Fully support using opnsense buuut pfsense has a good guide for doing this exact thing. It works really well.

https://docs.netgate.com/pfsense/en/latest/recipes/virtualize-proxmox-ve.html

People recommending against proxmox don’t understand how good zfs is, but their points are valid for this being a sole point of failure. I virtualize pfsense to gain cluster advantages but tend to leave not too much else on that box.

If you don’t pass through the card the VM can more easily be restored to dissimilar hardware. But those ports are dedicated to the pfsense/opnsense VM, leaving the single free port for proxmox management and VMs. I would enable VLANs for network segments but if you either don’t have switches that support tags or are new to all of this it’s going to be WAY less headache to just use it all untagged for now. (Spend time on funner things, seriously!)

Have done something similar, you’ll discover the joy of have no internet while you do server maintenance, upgrades or disaster recovery and worst case, hardware failures.

Having internet and filesharing on one nic means internet will suffer while the nic is saturated.

Ensure your other VMs are adequately delayed at initial boot, as that can cause weird things that need DHCP to be available

Otherwise I never had issue running the router as a VM.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

8 acronyms in this thread; the most compressed thread commented on today has 9 acronyms.

[Thread #39 for this comm, first seen 3rd Jul 2026, 11:10] [FAQ] [Full list] [Contact] [Source code]

I have this setup. Upfront, I would not recommend Proxmox, the update methods are annoying. The better way is straight Debian with Incus installed, then you get straightforward stable Debian updates automatically - they won’t break anything and you’re secure. Sometime I’ll redo it - I haven’t because, of course, it is my router and when its down I don’t have internet! So foreboding and on the back burner.

Also also Proxmox’s GUI leaves a lot to be desired (for me, it looks like ass and is confusing), Incus is nicer for VM control and Cockpit is nicer for host control. After typing all that I realize I’m a hater at this point

I haven’t really noticed downtime issues cause of Proxmox updates cause I just do it when nothing is happening. And Proxmox hasn’t bricked itself, though I am wary of it because that has happened to others due to their rolling release update style.

I’ve got a Dell Wyse 5070 Extended with a 2 port Intel NIC in it. I pass both ports through leaving the built-in port for managing Proxmox.

Here are my notes:

Set NIC PCIe Passthrough for Network Card

nano /etc/default/grub

• Edit this line by adding intel_iommu=on to get

GRUB_CMDLINE_LINUX_DEFAULT="quiet intel_iommu=on"

update-grub

nano /etc/modules

• Add these lines

vfio  
vfio_iommu_type1  
vfio_pci  
vfio_virqfd  

update-initramfs -u -k all

reboot

Click on 2nd level thing named router on the left side vertical bar hierarchy thing and then click in the top right the blue Create VM button.

• General tab
  • Name: OPNsense
  • Start at boot: checked
  • Start/Shutdown order: 1
  • Startup delay: 15
• OS tab
  • Use media: DVD version (usb might work) of OPNsense.iso
• System tab
  • Machine: q35
  • Bios: OVMF (UEFI)
    • Storage: local-lvm
    • UNCHECK Pre-enroll Keys (HATE)
• Hard Disk tab
  • Disk size (GiB): 15
  • Discard: checked
  • SSD emulation: checked
• CPU tab
  • Cores: 4
  • Type: host {makes it not moveable between diff CPU types but will theoretically allow for more speed}
• Memory tab
  • Memory (MiB): 2048
  • Minimum memory (MiB): 512
• Network tab
  • No network device: checked
• Confirm tab
  • Do not start on creation
• After creation, go to Hardware tab in the 2nd left vertical list on the browser page and click add
• Click PCI Device
  • Device: ...01:00.0 I350 Gigabit... & ...01:00.1 I350 Gigabit... (1st & 2nd ones)
  • PCI-Express: checked

Go to the Console tab in the 2nd left vertical list on the browser page and hit enter to get to a command line in the OPNsense VM

!Add expand storage via command line!

And lastly, during setup I have these notes

It will choose wrong (WAN gets igb1 and LAN gets igb0 -> we want WAN gets igb0 and LAN gets igb1)  
Default User: root, PW: opnsense (they don't tell you anywhere, you don't have internet b/c this is your new router, fuck em)  
**Access at 192.168.1.1 via pluging an ethernet cable into the 1st port in a set of forwarded ports**  
*Note that we will move it so the 1st port is the WAN (can't access OPNsense from the WAN port for safety), so after following this you access via 2nd port*  

So watch out for those things. Not sure quite what I mean by the 1st and 2nd port things, may be related to on setup it had the order of the ports I wanted wrong so they’re switched till setup is complete and it reboots.

I don’t remember doing this at this point, but maybe this info dump will help!

I personally would not recommend this setup as any issue with your proxmox cluster will turn into a network issue.

Instead, I would purchase a cheapish router that can run OpenWRT. If you are dead set on OPNsense you can find x86 boards from various vendors or you can make a dedicated router out of a network card and a small form factor computer

I have been running PfSense on Proxmox for ages now.

What I do is the following.

1. Pass the NIC card through to PfSense.
2. Your motherboards ethernet port is plugged into your network switch (think of proxmox as just another pc on your network)
3. In PfSense your NIC can now be seen and all ports can be assigned as needed. Assign one as WAN and the others as LAN.

