Proxmox Firewall Setup [Single NODE or CLUSTER] | Proxmox Home Server Series

[@jhboricua]

From the Proxmox documentation: If you enable the firewall, traffic to all hosts is blocked by default. Only exceptions is WebGUI(8006) and ssh(22) from your local network. In other words, as long as you're in the same local network as the hosts, enabling the firewall without any rules defined will NOT block you out from the Proxmox hosts. You still will be able to manage them via the GUI and SSH.

[@SamWhitlock]

This is a fantastic channel! Pure, useful info! I was just wandering around the forums trying to figure this out for myself (e.g. don't want VMs to be able to just reach out to the proxmox nodes' web interfaces themselves!), so I'm so glad I stumbled upon this!

[@BMSwahn]

This is actually so useful. Just discovered your channel. You are a beast

[@HyuLilium]

I set output policy to drop everywhere, then defined 1st rule accept with destination gateway, 2nd rule drop with destination ALL local IPV4 addresses, third accept out anywhere else

[@tienvoxuan4954]

Thanks for sharing. A nice and clean video with a lot of useful information to me

[@HyuLilium]

I don't get why out rules towards the internet are needed when the default policy for output was already ACCEPT under Datacenter, and also the individual LXC. Shouldn't it be turned to DROP for output rules to become necessary, otherwise everything out is accepted?

[@goodcitizen4587]

Very cool. I was wondering about this. I had them turned off, but you showed how to implement correctly. Thanks!

[@andrevieira997]

Love your videos. Thank you for sharing your knowledge :) Hugs from Portugal!

[@MRPtech]

Your Welcome. I hope video was helpful for you.

[@sumarouno]

This is actually so useful. Thanks!

[@anthonydelagarde3990]

Thank you. Great video and tutorial.

[@akostoth7654]

Great video, thank you very much. However, what I don't understand is that when I run the command 'nmap -sn' in the 'vm', it can still see the other devices on my local network. Does anyone know why?

[@muhammadabidsaleem7048]

Hi MRP We are running 4 node ceph cluster with PBS on another bare metal. We have configured simple zone in SDN as well. You explained the FW well. Thank you for your efforts. please shoot some videos on FW security groups and SDN with simple and vlan zones.

[@Crunch8111]

Hello Sir! May I ask you a question? Which rule do I have to add to the firewall to reject all traffic and connections to ipv6 adresses? When I activate the "Localnet" profile it blocks all IPV4 only.

[@mtiken]

This is a great video. I am a very big fan of IPTABLES. Behind the scene it is the IPtables at work. This gives a very eassy way to write the rules. It would be good to see if we write the Iptables rules in the proxmos shell, will it refelect in the proxmos gui. Proxmos is really good. I remember in the late 90s we have this Webadmin for linux which is gui based configuration and now I see proxmox like that tool with hypervisor capability. Thanks again MRP. This is a great video.

[@ltonchis1245]

What would be the best way to run a firewall? Local router -> Proxmox -> PFsense ( manage all interfaces from Promox ) or PFSense -> Proxmox ?

[@smokedironmade8705]

Great video!! As a complement to this one can you please make one for setting up vlan? Thanks

[@robbuurman1667]

Great video, thanks

[@hprompt166]

hi there you lxc container pihole, I installed it using simple SDN. I can update, ping etc.. but when I place the NAT ip address in the web browser with the /admin, I get nothing. If I switch it to vmbr0 it works. any suggestions?

[@MRPtech]

LXC or VM inside SDN network can access your local network, but you can't access VM or LXC from your local network back into SDN. To access VM or LXC inside SDN network from your local network, you need to assign additional network adapter to that VM/LXC. This way your VM/LXC will have two "local" ip addresses: 1: 100.100.100.x (SDN) and 2: 192.x.x.x (Local)

[@hprompt166]

@@MRPtech first off thx for getting back with me. So do I add vmbr0 ip with gateway or create a vmbr1 with a new ip and gateway? what do I leave the gateway on the SDN ip address or remove it? also which ip do I use in the web browser to access pihole with the /admin?

[@MRPtech]

If you setup SDN IP as static, leave as it is, you need to add main network "card" as 2nd network connection device. example: prnt.sc/l49BjpLbZAJJ net0 - SDN - i have SDN ip of 192.168.100.100 and gateway 192.168.100.1 net1 - vmbr0 - 192.168.178.123 and gateway 192.168.178.1 If i want to access this VM from my local network - i use 192.168.178.123 ip address. 192.168.100.100 is my SDN ip address which can be used to communicate with other VMs inside the same SDN network.

[@hprompt166]

@@MRPtech ok, if I use the SDN ip 10.0.100.1/admin it won't work but if I use vmbr0 ip 10.0.40.4/admin it works. am I good to go?

[@hprompt166]

@@MRPtech so any lxc or vm that I create on the SDN will have to be setup the same way with a different ip address on vmbr0

[@DawidKellerman]

Please do a video on the security groups

[@MRPtech]

Got it

[@barma1309]

It's a good idea to block all traffic except that directed to gateway

[@Siyual]

Can this be used for public facing server VMs to prevent access to the rest of the network in the event the server is compromised?

[@MRPtech]

Yes, extra firewall config required. For example, you can setup that firewall will accept access in from outside network to that VM but will block access from that VM to rest of local network, one exception being is Gateway (to access internet) + DNS server to resolve web queries.

[@kristof9497]

Thanks.

[@Lunolux]

thx

[@MRPtech]

np

[@WOTBLITZ_-xx1uf]

I have localsite connected through cloudflared tunnel, the problem is i cant store/save data through domain name instead local ip. Is this any related with firewall ? Thanks

[@MRPtech]

CF setup is for accessing web services. You can't do much besides that, for example: if i want to RDP in to local Windows 11 server via CF tunnel. i need to do A LOT OF configurations to make that happen. if you want to access local services and upload data from outside network, have a look into setting up Tailscale and Subnet Routing