If you've been running Proxmox for a while and have a proper home lab stack — Jellyfin, Immich, Forgejo, Headscale — there's a good chance your network security looks like this: ISP router, flat LAN, everything on the same subnet. That's fine until it isn't.
OPNsense changes that. And running it as a Proxmox VM rather than dedicated hardware means you get snapshots, easy rollbacks, and no extra box sitting on your shelf. OPNsense 26.1 "Witty Woodpecker" dropped in January 2026 and it's the version I'd recommend starting with — it officially deprecates the legacy ISC DHCP daemon, ships a new Host Discovery service, and cleans up a lot of edge cases in IPv6 handling.
Here's how to set it up properly.
Why Virtualize Your Firewall?
The usual objection is that virtualizing your firewall on the same host it protects is "wrong." And in a pure security sense, that's not wrong. But for a home lab, the tradeoffs are clearly worth it:
If you're running a genuinely high-security environment, dedicated hardware makes sense. For a home lab? Virtualize it.
Network Planning Before You Touch Anything
This is where most guides skip ahead too fast. Before you install OPNsense, you need to decide how your network will be structured.
A sensible home lab VLAN layout:
VLAN 10 — Management (Proxmox, OPNsense admin, switches)
VLAN 20 — Servers (your self-hosted services: Jellyfin, Immich, etc.)
VLAN 30 — IoT (smart plugs, cameras, anything you don't trust)
VLAN 40 — Trusted clients (your main workstations, laptops)
VLAN 50 — Guest WiFi (isolated, internet-only)You don't have to implement all of these on day one, but plan for them now. Retrofitting VLANs into an existing flat network is painful.
For this to work in Proxmox, you need a managed switch that supports 802.1Q VLAN tagging. The TP-Link TL-SG108E 8-Port Gigabit is the classic cheap option — about $30, web UI, does the job. If you want something with a real CLI and better throughput, the TP-Link TL-SG2210P adds PoE and LACP.
Proxmox Network Setup
OPNsense needs at minimum two network interfaces: WAN and LAN. How you handle this in Proxmox depends on your hardware.
Option A: Two physical NICs, both passed through
This is the cleanest approach. Your Proxmox host keeps one NIC for management, and you pass through two more to OPNsense — one for WAN, one for LAN. For passthrough to work reliably you need Intel NICs. The Intel I226-V 2.5GbE NIC is what I'd use for WAN. For a PCIe slot version that works cleanly with IOMMU groups, the Intel I350-T2 dual-port is the gold standard — used enterprise cards run around $40–50 on eBay.
Option B: One physical NIC, Linux bridge with VLAN trunking
If you only have one NIC available, create a Linux bridge on your Proxmox host with VLAN-aware enabled. OPNsense gets a WAN interface and a VLAN-aware LAN trunk. This works perfectly well for most home labs and avoids needing extra hardware.
To enable VLAN-aware on a bridge in Proxmox, edit /etc/network/interfaces:
auto vmbr0
iface vmbr0 inet static
address 192.168.1.10/24
gateway 192.168.1.1
bridge-ports eno1
bridge-stp off
bridge-fd 0
bridge-vlan-aware yes
bridge-vids 2-4094Then create a second bridge for WAN that connects to your modem/ISP port:
auto vmbr1
iface vmbr1 inet manual
bridge-ports eno2
bridge-stp off
bridge-fd 0Apply with ifreload -a and don't forget to snapshot your Proxmox host config first.
Creating the OPNsense VM
Download the OPNsense 26.1 DVD ISO from opnsense.org — pick the amd64 architecture, dvd image type. Upload it to your Proxmox ISO store.
VM configuration that works well:
OS: Other (FreeBSD under the hood, but OPNsense ISO handles it)
BIOS: SeaBIOS (or OVMF/UEFI — both work in 26.1)
Disk: 16–32GB, virtio-scsi, on your fastest storage
vCPUs: 2–4 (pin to physical cores if you have them to spare)
RAM: 2–4GB (2GB is fine for basic setups, 4GB if you run Zenarmor or Suricata)
Network: Add two VirtIO NICs — one attached to vmbr1 (WAN), one to vmbr0 (LAN trunk)Start the VM, boot from the ISO, and follow the installer. The default credentials are installer / opnsense. The installation itself takes about 3 minutes.
After first boot, log in via the console and run through the initial setup wizard. Set your WAN interface to vtnet0 and LAN to vtnet1. OPNsense will assign a default LAN IP of 192.168.1.1/24 — change this if it conflicts with your existing subnet.
First Things to Configure in OPNsense 26.1
Update immediately. System → Firmware → Updates. OPNsense ships bi-weekly updates. Install them before doing anything else.
DHCP — note the 26.1 change. In 26.1, Dnsmasq is now the default DHCP and DNS provider for new installs (Kea is available as an alternative with more features, particularly for IPv6 prefix delegation). If you're migrating from an older OPNsense install, your existing ISC DHCP leases won't automatically migrate. Export them first.
