Proxmox All-in-One

pfSense

• Install pfSense (a link)
  • Set up a second network bridge internally (& give it a secondary physical NIC if you have one)
  • Build the pfSense VM
    • 8GB drive, 4 cores, 4096MB RAM
    • Add a second network device (on the second bridge... duh...)
  • Do a BACKUP
  • Open the VM console & pretend you're building a normal pfSense router
  • Once the VM is booted into pfSense...
  • Do a BACKUP
  • Then move on to:

Management VM

• Pick your favourite OS & build a VM (Or... Ya know... Since ya gave that second network bridge a physical NIC (Ya did, right?)... You could just plug a computer in there.)
  • Point its network device at the second network bridge
  • Sign into https://192.168.1.1 (from the Management VM)
  • Go into Services / DHCP Server / LAN
    • Under Servers, add in your DNS server(s) address(es)
  • Restart networking on the Management VM
  • Feed access to this VM through the pfSense firewall
• & continue messing with pfSense
  • Do a BACKUP

Taking it LIVE

Here's where things get a bit fugly...

Up to this point, your server works fine on an internal network. Unfortunately, as far as the world outside the box is concerned, there are 2 machines there. The Proxmox install AND a pfSense install. They both show up on the network.

So...

Let's fix that.

1. Swap all of the network connections on all existing VMs
   • Go into the Hardware tab for each VM...
   • edit any Network Device(s) they have configured...
   • basically, swap them to the opposite Bridge (vmbr) from what they currently use.
2. SSH into Proxmox & change vmbr0 back to static
   • Give it the IP address your pfSense VM should be assigning it & the IP of the pfSense VM as its gateway.
   • Example here:

auto lo
iface lo inet loopback

iface eno2 inet manual

iface eno1 inet manual

auto vmbr0
iface vmbr0 inet static
	address 192.168.1.2/24
	gateway 192.168.1.1
	bridge-ports eno1
	bridge-stp off
	bridge-fd 0
#Internal Network (+ Eth0)

auto vmbr1
iface vmbr1 inet manual
	bridge-ports eno2
	bridge-stp off
	bridge-fd 0
#InterWebs (Eth1)

1. • It'd be a good idea to edit /etc/hosts to match the new address.
   • Example Here:

127.0.0.1 localhost.localdomain localhost
192.168.1.2 pve.tinkernet.ca pve

# The following lines are desirable for IPv6 capable hosts

::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts
root@pve:~# 

1. Switch the physical network cables.
   • If NIC #1 is currently plugged into your network, swap it for NIC #2 (or whichever NIC you set your second bridge up to use...)
2. Reboot the machine.