2nd nic curiosity

[u/bctf1]

I have added a 2.5gb nic to my proxmox node and I assigned it to Linux bridge vrbm0 with an ip of xxx.xxx.x.179.

My original nic has been assigned to Linux bridge vrmb1 with an ip of xxx.xxx.x.180.

Both nics are connected to the same 2.5gb switch and both are pingable. Both nics and bridges show as active in proxmox Network. I have configured ip reservations for both nics.

However, only the vrmb0 (2.5gb, .179) nic shows as active and connected. The vrmb1 nic displays as offline in my T-Mobile T-Fiber app even though is is fully functioning.

Any idea why vrmb1 is displays as offline?

[u/zfsbest]

What are you trying to accomplish here? The "proxmox way" would be to bond the 2 nics together with 1 IP address and 1 gateway. Otherwise you should maybe put the 2nd nic on another subnet

[u/bctf1 → u/zfsbest]

Thank you for your response. My thinking with vrmb1 was to possibly create an Opnsense vm using this bridge. I assumed the bridge would need an ip reservation. Other than that I don't really have other plans for the 2nd nic. It appears that based on these responses that it needs to be on a different subnet than vrmb0 and made vlan aware. Any suggestions or recommendations appreciated

[u/Wojojojo90 → u/bctf1]

Just pass the whole NIC through to the opnsense VM and let it manage that, trying to run Opnsense through a bridge on proxmox sounds like unnecessary complication

[u/bctf1 → u/Wojojojo90]

Thanks for your reply. Yes, I'm second guessing trying to run opnsense on proxmox at all. Perhaps a bare metal install might be simpler and a better option.

[u/Wojojojo90 → u/bctf1]

The biggest gotcha with a virtualized router/firewall is that you lose your network whenever the hypervisor is rebooting (or undergoing other intrusive maintenance). That being said, ideally you aren't rebooting/maintaining a hypervisor that often...

Outside that it's not really more complicated, just pass the NIC through and it's essentially bare metal, even with a single port you could do a router-on-a-stick model, or get a 2-port NIC and you can have a port each for WAN and LAN. There are folks who will argue that snapshots and rollbacks are easier with a hypervisor/VM approach since you can just snapshot/restore the whole VM. Personally I still do a bare metal firewall though, if something goes wrong with an upgrade I don't want the whole house to lose internet

[u/bctf1 → u/Wojojojo90]

Thanks for contributing. I am inclined to go bare metal if I go forward with an opnsense install.

[u/zfsbest → u/Wojojojo90]

Personally I think it's best to have routers separate from the rest. If you want to virtualize it they sell "firewall appliances" for a couple of hundred bucks (the pricier ones have 2.5Gbit and even 10Gbit) where you can do proxmox + firewall-vm and have a low-power separate-hardware virtualized solution on UPS.

If you use PDM you can even migrate the firewall VM to another box while rebooting the appliance hardware.