I'm trying to set up a virtualised pfSense router in ESXi on a Dell server. After many hours of reading, experimenting, watching Youtube videos etc, I'm close to pulling my hairs out...

The setup:
- Dell server with 6 physical NIC's
- ESXi 6.7
- pfSense 2.4.5 running as VM (responisible for routing, VLAN, firewall, DPI, ID/IP, OpenVPN etc)
- 3 more VM's running, each of them requires a particular VLAN

- 10: Management
- 20: User
- 30: IOT
- 40: Surveillance
- 50: Local (no internet)
- 60: Guest

Physical connections:
- 1x Uniquiti UAP connected to NIC 0 (should be a VLAN trunk/all VLANs, since the UAP makes a SSID for every VLAN)
- 1x WAN connected to NIC 1
- 1x device connected to NIC 2 (should be VLAN 30)
- 1x device connected to NIC 3 (should be VLAN 30)
- 1x device connected to NIC 4 (should be VLAN 20)
- 1x device connected to NIC 5 (should be VLAN 20)

Optional: the Dell server had its iDRAC shared with NIC0. It can be configured for a particular VLAN. Best solution would be if it could 'join' VLAN10 (management) on the trunk on NIC 0. Not sure if that's possible, hence optional.

Things I'm heavily struggling with are:

  • the ESXi vSwitch and port group setup

  • the pfSense interface setup (VLAN, Interface groups, bridges etc)

I tried many combinations but with no luck so far.

How can this be set up the best way? I assume every physical NIC requires a vSwitch, right? I also assume vSwitch0 (NIC 0) has a port group for every VLAN such that the internal VM's can connect to it. It also has a port group with VLAN 4095 (passing al VLAN's) which is connected to the pfSense VM. If that is a correct assumption, how do I get (tag) NIC 2-5 connected to the right VLANs? I guess I need to bridge things, either in ESXi or pfSense?

Please also note that I do not want to add a managed switch. The reason I invested in 6 NIC's on the server is to prevent additional external HW.

Please help before I lost all my hair ;)


You can easily get away with a single vSwitch.

Just add all your ports to the vSwitch then create port-groups for each link and set the specific ports to be active with every other port as disabled for that port group. They just set each of the pfSense vNICs to link to the appropriate port-groups.

So you'll have something like this (can't actually do it in esxi myself, well not quickly);


  • pg 'UAP' - pNIC 0 active, all other pNICs disabled (i.e. neither active nor standby), set to trunking mode
  • pg 'WAN' - pNIC 1 active, all othe pNICs disabled, no VLAN tagging
  • pg 'VLAN_30' - pNICs 2 and 3 active (if your switches are aware of each other) or active/standby (if your switches aren't aware of each other), tagged to VLAN 30
  • pg 'VLAN_20' - pNICs 4 and 5 active (if your switches are aware of each other) or active/standby (if your switches aren't aware of each other), tagged to VLAN 30

Then for your pfSense VM just link your vNICs to the appropriate port-groups.

If you had L3/VLAN-capable/linked switches this could just be done on two links as trunks but that's not what you want to do, fair enough.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.