pfSense + Proxmox: Building an Isolated Virtual Lab Network

This guide outlines the process of isolating a Proxmox lab environment by deploying a dedicated pfSense virtual machine (VM). This architecture keeps your home ISP-managed devices on a standard bridge while creating an "air-gapped" virtual bubble for your lab VMs.

Phase 1: Create the Isolated Network (Bridge)

This bridge acts as a virtual "switch" that is not connected to any physical hardware ports, ensuring your lab VMs stay strictly off your main home network.

1. Log in to your Proxmox Web UI.
2. Navigate to Datacenter → [Your Node] → System → Network.
3. Click Create → Linux Bridge.
4. Name: vmbr1
5. Bridge ports: Leave BLANK (this is crucial for complete network isolation).
6. Click Create and then Apply Configuration.

• vmbr0 (Management Bridge): Connected to the physical NIC, handles Proxmox PVE GUI, SSH, and host management traffic.
• vmbr1 (Internal Bridge): Isolated virtual switch with no physical slave port, handling only guest lab traffic.

Phase 2: Deploy the pfSense VM

1. Download ISO: Fetch the latest pfSense CE ISO and upload it to your Proxmox local storage.
2. Create VM: Click Create VM in the top-right toolbar:
   • General: Name it pfSense-Gateway.
   • OS: Select the pfSense ISO. Guest OS Type: Other.
   • System: Default settings (Keep QEMU Agent enabled).
   • Disks: 32GB+ recommended (Enable IO Thread for improved I/O throughput).
   • CPU: 2 vCPUs are sufficient for lab workloads.
   • Memory: 2GB to 4GB RAM.
   • Network:
     • NIC 1 (WAN): Select vmbr0 (Your uplink bridge to the ISP network).
     • Add Network Device: Click Add → Network Device.
     • NIC 2 (LAN): Select vmbr1 (Your new isolated bridge).
     • Model: Set both NICs to VirtIO (paravirtualized). Uncheck "Firewall" on these virtual NICs to prevent Proxmox pve-firewall rule interference.

Phase 3: Install & Assign Interfaces

1. Start the pfSense-Gateway VM and launch the Console.
2. Follow the installation prompts (Accept, Install, ZFS Auto-Partitioning).
3. Interface Assignment: Once installed and rebooted, console prompts will request interface assignments:
   • VLANs: Type n and hit Enter.
   • WAN: Enter vtnet0 (bound to vmbr0).
   • LAN: Enter vtnet1 (bound to vmbr1).
   • Type y to confirm assignments.
4. Once assigned, note the LAN IP (default gateway is typically 192.168.1.1).

Phase 4: Configure the Lab & Route Endpoints

Now we attach target lab machines (such as our Active Directory Domain Controller and Windows 11 client) to the isolated network:

1. Shut down your target lab VM (e.g., Domain Controller or Windows 11 client).
2. In Proxmox, select the VM → Hardware → Network Device → Edit.
3. Change the bridge from vmbr0 to vmbr1.
4. Power the VM back on. It will immediately request an IP lease from the pfSense DHCP server rather than your home router.
5. Access: From your Windows 11 lab VM, navigate to https://192.168.1.1 in your browser to access the pfSense Web GUI.

NAT Outbound Verification

Verify that Firewall → NAT → Outbound is set to "Automatic outbound NAT rule generation". This ensures all guest VMs on vmbr1 receive masqueraded internet access while remaining completely invisible and unreachable from the external home network.

Phase 5: Security Hardening – Disabling WAN Management

To ensure management interfaces are never exposed to the ISP side:

1. Navigate to System → Advanced → Admin Access.
2. Locate the WebGUI redirect section and check "Disable webConfigurator redirect rule".
3. Navigate to Firewall → Rules → WAN.
4. Review WAN rules: If any rule permits TCP/443 (HTTPS) or TCP/80 (HTTP) from "Any" source to "WAN Address", disable or delete it immediately.
5. By default, pfSense blocks all unsolicited WAN traffic, but explicit verification guarantees your firewall interface cannot be reached from outside the lab bubble.