Can OPNsense allow only a portion of its traffic to go through an external proxy

Started by cicirrr, November 20, 2025, 10:55:08 AM

Previous topic - Next topic
I wanted to try sending just a small part of my traffic through an external proxy (I tested one service like ProxyShare,naproxy,proxylite), mainly for some simple routing tests.
Right now I'm using basic policy routing, but I'm not sure if that's the correct or safest way to do it.
For anyone with more experience:
Is there a recommended method for this?
Should I separate it by device or VLAN?
Anything important a beginner should watch out for?

Quote from: cicirrr on November 20, 2025, 10:55:08 AMRight now I'm using basic policy routing, but I'm not sure if that's the correct or safest way to do it.
It is.
Just ensure that the policy-routing rule is set on the top of the rule set, so that it is checked before other rules allowing any outbound.

Quote from: cicirrr on November 20, 2025, 10:55:08 AMShould I separate it by device or VLAN?
I assume, you'd assigned static IPs to the concerned devices, maybe via DHCP. So put all these IPs into an alias and use it as source in the policy-routing rule.
Of course, you can also put all these devices in a separate VLAN if you want. So you don't need the source alias.


I haven't done what you are trying, but here is how I would approach that.

Create a WAN Gateway with the IP gateway of your Proxy and enable it.
Create a LAN subnet in Interface and enable it.
Configure the LAN DCHP unless you are setting static addresses.
Assign the Interface, ex: igb2 (depending on what port you are plugging into)
Select the proxy WAN in the Interface gateway settings (At the bottom of the config page) of the LAN subnet interface that you created.
Copy the default LAN to WAN (Default LAN to any rule) for the new LAN interface, deselect LAN and select your new LAN Proxy Interface and save.
Verify traffic flow on the firewall live view.