OPNsense on Proxmox: Virtual Bridge vs PCI Passthrough

Quick Answer

For most users running OPNsense on Proxmox, a Virtual Bridge is the simpler and more flexible starting point.

If you want OPNsense to control a physical NIC directly and you are familiar with IOMMU, PCI device assignment, and Proxmox hardware configuration, you can consider PCI Passthrough.

The difference can be summarized simply:

Virtual Bridge

Physical NIC → Proxmox Bridge → Virtual NIC → OPNsense

PCI Passthrough

Physical NIC → OPNsense VM

1. What Is a Proxmox Virtual Bridge?

A Proxmox Linux Bridge can be thought of as a software switch running on the host.

It connects:

• Physical network interfaces

• Virtual machine network interfaces

A typical firewall layout looks like this:

WAN NIC
   ↓
 vmbr0
   ↓
OPNsense WAN

LAN NIC
   ↓
 vmbr1
   ↓
OPNsense LAN

The physical NIC is first managed by the Proxmox host, and the vmbr bridge then provides network connectivity to the OPNsense VM.

Why Use a Virtual Bridge?

A Virtual Bridge is well suited to:

• Simple VM networking

• VLAN-aware networking

• Easier future network changes

• Networks that need to be shared by multiple VMs

• Deployments that do not require PCI passthrough

For most home labs, it is usually the more practical starting point.

If this is your first firewall deployment on Proxmox, starting with a bridge is often easier to troubleshoot than configuring passthrough from the beginning.

2. What Is PCI Passthrough?

PCI Passthrough means:

Assigning a physical PCI device directly to a VM.

For a firewall, this usually means assigning a physical NIC directly to OPNsense.

For example:

Physical NIC
     ↓
PCI Passthrough
     ↓
  OPNsense

In this setup, the NIC is no longer presented to OPNsense through a standard Proxmox Virtual Bridge.

The OPNsense VM can control the device more directly.

PCI Passthrough generally requires platform support for:

• Intel VT-d / AMD-Vi

• IOMMU

• Appropriate device isolation

Once a NIC is passed through to OPNsense, it normally cannot continue to be used as a regular Proxmox host interface.

3. Virtual Bridge vs PCI Passthrough

Do not choose passthrough by default simply because it appears more direct or more advanced.

If a Virtual Bridge already meets the network design requirements, the additional complexity of passthrough may not provide a practical benefit.

4. How Should WAN and LAN NICs Be Assigned?

Assume the system has four physical NICs.

A practical bridge-based layout could be:

With PCI Passthrough, you could instead assign:

• NIC 1 → OPNsense WAN

• NIC 2 → OPNsense LAN

directly to the firewall VM.

NIC 3 can remain dedicated to Proxmox management.

There is one practical rule worth following:

Do not make system recovery unnecessarily difficult.

If every physical NIC is passed through to OPNsense and the firewall VM fails to start, reaching the Proxmox host itself may also become more difficult.

For this reason, keeping a separate management interface on a multi-NIC firewall mini PC is often useful.

5. How Should VLANs Be Handled?

If the network relies heavily on VLANs, a Virtual Bridge can be convenient.

A Proxmox Linux Bridge can be configured as VLAN-aware, allowing tagged traffic to pass through the bridge to the appropriate VM.

The layout can be understood like this:

Managed Switch
      ↓
 Tagged VLANs
      ↓
Physical NIC
      ↓
VLAN-Aware Bridge
      ↓
   OPNsense

With PCI Passthrough, OPNsense sees the physical NIC directly.

VLAN configuration is therefore handled more directly inside OPNsense.

Both approaches can support VLANs.

The real difference is closer to:

How much networking logic do you want Proxmox to manage?

versus:

How directly do you want OPNsense to control the physical NIC?

6. Which Should You Choose: Virtual Bridge or PCI Passthrough?

Choose a Virtual Bridge If:

• This is your first Proxmox firewall deployment

• Your network relies heavily on VLANs

• Easier management is a priority

• You may change VM networking later

• You do not want the additional complexity of IOMMU configuration

Choose PCI Passthrough If:

• You want OPNsense to use dedicated physical NICs

• Your hardware supports VT-d / AMD-Vi and IOMMU

• You understand the recovery implications of passthrough

• Those NICs do not need to be used by the Proxmox host

If there is no specific problem that requires PCI Passthrough:

Starting with a Virtual Bridge is usually the more practical choice.

If a clear requirement appears later, moving to passthrough is generally more sensible than adding complexity from the beginning only because it seems more direct or potentially faster.

Regardless of which method you choose, hardware offloading settings should also be checked in a virtualized OPNsense deployment to avoid compatibility problems between virtual networking and offloading configuration.

Related Guide: Bare Metal vs Virtualized Firewall

Related Guide: Proxmox Firewall Hardware Requirements

Explore CWWK Multi-NIC Firewall Mini PCs →