PfSense seems to be behaving unexpectedly. Need guidance to resolve the issue.
PfSense seems to be behaving unexpectedly. Need guidance to resolve the issue.
I recently got a 2U server blade equipped with two 10-core Xeons, 64GB RAM, 2.5TB SSDs, dual redundant 900W power supplies, four RJ-45 NICs (excluding IMM), and I was planning to build my ideal server setup. However, I'm facing some challenges. My goal is to run Linux Mint as the host OS for VMware Workstation Pro 16, hosting VMs for pfSense, OpenVPN, Home Assistant, Plex, and Media Server. Currently, I’m having difficulty getting Mint to connect to the internet via pfSense. I can ping the default gateway in CLI, WAN, and LAN settings, but pfSense can reach Cloudflare’s DNS (1.1.1.1), yet I can’t access the Webconfigurator or open a site in Firefox. I’m fairly sure my VMware network configuration is correct, but I’m not entirely confident on subnet settings or other details. My main worry is that my network configurations for both Mint and pfSense might be off. I’ve changed default gateways, enabled/disabled DHCP, restarted the modem, but the issue persists. I feel uncertain about whether I made any mistakes. Please don’t hesitate to ask simple questions—I may sound a bit unsure, but I’m trying my best. My experience suggests I should be competent, yet I’m not sure if my setup is optimal.
I wouldn’t rely on virtual networking… I’d connect a dedicated NIC straight to PFSense and use that. This is exactly how I do it—it functions flawlessly and is straightforward. Running virtual NICs adds unnecessary complications. Also, why not leverage a specialized hypervisor? I’m sure Mint can handle it, but it isn’t designed for that purpose. Anyway, for my configuration, I placed PFSense inside a VM running Proxmox. I set up a quad Intel NIC (just need a dual-port setup… but had a quad available), routed the NIC through, configured EM0 as WAN, EM1 as LAN, applied simple allow rules, transferred the WAN cable from the modem into PFSense’s EM0, moved the LAN cable to my first switch into EM1. And that’s it—a fully virtualized router. Obviously, there are many more settings and firewall adjustments needed to make a homelab functional, but that’s essentially all you need to get started. Using a dedicated NIC simplifies things because it makes the VM operate like a bare metal device. There’s no extra confusing layer or complexity in my setup—it behaves exactly as if it were on physical hardware. The only exception occurs when the server encounters a problem and I’m stuck in Proxmox; then I can manually connect my laptop to a static IP on the management subnet and plug it directly into the servers (not through the quad NIC, but via the LAN port on the motherboard next to the cable from the switch to the quad NIC for PFSense). This lets me manage Proxmox without affecting the network’s availability.
I considered it too, particularly given this blade's internal hypervisor USB port and its dedicated hypervisor boot feature that works with certain VMware tools. I'm new to virtualization, especially setting up NICs without going virtual. Your question about not virtualizing the NIC isn't clear—am I misunderstanding? Check my attached photo for details. Also, keep in mind the IP addresses may have changed since then.
Hypervisors are quite straightforward; I’d check out Proxmox. It’s free and built on Debian with QEMU, featuring a user-friendly interface meant purely for running VMs and LXC containers. You don’t need a dedicated NIC unless you’re routing traffic through a physical device. I use a dedicated PCIe NIC on my server, and within Proxmox I assign it solely to pfSense. This gives pfSense direct access to that NIC, eliminating any virtual network complications. From there, I connect a LAN cable to a switch, then back to the server’s Ethernet port on the motherboard. That port then supplies virtual networking to all hosted VMs. The key point is that pfSense itself doesn’t handle virtual networking—it has its own dedicated hardware card. This simplifies everything, making it feel like pfSense operates independently as a bare metal system.
Additionally, consider installing Proxmox on an SSD rather than a USB drive—it runs as a full operating system, not just booting in RAM. It uses Debian, which is straightforward to install. While it’s possible to use apt to set things up, it’s usually better to stick with the base OS because the virtual machines are meant for heavy use. The VM environment should be kept as clean as needed, allowing maximum performance and stability.
Thanks for your feedback. I see now why you were concerned about the NICs. It seems I didn’t fully grasp the impact of losing two Ethernet ports. With the ports available on other network devices—like two switches and an old router I’ll repurpose as an AP—it shouldn’t be an issue.
It’s merely an additional port. If you handle it correctly, one Ethernet cable will connect your server to a switch handling all physical traffic. From the hardware side, there’s a wire from pfSense to the switch for traffic needing firewall decisions, and another returning wire from the switch to your host for data going to or from the VM (excluding the pfSense VM itself). This layout simplifies things. If you ever need a quick fix, you can simply plug that quad NIC into any PC, install a small pfSense drive, upload the XML backup, and your network is back up. With virtual NICs, re-deploying becomes difficult after hardware issues. As you configure more VLANs, this approach grows increasingly practical and less complicated.
Well, actually, I might be misinterpreting things. Those ports aren't separate cards—they're included in the motherboard. Unfortunately, it doesn't offer much flexibility compared to what you described.
I get it. You’d like to purchase a PCIe NIC and integrate it into the setup, routing it through the pfsense VM as I outlined for your needs. Of course, it’s not mandatory—you can handle everything virtually—but doing it this way makes the process significantly simpler. https://www.ebay.com/itm/324404676198?mk...media=COPY Please remember to quote me (or anyone) so they know you responded.
Also, I think it would be simpler to lock everything in. For a fully virtual setup, I’d suggest using VLANs… you’d need a WAN VLAN so only WAN traffic flows through a VLAN from the modem into the hypervisor, then pass it via the hypervisor into PFSense as a tagged VLAN (WAN), and set up another VLAN for LAN to send traffic out to the rest of the physical network. I guess that’s the idea. I haven’t tried this all virtual, but I’m pretty sure you’d need managed switches for VLANs.