I currently have pfSense virtualized with a 4 port NIC passed through for connectivity. I'm using 2 of the ports, one for WAN (connected directly to a PPPoE modem) and one for LAN (connected to my switch). Unraid is connected to the same switch with the onboard NIC.

 

Everything works as expected but I want to remove the need for the switch.

 

If I add a virtual NIC to pfSense and change the LAN interface to use this port (so the only physical interface in use by pfSense is the WAN connection to the modem) then it kind of works, ports forwarded from the WAN are able to hit services hosted in docker containers (plex works for example). Devices connected to the switch are able to get to the unraid GUI and out to the internet (via the pfSense VM) but unraid and docker containers are unable to initiate outbound connections. In my mind this should have worked as long as eth0 is bridged with vhost0.

 

I can't enable bridging in unraid's network settings as this will enable macvlan (macvlan was causing call traces and instability, can't use ipvlan either as it was silently losing connectivity for a few minutes at a time every couple of hours, macvtap has been super stable for over 2 weeks now). What would be stopping this from working as I would have expected?

My guess is that unraid has a default route set to go out of eth0 and the pfSense VM is connected to vhost0 so unraid is sending packets out of the wrong interface.

 

My LAN uses 192.168.10.0/24, pfSense uses 192.168.10.1, unraid is 192.168.10.10 .

I'd like to be able to turn the switch off and still have unraid be able to access the internet, any ideas?

Okay, I decided this probably was due to the default route heading out of eth0 so I've changed the metric and added another for vhost0 with higher priority, my routing table now looks like this;

 

 

and it works as I wanted, I've physically disconnected the LAN cable between pfSense and the switch and everything still works as it did when I had the switch in the middle.

 

Now will this survive a reboot? and are there any security considerations I haven't thought about?