TL;DR

System → Advanced → Networking → Disable hardware checksum offload ✔ → Save → reboot the VM. The GUI does not say so, but the change does not apply to vtnet interfaces until the reboot.

To test without rebooting (lost at boot):

1
2

ifconfig vtnet0 -rxcsum -txcsum -tso -lro
ifconfig vtnet1 -rxcsum -txcsum -tso -lro

On OPNsense: Interfaces → Settings → Hardware CRC → Disable hardware checksum offload, and the same reboot.

Symptoms

The VM boots, the interfaces are UP, LAN DHCP hands out addresses, and still:

  • Hosts behind the firewall cannot reach the Internet, or connections stall halfway (ping passes, TCP hangs).
  • From the virtualization host itself or from other VMs on the same host nothing protected by pfSense is reachable, not even the GUI.
  • Switching the VM’s NIC to e1000 fixes it on the spot, which confirms the diagnosis.

Why it happens

FreeBSD’s vtnet driver, with checksum offload enabled, hands the network stack packets whose checksum never got computed: between VMs on the same host, and between the host and the VM, traffic never crosses a physical NIC that would do it. FreeBSD sees invalid checksums and drops them (FreeBSD bug 165059). Netgate documents it under VirtIO Driver Support.

pfSense tries to tick the option only when it detects vtnet interfaces at install time. If the VirtIO NIC was added later, if you restored the config.xml from a physical firewall, or if you migrated the VM from another hypervisor with a different NIC type, the option stays off.

Procedure

  1. System → Advanced → Networking, Network Interfaces section:

    • Disable hardware checksum offload: tick it.
    • Disable hardware TCP segmentation offload and Disable hardware large receive offload: already ticked by default; leave them.

  2. Save.

  3. Reboot from Diagnostics → Reboot. Without this step nothing changes on vtnet.

  4. Check:

    1

    ifconfig vtnet0 | grep options

    Neither RXCSUM nor TXCSUM (nor TSO4, LRO) should show up.

If it is still the same

  • All of the VM’s NICs must be the same kind. A vtnet with offload and an e1000 behave differently; check every ifconfig.
  • Offload on the host. Netgate notes that sometimes checksums and TSO must also be turned off on the hypervisor. On Proxmox/KVM, on the VM’s tap interface: ethtool -K tap100i0 tx off (the number is the VMID and i0 the NIC). Rarely needed; try it last.
  • Plan B: e1000 NIC model on the VM. Less throughput than VirtIO without offload, but none of this bug.

Traps

  • The reboot is not optional and the GUI does not ask for it. It is the number one cause of “I ticked it and it still does not work”.
  • It is not a rules problem. With offload on, packets are dropped before reaching pf; the firewall log shows nothing.
  • e1000 on OPNsense too as plan B; the equivalent setting lives under Interfaces → Settings.
  • Multiqueue (queues=N on Proxmox) works fine with vtnet once offload is off; do not mistake it for the cause.