OpenBSD Handbook

    Theme
    • Part I. Install & Configure
      • Introduction to OpenBSD
      • Installing OpenBSD
      • The X Window System
      • Networking on OpenBSD
      • System Configuration
      • OpenBSD Basics
      • Managing Software: Packages and Ports
    • Part II. Daily Operations
      • OpenBSD Desktop Environments
      • Multimedia
      • Printing
      • Linux Compatibility
      • Windows Compatibility
      • Games
    • Part III. System Administration
      • Virtualization
      • Storage and File Systems
      • Updating and Upgrading
      • Localization
      • The OpenBSD Boot Process
      • Security
    • Part IV. Networking & Daemons
      • Services
        • Database
          • MariaDB
          • PostgreSQL
          • Redis
          • memcached
        • Directory
          • YP (NIS)
          • LDAP
        • File
          • NFS
          • Samba
        • FTP Services
          • ftpd
          • ProFTPD
          • vsftpd
          • Pure-FTPd
          • TFTP
        • Mail
          • OpenSMTPD Mail Server
          • Dovecot IMAP and POP3 Server
          • Postfix
          • Exim
          • Rspamd
        • Name
          • Unbound DNS Resolver
          • NSD Authoritative DNS Server
          • BIND DNS Server
        • Networking
          • OpenBGPD
          • rad
          • DHCP on OpenBSD
          • slaacd
        • Web
          • Apache HTTP Server
          • nginx Web Server
          • OpenBSD httpd Web Server
          • relayd Reverse Proxy
        • Logging
          • syslogd
        • Monitoring
          • SNMP
        • Remote Access
          • Audit OpenSSH
          • OpenSSH Server
        • File Synchronization
          • rsync
        • Messaging
          • RabbitMQ Message Broker
        • Time
          • NTP Time Synchronization
        • Load Balancing
          • Build Redundant Load-Balanced Gateways
          • Load Balance Services with NAT or DSR
          • Build an HA HTTPS Load Balancer
      • PF
        • pfctl cheat sheet
        • PF Anchors
        • PF Filter Rules
        • PF Forwarding
        • PF Lists and Macros
        • PF Load Balancing
        • PF Logging
        • PF NAT
        • PF Options
        • PF Policies
        • PF Shortcuts
        • PF Tables
      • Advanced Networking
        • High Availability and State Replication
        • Multi-WAN and Policy-Based Routing
        • VPN and Cryptographic Tunneling
        • Classic and Lightweight Tunnels
        • IPv6 at Scale
        • QoS and Traffic Shaping
        • MPLS and Label Distribution
        • Network Services at Scale
        • Virtualization and Host Networking
        • Large-Scale L2 and L3 Design
        • Telemetry, Logging, and Flow Export
        • Hardening and Operational Safety
        • Reference Architectures
        • Troubleshooting Playbooks
      • Serial Communication
    • Part V. Miscellaneous
      • Virtualization Cheat Sheet
      • OpenBSD Cheatsheet
      • How-to Guides
        • Installation and First Boot
          • Complete the First 30 Minutes After Installation
          • Check Hardware Compatibility Before Installing
          • Bootstrap Wi-Fi Firmware Without Ethernet
          • Run OpenBSD as a Virtual Machine Guest
          • Install OpenBSD on a VPS or Cloud Server
          • Install OpenBSD with Full-Disk Encryption
          • Dual-Boot OpenBSD on a UEFI System
          • Automate OpenBSD Installation with Autoinstall and PXE
        • Desktops and Laptops
          • Set Up OpenBSD as a Laptop or Workstation
          • Configure Laptop Power Management
          • Troubleshoot Web Browsers on OpenBSD
          • Use Plan 9 Tools on OpenBSD
          • Build a Minimal Desktop with suckless Tools
          • Install Z shell (zsh)
        • Networking and Remote Access
          • Create an Administrator Account with doas and SSH Keys
          • Configure Secure Remote Access with OpenSSH
          • Use FIDO Security Keys with OpenSSH
          • Configure Wi-Fi Roaming and Wired Failover
          • Troubleshoot PF, NAT, and Routing
          • Route Multiple VLANs with PF
          • Configure a Road-Warrior WireGuard VPN
          • Route IPv6 Networks without NAT
          • Test OpenBGPD with Two Providers
          • Unlock an Internal Service with an SSH Key
          • Build a Simple Router and Firewall
        • Servers and Services
          • Set Up WordPress on OpenBSD
          • Build a Mail Server with OpenSMTPD, Dovecot, and Rspamd
        • Security, Maintenance and Recovery
          • Establish a Conservative Security Baseline
          • Recover Access and Reset the Root Password
          • Collect OpenBSD Diagnostic Evidence
          • Troubleshoot Package Installation and Update Failures
          • Schedule Recurring Maintenance
          • Monitor an OpenBSD System
          • Back Up and Restore an OpenBSD System
          • Configure softraid RAID1
          • Recover an OpenBSD System That Does Not Boot
        • Building, Automation and Virtual Machines
          • Manage OpenBSD with Ansible
          • Build Third-Party Software from Ports
          • Build OpenBSD from Source
          • Plan a Docker Workload Migration to OpenBSD
      • OpenBSD for Linux Users
      • OpenBSD for FreeBSD Users
      • OpenBSD for macOS Users
    • OpenBSD FAQ
    • OpenBSD Architectures
      • OpenBSD Package Search
        • Synopsis
        • Record the Virtual Hardware
        • Create the Guest
        • Install OpenBSD
        • Verify Devices in the Installed Guest
        • Configure Console and Shutdown Paths
        • Treat Snapshots as a Recovery Aid

