OPNsense Router (GUI)

Proxmox has no web interface for port forwarding. If you want to manage port forwards, DHCP and firewall rules in a web GUI, run OPNsense (a free open-source firewall) as a VM. After a one-time setup, you never need the host's command line for networking again.

How it works

The host forwards all incoming traffic (except its own SSH and web UI) to the OPNsense VM. OPNsense then decides where it goes. Your VMs sit behind OPNsense on a new private network.

Internet
   │
YOUR-PUBLIC-IP  (Proxmox host keeps :22 and :8006)
   │  everything else
   ▼
OPNsense WAN  10.10.10.2      vmbr1
OPNsense LAN  192.168.1.1     vmbr2
   │  DHCP 192.168.1.100–200
   ▼
Your VMs (on vmbr2)

:::warning Choose one method With this setup, all port forwarding happens in OPNsense. Don't add forwards on the host as well (see Port Forwarding), because host forwards would override OPNsense. :::

Step 1: Prepare the host (one time)

:::tip Let us do it Prefer not to touch the command line? Open a support ticket titled "Enable OPNsense routing" and we'll prepare the host for you. Continue with Step 2 once we confirm. :::

Open the host shell (Node → Shell) and back up the configuration:

cd /etc/network
cp interfaces interfaces.backup-$(date +%F)
nano interfaces

a) In the vmbr1 section, add these lines below the existing ones:

    post-up   iptables -t nat -A PREROUTING -i vmbr0 -p tcp -m multiport ! --dports 22,8006 -j DNAT --to 10.10.10.2
    post-down iptables -t nat -D PREROUTING -i vmbr0 -p tcp -m multiport ! --dports 22,8006 -j DNAT --to 10.10.10.2
    post-up   iptables -t nat -A PREROUTING -i vmbr0 -p udp -j DNAT --to 10.10.10.2
    post-down iptables -t nat -D PREROUTING -i vmbr0 -p udp -j DNAT --to 10.10.10.2

b) At the end of the file, add a new private bridge for your VMs:

auto vmbr2
iface vmbr2 inet manual
    bridge-ports none
    bridge-stp off
    bridge-fd 0

danger

bridge-ports must stay none. Never add a physical network port here. See Network Rules.

Apply:

cd /etc/network
ifreload -a

Your host's SSH (22) and web UI (8006) keep working. Everything else now goes to 10.10.10.2, which you create next.

Step 2: Create the OPNsense VM

1. Download the OPNsense DVD image (.iso) from opnsense.org/download. It comes as .iso.bz2, so extract it first, or use Download from URL together with Decompression algorithm: bzip2 in Proxmox.
2. Create VM with:

Tab	Setting
General	Name opnsense, ✅ Start at boot
OS	OPNsense ISO, Guest OS Other
Disks	local-lvm, 20 GB
CPU	2 cores, type host
Memory	2048 MB (4096 recommended)
Network	Bridge vmbr1, model VirtIO

3. After creation, add the second NIC: Hardware → Add → Network Device, bridge vmbr2, model VirtIO.

Step 3: Install OPNsense

1. Start the VM and open Console.
2. Log in as installer / opnsense and follow the installer (ZFS or UFS, either is fine). Set a strong root password.
3. After the reboot, log in as root and use the console menu:

Option 1, Assign interfaces:

Interface	Device
WAN	vtnet0 (on vmbr1)
LAN	vtnet1 (on vmbr2)

Option 2, Set interface IP address:

	WAN	LAN
Method	Static (no DHCP)	Static
IP	10.10.10.2/24	192.168.1.1/24
Gateway	10.10.10.1	none
DHCP server	—	✅ range 192.168.1.100 – 192.168.1.200

Step 4: Open the OPNsense web GUI

You reach the OPNsense GUI through an SSH tunnel via the Proxmox host. It's never exposed to the internet.

4.1 Temporarily allow access. OPNsense blocks GUI access on WAN by default. In the OPNsense Console, choose option 8 (Shell) and run:

cd /root
pfctl -d

This disables the packet filter until the next rule change or reboot.

4.2 Open the tunnel from your own computer:

cd ~
ssh -L 8443:10.10.10.2:443 root@YOUR-PUBLIC-IP

Keep this session open and browse to https://localhost:8443. Log in as root with the password you set during install.

4.3 Run the setup wizard:

• WAN: uncheck "Block private networks" and "Block bogon networks". The WAN uses a private address, and leaving these checked blocks your traffic.
• DNS servers: 1.1.1.1, 8.8.8.8

4.4 Move the GUI off port 443 so 443 stays free for your websites: System → Settings → Administration → TCP port: 4443 → Save.

4.5 Allow permanent GUI access via the tunnel only: Firewall → Rules → WAN → Add

Field	Value
Action	Pass
Protocol	TCP
Source	Single host 10.10.10.1 (the Proxmox host)
Destination	This Firewall
Destination port	4443

Save and Apply changes. This re-enables the packet filter.

From now on, reach the OPNsense GUI with:

cd ~
ssh -L 4443:10.10.10.2:4443 root@YOUR-PUBLIC-IP

…and open https://localhost:4443.

Step 5: Connect your VMs

Create VMs as usual, but select bridge vmbr2. They receive an address automatically via DHCP (192.168.1.100+). For servers that receive port forwards, set a static DHCP mapping in OPNsense (Services → DHCPv4 → LAN → Static mappings) so the address never changes.

Step 6: Port forwards in the GUI

Firewall → NAT → Port Forward → Add

Field	Example: web server
Interface	WAN
Protocol	TCP
Destination	WAN address
Destination port range	HTTPS
Redirect target IP	192.168.1.10
Redirect target port	HTTPS
Filter rule association	Add associated filter rule

Save, then Apply changes. Done, and no host access is needed.

note

OPNsense sees all incoming connections as coming from the internet as usual. In OPNsense's logs, the destination appears as 10.10.10.2, which is expected.