
25.1, 25.3, 25.7, 26.1, 26.7

Update firmware should require single click to bring it to latest version without needing to go through older versions.

Hi Everyone,

My Setup:
   Internet > ISP Router(into OPNSense WAN Port) > OPN Sense Router(one WAN port and 4 Lan port(LAN bridged)) > All devices(Server, AP and other devices on network into those 4 LAN Ports)

What I have :
single home server Host Debian KVM, it hosts multiple VM's. There will be client machines that will be connecting to these VM's over LAN. Two of VM's are gaming VM.
Currently OPNSense is assigning IP to VM's.

Objective:
   1. I want to be able to isolate individual VM's on network so they don't see other VM's on LAN or communicate with host on network.
      Example
      VM1 should not see/access VM2,3,4...
      VM2 should be able to see VM4 only.

   2. I don't want to use virtual switch on host for performance reason. I'll be using network card with SRIOV functionality assigning virtual functions to each VM or maybe passing physical port to each VM.


1. I don't know much about networking and need guidance on how to achieve objective. What I have learned so far is that I need to use subnet/VLAN to be able to isolate individusl VM's. I could create 4 VLAN on each of the 4 ports with different subnet but then how do I connect VM's to these separate VLAN's/subnet.

2. What is the difference between these from performance perspective?
Software bridge on host with single physical port.
vs
Passing through physical ports to each VM, using a network card with multiple ports supporting IOMMU.
vs
Assigning virtual functions to VM's SRIOV.

Thank you

Note that the specific system is off and actually has no IP at that time, so it cannot react to a directed request with an IP.

AFAIK, when you use "-i", you are denoting a specific (OpnSense) interface instead of using "255.255.255.255", which in turn should use all WOL-capable interfaces at once. Thus, you should not use a target system IP address, but the broadcast address of the specific interface, like "-i 192.168.1.255", or no "-i" at all.

Thanks a Ton,

It works :)

So this can help others
This is the command used from OPNSense (install os-wol plugin)

/usr/local/bin/wol -i 192.168.1.255 <MAC address>

Hi Everyone,

I have setup wol plugin under services to wake up proxmox machine. I am able to wake up system using opnsense GUI Services > "Wake on LAN" without any issue.

I want to automate system startup, whenever router starts it should turn on the server.

My Setup:
//Create file at /usr/local/etc/rc.syshook.d/start
File Name - 99-wolproxmox

content of file :
/usr/local/bin/wol -i <IP address of target system> <mac address>
/usr/local/bin/wol -i <IP address of target system> -m <mac address>

I have tried to login to opnsense shell and issue commands from there but it doesn't work. When I issue above commands it says on screen
Waking up x:x:x:x:x:x...(removed mac address) but nothing happens.

Any suggestion how to make this command work?

Thankyou Patrick

1. Created LAN Bridge following the document.
2. Created range under Services > DHCP
3. Assigned static IP to MAC address.

All good now.

Thank you :)

Onto reading.

Hello Everyone,

This is my current setup
ISP Router LAN port connected to WAN Port on ASUS Router.
There are four LAN ports on Asus router which are connected to four different clients, I have assigned fixed IP addresses to each of those clients in the router LAN > DHCP settings(192.168.1.2, 192.168.1.3, 192.168.1.4, 192.168.1.5). If I want to connect to router settings page I simply hit 192.168.1.1 from client connected to any of the four LAN ports. I have blocked internet access to all these clients in router settings.

With OPNSense
I am using Lenovo M720q tiny
Onboard Port - Assigned as WAN

four Port NIC - PRO 1000 PT
Port1 - LAN (Fixed IP 192.168.1.1 under Interfaces > IPv4 address)
Port2 - Opt1 (DHCP under Interfaces > IPv4 Configuration Type)
Port3 - Opt2 (DHCP under Interfaces > IPv4 Configuration Type)
Port4 - Opt3 (DHCP under Interfaces > IPv4 Configuration Type)

1. Port1 - LAN has fixed IP 192.168.1.1, how can I make all four LAN/OPT ports usable. If I change the Port1 LAN port IP I am no longer able to connect to Opnsense settings page. Also currently none of the other ports are working, when I connect a client on opt ports client doesn't get any IP assigned even though DHCP is on for those ports.
2. How can I reach 192.168.1.1 from all LAN/OPT ports, just like you can do it on ASUS router. Or does it mean that Port1 is fixed for OPNSense and can't be used by client to assign fixed IP?
3. How do I assign fixed IP to each of those four ports. So when a client connects it gets assigned that fixed IP.

[...]
Or just use ZFS.

I'd always recommend using an SSD with big caps just to make sure the SSD's own buffers are written when power is cut. Will you ever notice the difference? Probably not, unless your luck is like mine.

(The feature is generally listed as "power fail protection" or similar; the large capacitors are pretty obvious on M.2 devices and may make applying a heat sink a bit more challenging.)

Thank you

For now I'll be using image until I have figured out how to shut down with a remote(Single button click). There are other electronic devices that are controlled by this remote then through WOL, shutdown Scripts.

Write the nano image to an SSD instead to a USB drive. It will be read-only apart from the configuration. No problem with a power cut.

Or just use ZFS.

Thank you.

Hello Everyone,

I want to run opnsense just like embedded systems where only config is saved in permanent memory rest everything runs in RAM.
Reason - I want capability to just cut the power and not corrupt the file system.

Only config should save on SSD, rest everything should run from ram. Nano seems to do what I want but how do I run img from SSD just like we can run img from bootable usb. I don't want to install os on ssd.

I am fine installing on SSD as long as it gives me capability to just switch off power without corruption.

Thank you