Set your pfSense /OPNsense to start at boot when you power on proxmox.

FYI, you might occasionally run into issues where the NIC “GUID” changes so your VM won’t be able to start.

When this happens your pfSense/OPNsense VM won’t start so your network will be in a “down state”. This means DHCP won’t be working either, and any PC that were not assigned a static IP won’t be able to access the Proxmox GUI to quickly fix the issue.

You might occasionally need to hook up a temporary router between a PC and your Proxmox host to access the web GUI as a result. At least this is what I do when my outrage is longer then a hour.

I did the same setup except I used pfsense and a Dell.

I wouldn’t recommend it at all. Want setting change that requires a reboot from proxmox would result in a total lots of the network. The weakest link is settings based.

I can’t begin to tell you the amount of times this happened to me that I went out and bought a Intel NUC and put the pfsense on bare metal.

The way I would do it is this (assuming this VM is going to act as your main router):

Connect eth3 to your switch, set up proxmox with that as your management interface. Create the OPNSense VM and pass through the NIC, make sure you remove the one it automatically creates. It will either prompt you to set one port as WAN and one as LAN, or if you connect one port to your upstream connection it should autodetect that as WAN and assign the other as LAN. Finally, connect the LAN port to the switch as well; it won’t cause a network loop because eth3 isn’t bridged with either of the others (it can’t be, because the host can’t see a PCIe device being passed through to a VM).

With this, you can always access the proxmox host via eth3, so no matter what happens to the OPNSense VM you can still access the host. Just make sure that the OPNSense LAN subnet overlaps with the IP you set in Proxmox - since it’ll probably be statically set, not DHCP, it won’t automatically pick up an IP in the LAN subnet.

Enable pci passthrough for the card, use the onboard interface for proxmox management. It will only cause a loop if you bridge the interfaces or enable routing in proxmox, which is really hard to do accidentally. Don’t worry about it too much. Even if it happens, just unplug one of the connections and reboot the switch, then go back in and fix it.

The way you plug a VM into proxmox is with a virtual switch, bridge devices do they or the SDN stuff. I’ve played SDN yet so not sure how that works, but I do run bridges.

I would make 2 bridges, br0 and br1.

Br0 is the wan side of opensense, br1 is the Lan side.

Don’t add any IP to either, add an IP to the last nic as a management port.

Now plug your VM into the bridge devices.

There’s a few things we don’t know here.

• Are you hosting more VMs on Proxmox that need network via a virtual switch?
• Are you providing network to other physical devices as well via a switch, so you need to output to that?
• Do you want OPNsense to be your gateway and assign IPs, or do you have a router?
• As you have 3 NICs and sound like you want to use them, let’s assume you aren’t doing RoaS, but this could all be done on one (very busy) NIC.

There’s nothing wrong with your plan, but that’s not how I would do it.
I don’t pass through NICs. I bond them or I bridge them.
In a virtual world, this sort of task is done with virtual switches. OVS switches at my job.
OVS is a lot easier to use than oldskool linux bridges that come installed with Proxmox. There’s already a dropdown in Network where you can build with OVS objects, but you need to add the package.
apt install openvswitch-switch

• MGT. For your setup, I might consider (the onboard!) eth3 as my mgt NIC. That might be handy some day if you have to remove that card. Your server will still be online.

• DMZ WAN. I would run the WAN line straight to eth1. Add eth1 to a ‘dmz’ virtual switch. Add the OPNsense WAN leg to this dmz virtual switch, so the OPNsense (and nothing else) can directly talk to the upstream router.

• LAN Virtual. Create a ‘protected network’ virtual switch. Add the OPNsense LAN leg to this virtual switch. VMs can be a member of this downstream protected network and access any services provided by the OPNsense.

• LAN Local. If you need to share the OPNsense protected network back out to other devices, add eth2 to to the protected network switch, and ethernet cable out from eth2 to a dumb switch. Plug other external devices into the dumb switch, and they will be downstream from and protected by your OPNsense, accessing its services.

Feel free to ignore me here. I build a lot of big things, so I use enterprise-scale techniques. There’s nothing wrong with your pass-through plan.
And … you can do this! I have a somewhat similar setup on my laptop with HyperV, so I can distribute wired (work VPN) and wireless (everything else) internet to guest VMs and the main OS. I made two virtual switches in HyperV.

• The first switch gets exclusive access to my NIC attached to my VPN device. This is the OPNsense WAN leg.
• The second switch is the OPNsense LAN leg and VMs are members.

Good luck!

You cannot pass the nic through and still use it in proxmox - it loses all access to the nic. So if you want to go that route I recommend you to use eth3 as dedicated port for proxmox.

For (2) - affected in which way? Compared to which baseline? Are you concerned that your machine cannot keep up with 320Mbps? I doubt that.

For (3) - depends on your local network setup. Do you use vlans that need routing? Then it goes via OPNsense. Otherwise if all devices are in the same subnet, it likely will not.

For (5) - no loops. You’re not routing traffic between eth3 and eth2.

Don’t dedicate your nics. Use vlans and trunk ports.

Create a wan vlan. Create a lan vlan.