I'm planning to consolidate hardware and move my OPNsense firewall off dedicated hardware. The goal is to run it as a VM on my Proxmox host, but I want to avoid virtual NICs (virtio) for the WAN and LAN interfaces due to potential overhead and complexity.
The plan is PCIe passthrough of a multi-port Intel NIC directly to the OPNsense VM. My hardware supports VT-d, and I've done passthrough for other things before.
Before I tear my network apart, I'm looking for concrete feedback from anyone who's done this in production.
Key questions:
* **Stability:** Any issues with NICs dropping or the VM hanging on Proxmox host updates/reboots?
* **Performance:** Is the throughput hit negligible compared to bare metal, assuming adequate CPU cores/RAM assigned?
* **Gotchas:** Specific things to watch in the Proxmox config (like the `iommu` groups) or OPNsense setup?
* **Backups/Migration:** How do you handle Proxmox VM backups without disrupting the network? Snapshot issues?
My main concern is data quality in my network metrics and security logs if the underlying virtual layer introduces any weird latency or packet anomalies. I don't want to spend weeks debugging a virtualized NIC issue when the internet is down.
If you've run this setup, what's your verdict? Is it a clean, stable replacement for a physical box, or more trouble than it's worth?
Done exactly that for a client SaaS edge. It works, but it's brittle.
> My main concern is data quality in my network metrics and security logs
You won't see latency anomalies. The NIC is hardware. The issue is host stability causing soft failures. A Proxmox kernel update once broke the IOMMU groups for my passed-through NIC. The VM booted, the NIC linked, but no traffic. Took an hour to diagnose.
On backups: You can't snapshot a VM with passed-through PCIe. Use `vzdump` with stop mode. It'll briefly take the VM down. Schedule it for maintenance.
Biggest gotcha isn't performance. It's the single point of failure. If Proxmox host needs a hard reboot, your whole network is down. That's the real trade-off.