Virtualization is a powerful tool in the arsenal of a homelab enthusiast or system administrator. One interesting, but rather controversial, case is virtualizing a router, such as OPNsense, pfSense, OpenWrt, or MikroTik CHR, in the Proxmox VE hypervisor. Let’s break down the pros and cons of this approach.
If you enjoyed this article, you can support the author by becoming a sponsor on Boosty (link in the contacts section).
Why virtualize a router?#
Virtualization lets you consolidate your infrastructure: fewer physical devices, centralized management, and flexibility for scaling and redundancy. It’s also a great opportunity to test different configurations and systems within a single environment.
Advantages of virtualizing a router in Proxmox#
| Advantage | Description |
|---|---|
| Hardware savings | A single server acts as a host for several services, including the router. |
| Flexibility | It’s easy to take snapshots, clones, backups, and roll back changes - especially handy when testing new rules and settings. |
| Monitoring and management | Proxmox provides convenient tools for monitoring the resources and state of the VM running the router. |
| Isolation | The router in its own VM/LXC is isolated from other services, simplifying security and fault tolerance. |
| SR-IOV and PCI Passthrough support | Physical interfaces can be passed straight through into the VM for maximum performance. |
Disadvantages and risks#
| Disadvantage | Description |
|---|---|
| Dependency on the host | If Proxmox “goes down,” the router goes down with it, which can result in the loss of access to the entire network. |
| More complex boot process | Boot order issues: Proxmox has to come up before the router, otherwise there will be no network access. |
| Passing through network interfaces | For stable and secure operation, it’s advisable to use passthrough or a bridge - this requires experience and careful configuration. |
| Networking can become a bottleneck | Especially when using virtual bridges (Linux Bridge, Open vSwitch), which may not provide sufficient throughput. |
| Harder to troubleshoot | It’s harder to debug network errors across multiple layers of abstraction (Proxmox → VM → router OS). |
What’s better to use: VM or LXC?#
- VM (virtual machine) - preferable for pfSense and OPNsense, since they’re based on FreeBSD and were never designed as an OS meant to run inside a container.
- LXC - suitable for some Linux-based solutions, but not recommended for critical network services due to the limited level of isolation.
Practical tips#
- Use a UPS and a watchdog to minimize the impact of a host failure.
- Take regular configuration backups and VM snapshots before updates.
- Separate management access to Proxmox from the main routed traffic across different interfaces.
- If you need high availability, consider a Proxmox VE cluster with HA, although this adds complexity and cost.
When is it worth virtualizing a router?#
It’s a good fit if:
- You already have a stable Proxmox host;
- You’re confident in the reliability of your hardware;
- You want to save on hardware and power consumption;
- You need flexibility and redundancy.
It’s not a good fit if:
- You’re not confident in the stability of the host;
- You have no alternative access to Proxmox in case of a failure;
- You’re building production infrastructure where 100% availability matters.
Conclusion#
Virtualizing a router in Proxmox is a powerful but not universal solution. It’s a great fit for homelab projects, experiments, and resource savings, but it requires attention to detail and a well-thought-out architecture. If you’re ready for those challenges - go for it, the result is worth it!
