SSH to VMs disconnect after 1 minute

[hackdefendr]

Hello all this is my first post. Please be gentle 

I have a flat network in my house with OpnSense being my primary firewall, coming from a Sophos XG Appliance that went EOL. On my Arm server I do all my virtualization stuff (containers, virtual machines, etc.). It is running a standard routed virtual network on 192.168.x.x, and my LAN is on a 10.x.x.x subnet.

Pretty sure I am just missing a setting here, because using the same knowledge carried over from my time with the Sophos where this did work; I created the custom gateway pointing at my server's IP, then created a static route for the virtual network using that gateway. I was thinking that should be it, but unfortunately what happens is this: I can reach the VM IP with SSH, I get prompted for my password and can log in and even start 'top' or a 'ping' - within a minute the connection times out and is disconnected.

trace route from each endpoint, including my server, shows that the return traffic from the VM is hitting its gateway, but since the server IP and my MacBook (the client) IP are on the same subnet the server is just sending directly to my MacBook, skipping OpnSense and skipping what I believe to be network routing standards.

So I ask the community, the gurus, and the admins...what is missing from my configuration? Please tell me I don't have to set static routes on every client too? Is there a magic setting I didn't set?

Thanks in advance...
J

[dseven]

So if I'm understanding this correctly... the "Arm server" does layer 3 routing from 10.x.x.x to 192.168.x.x? So you've created an asymmetric routing scenario, where traffic from the macbook to a VM goes through the firewall, but return traffic does not (because the "Arm server" has a direct route to 10.x.x.x).

See maybe https://forum.opnsense.org/index.php?topic=34815.msg168643 (not tried this myself)