Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/community-scripts/ProxmoxVE/llms.txt

Use this file to discover all available pages before exploring further.

Network appliance VMs provide enterprise-grade routing, firewall, and network management capabilities within Proxmox VE.

​
Available Network Appliances

OPNsense

Advanced firewall and routing platform

OpenWrt

Powerful wireless router firmware

MikroTik RouterOS

Professional router operating system

​
OPNsense Firewall

OPNsense is an open-source firewall and routing platform based on FreeBSD, offering enterprise features. Script: opnsense-vm.sh 
bash -c "$(wget -qLO - https://github.com/community-scripts/ProxmoxVE/raw/main/vm/opnsense-vm.sh)"
1

Run the Script

Execute the command from Proxmox VE shell.
2

Configure Network Interfaces

The script creates:
  • WAN interface (first network device)
  • LAN interface (second network device)
You’ll configure which Proxmox bridge each connects to.
3

Set VM Resources

Configure:
  • VM ID
  • Hostname
  • CPU cores (recommended: 2-4)
  • RAM (recommended: 2-4 GB)
  • Disk size (recommended: 16-32 GB)
4

Complete Installation

Access OPNsense console to finish setup.

​
OPNsense Features

  • Stateful firewall
  • VPN (OpenVPN, WireGuard, IPsec)
  • Intrusion Detection/Prevention (IDS/IPS)
  • Traffic shaping
  • Web proxy with caching
  • Load balancing
  • High availability
  • Multi-WAN support
  • Plugin ecosystem

​
Initial OPNsense Setup

Username: root
Password: opnsenseWeb Interface:
  • Default LAN IP: 192.168.1.1
  • URL: https://192.168.1.1
# Via Proxmox VM console
# Login with root/opnsense

# Assign interfaces
1) Assign interfaces
2) Set interface IP address
8) Shell

​
Network Configuration

OPNsense requires at least two network interfaces:WAN (vmbr0): Internet-facing interface
LAN (vmbr1): Internal network interfaceIn Proxmox, create a second bridge or use VLANs to separate WAN/LAN traffic.
Use CaseCPURAMDisk
Home/Small Office2 cores2 GB16 GB
Medium Business4 cores4 GB32 GB
Enterprise8+ cores8+ GB64+ GB

​
OpenWrt Router

OpenWrt is a Linux-based router firmware with extensive package support and customization. Script: openwrt-vm.sh 
bash -c "$(wget -qLO - https://github.com/community-scripts/ProxmoxVE/raw/main/vm/openwrt-vm.sh)"
OpenWrt VM uses minimal resources (1 GB disk by default) and is perfect for testing or lightweight routing tasks.

​
OpenWrt Features

  • Package management (opkg)
  • Advanced routing protocols
  • QoS and traffic control
  • VPN support (OpenVPN, WireGuard)
  • Wireless management (with compatible hardware)
  • Extensive customization
  • Active community packages

​
Initial OpenWrt Setup

1

Access Web Interface

Default LAN IP: 192.168.1.1Navigate to: http://192.168.1.1
2

Set Root Password

First login has no password
  1. Click “Login” (no password needed initially)
  2. Go to System → Administration
  3. Set a root password
  4. Save & Apply
3

Configure Network

  1. Network → Interfaces
  2. Configure WAN interface (typically DHCP or Static)
  3. Configure LAN interface (default: 192.168.1.1/24)
  4. Save & Apply
4

Update Packages

# Via SSH or console
opkg update
opkg list-upgradable
opkg upgrade <package-name>

​
Network Configuration

Like OPNsense, OpenWrt benefits from separate WAN/LAN interfaces:
  • eth0 → WAN (vmbr0)
  • eth1 → LAN (vmbr1)
Configure during script execution or add interfaces later in Proxmox.

​
Common OpenWrt Packages

# WireGuard
opkg update
opkg install wireguard-tools luci-app-wireguard

# OpenVPN
opkg install openvpn-openssl luci-app-openvpn

​
MikroTik RouterOS CHR

MikroTik RouterOS Cloud Hosted Router (CHR) is a professional routing platform. Script: mikrotik-routeros.sh 
bash -c "$(wget -qLO - https://github.com/community-scripts/ProxmoxVE/raw/main/vm/mikrotik-routeros.sh)"
MikroTik CHR has licensing tiers based on performance. The free license is limited to 1 Mbps throughput.

