pfSense on PROXMOX with HomeAssistant
-
@bearhntr maintain a backup router for when Proxmox fails. It just needs to provide minimal functionality to restore & debug Proxmox during fault conditions so an old multifunction router should be adequate.
-
Took me some time...
...and lots of help from the Internet.I have a pfSense installation in Proxmox 7.2-7 and everything appears to be working.
Just a shout-out to all the helpers:
-
@bearhntr Regarding wifi AP. Since pfsense is not recommended for wifi duties due to the lack of supported hardware in FreeBSD, you might consider an OpenWRT x64 VM or container now you are successfully running Proxmox. I thought about that and had it running for a short while. However the wifi hardware I used was not equal to the performance of my old router. So now I continue to run the old router as AP only using freshtomato on an RT-N66U which provides for vlans.
The all in one idea appealed to me. However it is hard to find wifi hardware to compete with dedicated APs and it can make siting antenna inconvenient. -
Thanks for the idea -- did some googling and got some reading to do this weekend.
-
So -- I did get this all working. It is nice. 2 questions:
-
I would like to think about moving this to my new Proxmox box - much more RAM and better CPU than this HP ThinClient. Suggestions on best method? (I was thinking a BACKUP then restore on new install??)
-
Looking these OpenWRT on Proxmox instructions. Ever done that?
-
-
@bearhntr said in pfSense on PROXMOX with HomeAssistant:
moving this to my new Proxmox box
I assume you have now installed pfsense on different hardware bare metal and got that system running and would now like to move pfsense to your Proxmox sever.
If so, well done, you have done the hard bit as you have pfsense working and have a backup system.
Next steps
- Create a VM on Proxmox. You will need to think about how WAN get into Proxmox and LAN connection(s) get out of Proxmox
- Install pfsense on that VM
- Import the pfsense configuration from your other installation
- Reassign NICs
-
Nope -- pfSense is running on Proxmox on my HP t620+ ThinClient where it was bare-metal.
The system has onboard NIC - which took me forever to get working as the 'mgmt port' for Proxmox, and a 4-port NIC in the PCI Slot. Port 0 on there is the WAN and Port 3 is the LAN port which connects to the ORBI (in AP mode) and everything is working.
I had ordered an HP Z240 SFF machine - which finally arrived. The RAM for it should be here today (64GB) and I would like to move the pfSense from the Proxmox it is on now - to the new one. I am very familiar with VMware ESXi and moving things many times requires a tool to move the VMs to another host. I am hoping this is easier in Proxmox.
If it is just as simple as making a BACKUP and then a RESTOR - should be easy enough...as I am planning on moving the 4-port NIC to this new Z240.
-
Thanks for the assist. So I think I have one more final question.
Do I have to have 3 physical NICs (one of for the Proxmox management port, one for WAN and one for LAN)?
I ask - because I ran a script to install HomeAssistant in Proxmox, and it installed - with no errors and it started up - it got a DHCP Address from pfSense and I could access the web page for it. When I looked...it had grabbed the NIC that I have configured as vmbr0 (my management port).
-
- pfsense will see the virtual NICs you set up in Proxmox.
- If you want pfsense to work with a saved configuration, the VM will need to have the same number of virtual NICs as your saved configuration.
In summary
- if you want your pfsense VM to use a Management lan then you will need to provide one.
- If you want your pfsense VM to use vlans you will need to ensure the virtual NIC support vlans or use NIC pass through (as I do).
-
Thanks for the reply. Yes. I understand that I have to setup vmbr# for the ports I want to use in pfSense. I am not using VLANs.
Currently in Proxmox - I have 3 of the 5 ports in this computer setup with vmbr0, vmbr1 (WAN), vmbr1 (LAN). The vmbr0 I set a static IP to be the mgmt port for Proxmox.
What I am questioning is...do I have to do that?
Currently there is a ETH from the modem into the WAN port - it is DHCP and gets IP from ISP.
The LAN port has an IP set to it from within pfSense (statis IPv4 and for DHCPv6 as Track Interface (pointing to WAN)) and it gets an IPv6 from there. There is an ETGH cable from there into my wireless AP (the old WAN port there). It used to be my Router, now in AP mode.
From one of the other ports, I have ETH cable plugged into the 3rd (mgmt) port on the Proxmox. What I am wondering -- is this required?
-
@bearhntr
The vmbr are effectively virtual Ethernet switches, so can be used similar to a hardware switch.
I would normally connect the Proxmox management interface to my lan. This can be done using the internal vmbr switch or externally using a hardware switch.Note if you use pass through (like I do) there in no internal Proxmox virtual switch.
-
You could use the LAN bridge to manage Proxmox. My Proxmox host here only has one NIC and it's not a problem. You would want at least two if you're using it to host your main firewall though.
Steve
-
Makes a little more sense. I am not understanding best way to do this. As the PC has 5x NICs (one on the system board and a 4-port PCI card). As I read what you are saying I would only need to setup/use 2 of them (total)?
How would this work to do the install? Plug the ETH into the on-board NIC - then install Proxmox? That MAC currently has a DHCP reservation in pfSense (to get 192.168.10.252) --- but since pfSense is currently "ON" this Proxmox as a VM - not sure how I make the change. When I installed Proxmox - I set this NIC to be vmbr0.
As in pfSense I used 2x of the NICs on the 4-port and one is WAN (connects to cable-modem) and is vmbr1 in Proxmox and another one as vmbr2 (the LAN port in pfSense -- this one I set in pfSense to be 192.168.10.254).
-
@bearhntr said in pfSense on PROXMOX with HomeAssistant:
When I installed Proxmox - I set this NIC to be vmbr0.
Then make vmbr0 the LAN bridge. Change the pfSense LAN NIC to use that instead of vmbr2.
Or just add a management IP in the LAN subnet to vmbr2 and access proxmox there. Then do whatever with vmbr0 and the port attached to it.
When you're running the edge. firewall as a VM though it's always a bit of a chicken/egg situation.
-
Something may not be right - as when I create a new VM, I do not seem to have anything but the vmbr# that I created.
This what I see in networking:
-
Not sure what you mean. I see 3 bridges shown.
If you simply add an IP address on vmbr2 in the pfSense LAN subnet can you access Proxmox on that IP?
-
If you have already created your pfSense-VM. Click on it in the management interface in Proxmox, click Hardware and see if there are any interfaces assigned to it in the list. With your setup you should have vmbr1 and vmbr2. If not, and it's ok to create a VM without any network interface, then you can add as per the following procedure.
Click Add -> Network Device at the top menu under hardware.
In the box that appears you have a similar drop down as in your picture above where it sais Bridge: vmbr0. Click the drop down and you should see all bridges available through Proxmox. Select vmbr1 and click OK (uncheck firewall perhaps).
Then do the same thing again but this time select vmbr2.Restart the VM and you should now see both interfaces in pfSense.
-
Yes - as when I was building the VM - when I got to Network - there was nothing showing. I had to create the bridges to see the NICs. Unless I need to change something in Proxmox.
-
-
