Issue migrating hardware

[Graylev]

Hi, I used to run pfSense on a Protectli FW4B but I wanted to moved to OPNsense. I setup a VM in Proxmox and passed through two InteL NICS through to it. I got it all setup and working great. I've got a bunch of VLANS and DNS filters etc. Like I said it works great. I then wanted to move it to it's own dedicated hardware which is the protectli FW4B which also has intel nics and the same naming of igb0 for WAN and igb1 for LAN etc. My VM is on version 26.1.11. On the FW4B I installed the latest ISO I could get which is 26.1.6. I then restored a copy of the config.xml to it. I then unplugged the cables from the proxmox VM and plugged the FW4B into the same sockets. It powered up and I updated it to 26.1.11. Now is when it gets weird. No computer could browse the web but they could ping public IP's and do NSLOOKUP on any DNS name. In the firewall logs I get a lot of "Default deny / state violation rule". In my desperation I have some rules to stop people using other DNS than the ones hosted on the router. I disabled them and things sort of started working. My computer on my USERS VLAN worked but computers on the GUEST VLAN wouldnt work except for my daughters computer which is on a DHCP reservation. The guest VLAN only has one rule which is to allow internet access and thats it. It's very weird and confusing. It's a fresh install and just a copy of the config.xml which works fine elsewhere. Other than the router I also have two VLAN aware layer 2 switches. I'm out of ideas. The interfaces and vlans looks to be assigned to the correct physical interfaces. I think I've checked all the obvious stuff.

[yourfriendarmando]

One observation with these mini-pcs,
is that running a system in a system on these older Protectli devices, like Proxmox,
feels like it would be TOO heavy for them.
It could add unnecessary lag too which is not preferable for a firewall.

For the price one of these FW series devices run for, you can get a few in stock, or run in a HA redundant configuration or something.
FreeBSD/OpnSense runs great as the bare-metal OS.

That being said, I think depending on how you configured your VM OS,
are you passing through the physical adapter, which may be ideal for a firewall.
Sometimes the VT Net virtualized network adapter struggles with real life events like
a cable physically disconnected from the medium.

Also is the virtual switch perhaps blocking VLAN tags through to the real switch.
For virtual application servers, I have often added a new network adapter,
that tags a VLAN externally, and the inner VM server has no idea.
You may need to allow VLAN pass through.

Here is some discussion on that
https://forum.proxmox.com/threads/vlan-passthrough.142272/

Hope that helps, but yeah unless you have a 1U server to handle VMs, I highly urge you to run OPN as the baremetal OS, make your life easier.

[cookiemonster]

It sounds like it's configuration problem.
When you go from VM to baremetal or viceversa, there are changes to be made. There is no proxmox bridge anymore, the firewall rules will need to be adjusted for instance.
Either will work fine on small networks until you need high cpu performance for IPS for instance.
My main OPN (at home) runs as VM on a small Chanwang thingie and has spare resources. It uses an AMD Ryzen 5 5600U with just 2 cores, 2 threads. Uses various services, including Zenarmor, a few VLANs. No problem.
In sum, just review or post your settings and we'll help you figure out the problem. Doubt is performance related.