        Run OpenBSD as a Virtual Machine Guest

        Synopsis #

        OpenBSD can run as a guest under several third-party hypervisors. The installation procedure remains the standard OpenBSD procedure, but the hypervisor controls firmware, virtual disks, network adapters, consoles, power events, and snapshot behavior.

        This guide covers virtual hardware selection and checks inside the guest. Use the hypervisor’s documentation for its setup interface. Confirm the current OpenBSD release and the selected virtual devices before relying on a guest for production work.

        Record the Virtual Hardware #

        Before creating the guest, record:

        • the OpenBSD architecture;
        • BIOS or UEFI firmware mode;
        • virtual CPU count and memory;
        • disk controller and disk size;
        • network adapter model and network attachment;
        • graphical, serial, or provider-console access;
        • the recovery-media attachment procedure.

        Prefer simple virtual devices documented by current OpenBSD section 4 manual pages. virtio(4) documents the paravirtual device framework used by many hypervisors. Availability and behavior depend on the host product and its configured device model.

        Create the Guest #

        Use conservative initial resources and one disk. Attach the verified OpenBSD installation ISO for the selected architecture. Do not enable optional acceleration, nested virtualization, unusual storage caching, or several network adapters until the basic guest boots and installs reliably.

        Connect the first virtual network adapter to a network that provides either DHCP or recorded static settings. Maintain console access until SSH connectivity has been tested after a reboot.

        Install OpenBSD #

        Boot the installation media and follow the installation chapter . The installer should display the virtual disk and network adapter in its kernel messages. Stop and correct the virtual hardware configuration if the intended disk or network interface is absent.

        Use the automatic disk layout unless the workload requires a documented alternative. Install all sets for a general-purpose guest. Eject or detach the installation media before the first disk boot.

        Verify Devices in the Installed Guest #

        After the first boot, record the virtual devices with dmesg(8) , disklabel(8) , and ifconfig(8) .

        dmesg
          # Confirm the firmware, storage, network, clock, and console devices
        disklabel sd0
          # Confirm the installed disk and OpenBSD partition layout
        ifconfig
          # Confirm the virtual network interface and address
        

        Replace sd0 when the installed disk uses another name. Device names must be discovered from the guest’s own kernel messages.

        Complete the first 30 minutes , then reboot again. Confirm that the guest starts from its virtual disk, obtains the expected network configuration, and remains accessible from the hypervisor console.

        Configure Console and Shutdown Paths #

        A graphical console is enough for installation, but a serial console can improve headless recovery when the hypervisor exposes one. Configure it only after confirming the architecture-specific boot(8) and ttys(5) requirements. Keep the known-working console until the serial path has been tested across a reboot.

        Test a normal in-guest shutdown with shutdown(8) :

        doas shutdown -p now
        

        Confirm that the host recognizes the powered-off state. Do not treat an abrupt hypervisor power-off as a normal shutdown procedure.

        Treat Snapshots as a Recovery Aid #

        A hypervisor snapshot captures virtual-disk state at a point chosen by the host. It does not automatically guarantee filesystem or application consistency. Before a planned snapshot, stop applications that write important data, or pause their writes, and let pending filesystem writes finish.

        Snapshots usually share the guest’s storage and administrator access, so a storage failure or compromised account can affect both. Keep an independent backup. Maintain a guest-aware backup and test restoration separately.

        Before a base-system upgrade, confirm all three recovery paths:

        1. hypervisor console access;
        2. verified installation or ramdisk media;
        3. an independent backup of configuration and application data.

        The virtualization chapter covers OpenBSD as a virtualization host. It is distinct from running OpenBSD as a guest under another hypervisor.

        Report a bug
        • Synopsis
        • Record the Virtual Hardware
        • Create the Guest
        • Install OpenBSD
        • Verify Devices in the Installed Guest
        • Configure Console and Shutdown Paths
        • Treat Snapshots as a Recovery Aid