Proxmox VM can't connect to other network

[Becks0815]

Setup:
Proxmox on a N100 with 4 NICs. 1 NIC (named vmbr0 in Proxmox) only internally used to connect to the Proxmox host. Opnsense running as VM with 2 NICs set to pass through (works flawless). Opnsense IP is 192.168.1.1 (with a /24 Subnet for the LAN)

Idea:
create at least one additional VM (lcx container, Debian 11) and run wireguard on it. Then route traffic coming in on Opnsense to this VM via an virtual network device, and avoid routing the data through the regular LAN NIC of opnsense.

Done:
Created a Linux bridge VMBR1 without bridge port set, added the device to opnsense, enabled the NIC, added DHCP (Subnet 192.168.111.0/24), set opnsense IP 192.168.111.1 on this NIC.
Created a LXC CT using the Debian template, added VMBR1 as Network device to this machine with IPV4 = DHCP and IPV6 = Static (not used).

Result(s):
- machine is starting and gets an IP address from the DHCP server on opnsense. I also can see the lease in the overview on opnsense.
- I can ping IP addresses on my on network (192.168.1.x) and also on the Internet (e.g. 1.1.1.1)
- DNS works, I also can e.g. ping www.google.com
- I can download a page from 192.168.1.1 using wget (-> TCP seems to work across subnets)

but:
whenever I try to connect to any host on the internet or on the internal network 192.168.1.x, I get a timeout

I already have checked the Firewall settings on Opnsense, at least 3-4 times. The settings for the two networks LAN and the new virtual net are identical, and outgoing NAT is enabled for both networks. Now I have run out of ideas where else I should look. I start to suspect that something needs to be changed in Proxmox, but as a beginner with this software, I have no idea.

Anyone has ahint where I should look first/next?

 

[zunder1990]

proxmox is based on Debian why not running wire guard directly on the host?

 

[Becks0815]

I want Proxmox to be separated from anything I plan to run on it. VM1 is opnsense, VM2 is planned to be a Debian system running docker and poentially wireguard-easy, or something else.

 

[Becks0815]

Topic can be closed. Solution:

I have enabled hardware offload for CRC calculations on Opnsense on global level. While doing some packet capturing on the newly created virtual network interface, I found the following in the log output:

ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 64, id 63237, offset 0, flags [DF], proto TCP (6), length 60)
192.168.178.12.49094 > 151.101.242.132.80: Flags [S], cksum 0xfccd (incorrect -> 0x1dfc), seq 1355571707, win 64240, options [mss 1460,sackOK,TS val 976913755 ecr 0,nop,wscale 7], length 0

And after some sleep, it finally made sense.....
All I had to do was to go into the settings of the new interface, activate "override global settings" and disable the hardware offload functions for this virtual NIC. Then the cheksums were calculated without errors, resulting in my VM being able to pull data from the network.

Now everything works.