​
MikroTik CHR License Levels

LicenseSpeed LimitPrice
Free1 MbpsFree
P11 Gbps$45
P1010 Gbps$95
P-UnlimitedUnlimited$250

​
Initial MikroTik Setup

1

Access Via Console

Login credentials:
  • Username: admin
  • Password: (blank - press Enter)
2

Access Via Winbox

Download Winbox from MikroTik.comConnect to VM’s MAC address (shows in neighbors)
3

Basic Configuration

# Set identity
/system identity set name=RouterOS-VM

# Set admin password
/user set admin password=newpassword

# Configure IP address
/ip address add address=192.168.88.1/24 interface=ether1

# Enable SSH
/ip service enable ssh
4

Apply License

If purchased, apply license key:
/system license renew account=your-account password=your-password

​
MikroTik RouterOS Features

  • Advanced routing (BGP, OSPF, RIP)
  • MPLS
  • VPN (L2TP, PPTP, OpenVPN, IPsec, WireGuard)
  • Firewall and NAT
  • Quality of Service (QoS)
  • Hotspot management
  • User management
  • Scripting engine
  • Extensive monitoring

​
Quick Configuration Example

# Configure WAN (DHCP client)
/ip dhcp-client add interface=ether1 disabled=no

# Configure LAN
/ip address add address=192.168.88.1/24 interface=ether2
/ip pool add name=dhcp_pool ranges=192.168.88.100-192.168.88.200
/ip dhcp-server network add address=192.168.88.0/24 gateway=192.168.88.1 dns-server=8.8.8.8
/ip dhcp-server add name=dhcp1 interface=ether2 address-pool=dhcp_pool disabled=no

# Setup NAT
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade

​
Network Design Considerations

​
Bridge Configuration in Proxmox

For proper WAN/LAN separation, create multiple bridges in Proxmox:In Proxmox Web UI:
  1. Node → System → Network
  2. Create → Linux Bridge
  3. vmbr0: WAN (connected to internet-facing NIC)
  4. vmbr1: LAN (internal network)
  5. Apply configuration

​
VLAN Configuration

Alternatively, use VLANs on a single bridge:
# Proxmox: VM → Hardware → Network Device → Edit
# VLAN Tag: 10 (for WAN)
# VLAN Tag: 20 (for LAN)
Configure VLAN trunking on the physical switch.

​
High Availability Setup

1

Create Two VMs

Deploy two identical firewall VMs (OPNsense/MikroTik)
2

Configure Cluster

Set up HA clustering in the firewall OS
  • OPNsense: System → High Availability
  • MikroTik: /interface vrrp
3

Sync Configuration

Enable configuration synchronization between nodes
4

Test Failover

Simulate failure to verify automatic failover

​
Resource Allocation Guidelines

​
CPU Allocation

  • Basic testing
  • Lab environments
  • Low traffic (under 10 Mbps)
  • Home networks
  • Small office (1-10 users)
  • Traffic up to 100 Mbps
  • VPN usage
  • Medium business (10-50 users)
  • Traffic up to 1 Gbps
  • IDS/IPS enabled
  • Multiple VPN connections
  • Traffic shaping

​
Memory Recommendations

FirewallMinimumRecommendedAdvanced
OPNsense1 GB4 GB8+ GB
OpenWrt256 MB512 MB1 GB
MikroTik256 MB1 GB2+ GB

​
Troubleshooting

  • Verify WAN interface has IP address
  • Check default gateway configuration
  • Ensure NAT/masquerading is enabled
  • Verify firewall rules allow outbound traffic
  • Check DNS configuration
  • Verify LAN IP address configuration
  • Check network cable/bridge connection
  • Ensure client is on correct subnet
  • Try accessing via VM console first
  • Check firewall rules on WAN interface
  • Increase CPU cores
  • Disable CPU limit in Proxmox
  • Enable virtio network drivers
  • Disable IDS/IPS if not needed
  • Check for CPU throttling
  • Consider hardware offloading
  • Verify VPN port forwarding
  • Check firewall rules
  • Ensure certificates are valid
  • Verify routing configuration
  • Check logs for specific errors

​
Performance Optimization

# Enable VirtIO for better performance
# VM → Hardware → Network Device → Model: VirtIO

# Enable multi-queue for VirtIO
qm set <VMID> -net0 virtio,bridge=vmbr0,queues=4

​
Next Steps

Linux VMs

Deploy Linux virtual machines

Home Assistant

Set up home automation

VM Overview

Back to all VM scripts