How to configure OPNsense on OVH Hosting in a virtual environment

[ovizii]

Hi there,

I am attempting to install OPNsense in a virtual machine using OVH as my host.
OVH has a different setup than the usual hosts namely that the Gateway for VMs is basically the IP of the host with a .254 ending so the Gateway of OPNsense would be outside the WAN network.

All I could find on this topic is:

• a post from 2015 with the exact same problem: https://forum.opnsense.org/index.php?topic=1500.msg4562#msg4562
• a blog post treating the same problem with pfsense 2.0: http://blog.magiksys.net/pfsense-firewall-default-gateway-different-subnet
  
• a similar blog post about pfsense 2.0: http://magiksys.blogspot.de/2012/12/pfsense-bridge-gateway-vmware-ovh-ip.html
  
• the explanations of the host: http://help.ovh.co.uk/BridgeClient
  
• another thread dealing with this problem with pfsense: https://forum.ovh.co.uk/showthread.php?6507-ESXi-pfSense-and-failover-IP
  

I hope someone can help. I am very happy with OVH, its one of the biggest hosts in Europe so I am very surprised that I could not find more info on this topic and all the info I found was from around the years of 2012-2013.

I have attached the config of a windows machine to demonstrate what is needed. Here is some more info to go with that screenshot:
94.xxx.xxx.79 is the host in this case Proxmox but could be VMware or any other hypervisor
51.xxx.xxx.83 is an IP assigned to a VM, in this case Win10 but OPNsense will get a similar one
255.255.255.255 is the netmask which needs to be used as OVH does some weird ARP stuff behind the scenes
94.xxx.xxx.254 is basically the IP of the hypervisor with the ending replaced with 254 to serve as the gateway

To summarize:
Can someone write some sort of tutorial or at least confirm which solutions found in the above links is recommended for OPNsense 16.7?

[YoShiiro]

did you find any solution ?

I've tried to install firewall as vm as pfsense or ipfire based on freebsd . But when i try to config the WAN (em0) using an IP Failover for WAN access impossible to configure it.

Does anyone know how i can configure em0 to use IP Failover on a proxmox ?

[ovizii]

I haven't made any progress and other issues cropped up so I have postponed this until I find more time.

[socket]

Hi ovizii,

I am using soyoustart which is a branch of OVH and is very similar if not the same (I also have some experience using OVH).
I think I achieved what you are looking for using virtual IPs.

I have a Xen Server 6.5 which takes the primary ipv4.
Then I have 2 failover IP assigned to the same MAC address.

OPNsense is running as a VM inside Xen Server but it should be the same with vmware.

In OPNsense I assigned this very MAC address to the xn0 interface (WAN)
I then configured one of two FO IP to the WAN with /24 subnet (I will look if it is possible to add it as a /32, which I know is working using other firewall appliance) and configured the upstream gateway with .254 ending.

Enabled NAT and internal VM were able to browse internet.

Then I wanted to assign the second FO IP to a specific VM.
I simply added it under Virtual IPs with /32 mask.

I was then able to specify this Virtual IP in NAT/Port Forward and it does work.

There are a lot to improve in my config but I started using OPNsense yesterday, so....

[ovizii]

I'm with SoYouStart too! Thanks for the tips, I'll be checking them out. Just wondering as you mention NAT, all my VMs have their own public IPs.

[socket]

I saw in NAT/One-To-One there is no virtual IPs.
But I think it should work if you add here the FO IP.

I have still not tested the outbound NAT of the FO IP.

Maybe I will test it next few hours and post a reply here.

(Now I am configuring OpenVPN with RSA )

[dison4linux]

I found this https://forum.ovh.co.uk/showthread.php/6507-ESXi-pfSense-and-failover-IP
and successfully followed those steps on pfSense, but when trying to do the same on OPNsense, no joy.

The individual shell scripts do their thing, but the bit in devd doesn't seem to trigger the shell scripts.

Is someone able to take these instructions for pfSense and adapt them for OPNsense?

[YoShiiro]

I've successfully doing it on ipfire but on OPNsense never find the way to doing it if anybody got news about that .

I don't know how to use ip failover as ip for net routing to my lan subnet on nic 1 & 2

[slimit]

I'm working with OVH Failover IPs since many years and don't have such problems on CentOS and Ubuntu.

All seems to be well configured but it doesn't work

[slimit]

It is working now, I don't know exactly what operation did the trick.

I think that I will have to reconfigure after a restart and then I will try to write what commands fixed the problem.

[YoShiiro]

it could be greate because i stop use it since i cannot find how to configure interfaces using failover ip. I got DMZ / LAN + net interfaces but don't find any way to use failover