Set up VLAN interfaces. Interfaces → Other Types → VLAN. Create entries for each VLAN ID you planned earlier, all pointing to your LAN parent interface (vtnet1). Then assign each VLAN as a new interface under Interfaces → Assignments. Enable each one, set a static IP (e.g., 192.168.20.1/24 for VLAN 20), and enable DHCP on each.
Firewall rules. OPNsense's default posture is permissive on LAN and blocked on WAN. For VLAN segmentation to actually work, you need explicit rules. A sane starting point:
# VLAN 30 (IoT) — internet only, no access to other VLANs
Block: source VLAN30_net → destination RFC1918 private ranges
Allow: source VLAN30_net → destination anyVLAN 20 (Servers) — allow from Trusted, block from IoT
Allow: source VLAN40_net → destination VLAN20_net
Block: source VLAN30_net → destination VLAN20_netFirewall → Rules → [VLAN interface] is where you add these. OPNsense evaluates rules top-to-bottom, first match wins.
WireGuard VPN Setup
OPNsense 26.1 includes WireGuard in the kernel by default (no plugin needed). This is how you get a proper road-warrior VPN into your home lab — useful even if you already run Headscale, since WireGuard in OPNsense gives you firewall policy control over VPN traffic that Headscale/Tailscale can't easily provide.
VPN → WireGuard → Local → Add. Generate a key pair, set your tunnel network (e.g., 10.10.10.1/24), choose a port (51820 is default), then add peer entries for each device. Under Firewall, create a rule on the WireGuard interface to allow traffic to your Servers VLAN.
For a travel router setup, you can run WireGuard on the OPNsense side and have all traffic from a GL.iNet or similar device tunnel home automatically.
Suricata IDS/IPS — Worth It at Home Lab Scale?
Short answer: yes, but configure it carefully.
Services → Intrusion Detection → Administration. Enable it on your WAN interface. For home lab use, run it in IDS mode (alert only) first — IPS mode (drop) will cause false positives that will end your evening.
Ruleset recommendation: Enable ET Open (free). Skip the paid feeds unless you specifically need them. ET Open covers the meaningful threat classes for a home network.
Performance note: Suricata needs dedicated RAM. If you gave OPNsense 2GB, bump it to 4GB before enabling Suricata. At home lab scale on modern hardware, you won't notice the CPU overhead.
The New Host Discovery Service
OPNsense 26.1 added a Host Discovery service (Services → Host Discovery) that passively watches your network and builds an inventory of connected devices — MAC addresses, hostnames, first/last seen timestamps. It's not revolutionary, but it's genuinely useful for catching rogue devices on your IoT VLAN or spotting things that should be static but are grabbing DHCP leases.
Enable it on your VLAN interfaces, not WAN.
Hardware Recommendations If You Go Dedicated
If at some point you want to pull OPNsense off Proxmox and give it dedicated hardware, these are the options I'd consider:
For UPS protection — which you absolutely need if OPNsense is your primary router — the APC BE600M1 covers a mini PC load for 45+ minutes.
Common Gotchas
The snapshot-before-changes rule. I mentioned this already but it's worth repeating. Proxmox VMs → OPNsense → Snapshots → Take Snapshot. Do this before every meaningful change. OPNsense firewall rules can make your entire lab unreachable if you get them wrong.
Proxmox management interface isolation. Your Proxmox web UI should be on the Management VLAN (VLAN 10), not accessible from the internet, and ideally not accessible from your IoT or Guest VLANs. Set this up in OPNsense firewall rules early — it's easier before you have 30 rules to navigate.
The ECDSA certificate bug with external OIDC. If you're integrating OPNsense or Proxmox with Authentik for SSO, and you see 401 errors during OIDC authentication, the cause is usually that Proxmox doesn't handle ECDSA signing certificates properly. Regenerate your Authentik signing certificate as RSA and it will work.
VirtIO vs. e1000 NICs. Use VirtIO for OPNsense VMs in Proxmox — it performs significantly better than emulated e1000. OPNsense 26.1 handles VirtIO cleanly on FreeBSD.
Don't run OPNsense on the same storage pool as your heavy VMs. If your Proxmox storage is under heavy I/O from a Jellyfin transcode or Immich ML processing, OPNsense latency will spike. Put it on a separate SSD or at minimum a different pool.
Where This Gets You
After a weekend of setup, you'll have a home lab with actual network segmentation: your IoT devices can't reach your servers, your servers are accessible from your trusted VLAN, WireGuard lets you in remotely, and Suricata is watching your WAN. That's a meaningfully better security posture than a flat LAN, and it's all running on hardware you already have.
OPNsense 26.1 is the most polished version of OPNsense to date. The deprecation of ISC DHCP, the new Host Discovery service, and the bi-weekly release cadence make it a solid long-term pick. Start with the Proxmox VM, snapshot aggressively, and add complexity (Suricata, additional VLANs, WireGuard peers) incrementally.
---
Disclosure: This post contains affiliate links. If you purchase through these links, I may earn a small commission at no extra cost to you.