OPNsense, Isolated management interface

OPNsense configuration wizard

OPNsense LAN is by default at the subnet 192.168.1.0/24 therefore you will be provided an IP from that range. After connecting a wire to the LAN port, write https://192.168.1.1/ in the browser.
This first time that OPNsense GUI is accessed it will ask to run the configuration wizard. This procedure will be used to set the initial configuration.

On the general information a hostname must be selected, for the DNS servers I have selected OpenDNS IPs 208.67.222.222, and 208.67.220.220, keep the rest of the fields as they are.

Leave the time-server hostname and timezone as they are filled and move to the next screen.

As there is a DHCP server enabled on the ISP router there is no change on this screen.

Leave the LAN as default too, as later on it will be modified.

Now the firewall will set the configuration accordingly and restart the necessary processes.

On the Proxmox console the LAN now has the correct subnet.

Don't plug the LAN to your subnet, or you will have two DHCP servers at the same time. You may end without network connection till you disconnect it.

OPNsense third interface for management on Proxmox management subnet

Now the OPT interface and LAN interface has to be swapped.

Disable the DHCP on the LAN interface. Go to Services > ISC DHCPv4 > [LAN] and uncheck the Enable tick.

Add the vmbr0 network to the OPNsense vm.

From the OPNsense GUI go to Interfaces > Assignments and add the newly added interface. Add a comment indicating is the new LAN for VMs interface. I used VMs_LAN

On OPNsense go to Interfaces > [LAN]. Check Prevent interface removal, and on IPV4 Configuration type select DHCP. Save and apply the changes. Now the LAN is waiting to get a DHCP IP. Now on the PVE console you need to reassign the interfaces.

To reassign the interfaces login with the root user and press 1. Skip with n the LAGGs and VLANs configs. Fill the interface name for WAN, LAN, and OTP1. This time you have to switch the Proxmox Linux Bridge for management vmbr0 with OPNsense LAN interface.

As the lan is expecting for an IP from the DHCP the management router will allocate an IP for the LAN and the VMs_LAN interface will become the interface for the VMs. This allows us to control the firewall from the LAN.

To login now you have to reconnect your computer to the management subnet. On the console of Proxmox your new assigned IP for the LAN should be displayed. If it does not get an IP directly restart the services using the option 11.

Now go to Interfaces > [VMs_LAN]. Enable and check Prevent interface removal, and on IPV4 Configuration type select Static IPv4. Scroll down a bit and on IPv4 address fill the field with 10.0.1.1 and 24 for the mask. Save the changes and apply the configuration.

Apply the changes after saving the configuration.

Now we have to enable the DHCP in the VMs_LAN subnet if we don't want to configure each IP statically for each VM.

Go to Services > ISC DHCPv4 > [VMs_LAN] check Enable and fill the range according to your needs.

Reboot the router.

While trying to find ways to isolate OPNsense GUI on an interface I found that using OPX instead of LAN interface proved to be problematic.

The Interface swap feels like is not the appropriate way to do it, but it does the job.

We still need to add several firewall rules to allow the VMs to reach the public domain but protect the firewall GUI from internal VMs access.

Go to Firewall > Rules > VMs_LAN and press the + button

After this rules the VMs will be able to resolve the DNS queries and access the public domain. Ping to the firewall has been added for debugging purposes and NTP queries have been allowed as well. All the rest connection have been rejected on the last rule by allowing everything not targeting the router.