How to set up Single NIC OPNsense (26.1) with 2x TP-Link Smart Switches & Fritz!

[Vectralis]

Hi everyone,

I am a complete beginner with OPNsense and networking in general. I want to build a "Router-on-a-stick" setup using a single-NIC PC with OPNsense 26.1, but I need some guidance on the exact step-by-step configuration.

My Goal & Hardware:
- ISP: Proximus VDSL (Belgium)
- Fritz!Box 7530 (currently acting as router/modem, want to use it purely as modem).
- OPNsense PC: Has only 1 physical NIC.

Switches:
- TL-SG105E (located in the Modem Room)
- TL-SG108E (located in the Router Room)

Target Network Settings:
- OPNsense LAN IP: 192.168.129.1/24
- Fritz!Box IP (for web management): 192.168.129.2/24

DHCP Range:
192.168.129.50 – 192.168.129.254

DNS: 1.1.1.1

Physical Connection Plan:

- Inter-switch link: Cable from TL-SG105E Port 1 to TL-SG108E Port 1.

- Modem Room (TL-SG105E):
Port 2 connected to Fritz!Box LAN 1 (for Internet traffic).
Port 3 connected to Fritz!Box LAN 2 (to access Fritz!Box web GUI at 192.168.129.2).
Ports 4–5 for local clients.

- Router Room (TL-SG108E):
Port 2 connected to the OPNsense single NIC.
Ports 3–8 for local clients / APs.

My Questions:

- VLAN Tagging / Switch Setup:
How should I precisely configure the 802.1Q Tagged/Untagged ports and PVIDs on both TP-Link switches for VLAN 1 (LAN) and VLAN 10 (WAN)?

- OPNsense 26.1 Setup:
Since I am using a single physical NIC:
What exact steps do I need to take in OPNsense to set up the VLAN 10 interface for WAN while keeping the physical NIC for LAN (192.168.129.1)?
How should I configure LAN / WAN settings?

- Fritz!Box Configuration:
Is connecting two cables from the Fritz!Box to the SG105E (one for WAN on VLAN 10, one for LAN management on VLAN 1) the correct way to keep access to 192.168.129.2?

Could someone walk me through the correct sequence of steps so I don't lock myself out during setup?

Thanks a lot for helping out a beginner!

And sorry if I ask dumb questions lol

[nero355]

- Fritz!Box 7530 (currently acting as router/modem, want to use it purely as modem).

I would always replace those with a nice DrayTek : https://www.draytek.com/products/vigor166
Or whatever the latest and best option is for your xDSL connection :)

Could someone walk me through the correct sequence of steps so I don't lock myself out during setup?

You can't lock yourself out : There is always the option to connect a PC or Laptop to any of the devices directly and do whatever needs to be done ;)

It's really simple :
1. Untagged Ports are for devices like PCs/TVs/Consoles
2. Tagged Ports are for links between :
- Routers and Switches
- Multiple Switches
- Switches and Accesspoints

For your 'Router-on-a-Stick' setup I am guessing it's gonna be something like this :
- igc0 for WAN
- igc0.<pick your VLAN number> for LAN
- igc0.<pick your VLAN numbers> for additional networks.

That's about it :)

[Patrick M. Hausen]

Make that WAN also a tagged VLAN of your chosing, then connect an untagged switch port in that VLAN to the modem. If the ISP needs another tag, let the modem set it.

Don't mix tagged and untagged - especially when WAN and LAN are on the same port.

[nero355]

Make that WAN also a tagged VLAN of your chosing, then connect an untagged switch port in that VLAN to the modem. If the ISP needs another tag, let the modem set it.

Don't mix tagged and untagged - especially when WAN and LAN are on the same port.

Good point! :)

I forgot FreeBSD does not like Untagged and Tagged on the same port...

[Vectralis]

I was struggling the whole day with the vlans. So I ended up just deleting all vlans, and placed an Intel x550 T2 in my opnsense pc. Now I moved the pc to the same room where the modem (fritzbox) is located. Lan and wan are physically separated now. My whole network is already working. So that's cool. The only thing I am struggling with now is the Proximus tv and igmp Proxy. Even without the igmp Proxy plugin on opnsense the Proximus tv was just working fine while connected to opnsense lan, but the live tv and etc stutters sometimes and sometimes the view is blurry. But it's receiving something at least. Then I did some things with igmp Proxy plugin and firewall thingies, but it didn't make any difference, it didn't get worse, but it also didn't get better. Does anyone know how I can fix this so the Proximus tv is working perfectly behind my opnsense? I am 100% sure that the issue is on opnsense since Proximus tv behind fritzbox 7530 is just working perfectly as it should.