Issue migrating hardware

[Graylev]

Hi, I used to run pfSense on a Protectli FW4B but I wanted to moved to OPNsense. I setup a VM in Proxmox and passed through two InteL NICS through to it. I got it all setup and working great. I've got a bunch of VLANS and DNS filters etc. Like I said it works great. I then wanted to move it to it's own dedicated hardware which is the protectli FW4B which also has intel nics and the same naming of igb0 for WAN and igb1 for LAN etc. My VM is on version 26.1.11. On the FW4B I installed the latest ISO I could get which is 26.1.6. I then restored a copy of the config.xml to it. I then unplugged the cables from the proxmox VM and plugged the FW4B into the same sockets. It powered up and I updated it to 26.1.11. Now is when it gets weird. No computer could browse the web but they could ping public IP's and do NSLOOKUP on any DNS name. In the firewall logs I get a lot of "Default deny / state violation rule". In my desperation I have some rules to stop people using other DNS than the ones hosted on the router. I disabled them and things sort of started working. My computer on my USERS VLAN worked but computers on the GUEST VLAN wouldnt work except for my daughters computer which is on a DHCP reservation. The guest VLAN only has one rule which is to allow internet access and thats it. It's very weird and confusing. It's a fresh install and just a copy of the config.xml which works fine elsewhere. Other than the router I also have two VLAN aware layer 2 switches. I'm out of ideas. The interfaces and vlans looks to be assigned to the correct physical interfaces. I think I've checked all the obvious stuff.

[yourfriendarmando]

One observation with these mini-pcs,
is that running a system in a system on these older Protectli devices, like Proxmox,
feels like it would be TOO heavy for them.
It could add unnecessary lag too which is not preferable for a firewall.

For the price one of these FW series devices run for, you can get a few in stock, or run in a HA redundant configuration or something.
FreeBSD/OpnSense runs great as the bare-metal OS.

That being said, I think depending on how you configured your VM OS,
are you passing through the physical adapter, which may be ideal for a firewall.
Sometimes the VT Net virtualized network adapter struggles with real life events like
a cable physically disconnected from the medium.

Also is the virtual switch perhaps blocking VLAN tags through to the real switch.
For virtual application servers, I have often added a new network adapter,
that tags a VLAN externally, and the inner VM server has no idea.
You may need to allow VLAN pass through.

Here is some discussion on that
https://forum.proxmox.com/threads/vlan-passthrough.142272/

Hope that helps, but yeah unless you have a 1U server to handle VMs, I highly urge you to run OPN as the baremetal OS, make your life easier.

[cookiemonster]

It sounds like it's configuration problem.
When you go from VM to baremetal or viceversa, there are changes to be made. There is no proxmox bridge anymore, the firewall rules will need to be adjusted for instance.
Either will work fine on small networks until you need high cpu performance for IPS for instance.
My main OPN (at home) runs as VM on a small Chanwang thingie and has spare resources. It uses an AMD Ryzen 5 5600U with just 2 cores, 2 threads. Uses various services, including Zenarmor, a few VLANs. No problem.
In sum, just review or post your settings and we'll help you figure out the problem. Doubt is performance related.

[nero355]

I then wanted to move it to it's own dedicated hardware which is the protectli FW4B which also has intel nics and the same naming of igb0 for WAN and igb1 for LAN etc.
My VM is on version 26.1.11.

On the FW4B I installed the latest ISO I could get which is 26.1.6.
I then restored a copy of the config.xml to it.

I think that's a bad idea and also you should have done this :

I then unplugged the cables from the proxmox VM and plugged the FW4B into the same sockets.
It powered up and I updated it to 26.1.11.

First, because if I remember correctly : The installed version needs to be equal or newer than the version the config.xml file came from !!

Now is when it gets weird.

In the firewall logs I get a lot of "Default deny / state violation rule".

That Firewall Rule is always right !! ;)

IMHO your Interfaces need fixing because they are not equal between the VM and the Protectli you are using.

[Graylev]

Hi, I finally fixed it. It turns out some of the firewall rules didnt get loaded properly when I imported the config.xml. You could see the rules in the GUI and they looked totally normal but some rules weren't functioning properly or only partially. On my guests vlan one computer that had a reserved IP via DHCP worked fine while other normal DHCP users on the same VLAN could ping external IP's but not operate on something like port 443. All I had to do was to duplicate the "Allow internet" rules and put them up higher than the old rules then everything returned to normal. It's a bit odd that rules go wrong when importing. I tried the wipe/rebuild/import-config twice and it did the same thing twice. I even exported the config twice. Which VLANs it effected did change between attempts but it was the same rules. Like you I would of thought it was something to do with the interface assignments.

[nero355]

Like you I would of thought it was something to do with the interface assignments.

Could still be the case, but because of something different : Import/Restore config.xml bug that did not apply things properly to the right Interfaces :)

You could check the OPNsense Release Changes from version 26.1.2 up to 26.1.9 or so for anything related ?!