Understanding Proxmox Firewall Architecture
The Proxmox firewall operates at two distinct levels: the cluster level and the node level. Understanding this hierarchy is crucial for effective network security. The cluster firewall applies rules to all nodes within a cluster, which is useful for homelabs with multiple servers. However, for most single-node setups running Proxmox VE 8, you will primarily configure the node firewall.
Each virtual machine (VM) and container (LXC) has its own isolated firewall configuration. This means you can define different security policies for each guest operating system. For example, you might allow full internet access for a web server container while restricting an internal database container to local network communication only. The underlying mechanism relies on nftables, which provides high performance and flexibility compared to older iptables implementations.
Before making any changes, ensure that the firewall is enabled globally. Navigate to the Datacenter or Node view in the Proxmox web interface, select the "Firewall" tab, and click "Options." Check the box to enable the firewall for the node. Once enabled, you must manually add rules because the default policy is often set to deny incoming traffic unless explicitly allowed. This zero-trust model ensures that only configured ports are accessible.
Encrypt Local Traffic: Setting Up WireGuard for Gateway ServicesConfiguring Basic Access Rules
To secure your server, start by defining who can access it. The most common requirement is allowing SSH access from specific IP ranges. In the Proxmox interface, go to the Node view, select "Firewall," and then click "IP Sets." Here, you can create named sets of IP addresses or CIDR ranges. For instance, create a set called admin_ips and add your home office static IP range, such as 203.0.113.0/24.
Next, navigate to the "Rules" section under the same Firewall menu. Add a new rule with the following parameters:
- Action: Allow
- IP Version: IPv4 (or IPv6 if applicable)
- Source: Select the
admin_ipsset you created - Dest Port: 22 (SSH)
- Log Level: Info
This rule permits SSH connections only from the specified IP ranges. It is critical to also allow established connections to ensure that responses to your outgoing requests are not blocked. Add another rule with Action set to "Allow," Protocol set to "All," and Source/Destination left blank to accept return traffic. Without this, your existing sessions may drop unexpectedly.
Integrating with Netbird and WireGuard
Netbird uses WireGuard to create encrypted tunnels between devices. When running Netbird on a Proxmox host, the VPN traffic typically enters through a dedicated virtual interface, often named wg0 or similar. You need to allow incoming traffic on the WireGuard port, usually UDP 51820, from the Netbird management plane or trusted peers.
Create a new IP Set for your Netbird server IPs or the entire CIDR range of your VPN clients if they are dynamic. Then, add a firewall rule allowing UDP traffic on port 51820 from this source. If you are using Netbird's self-hosted setup, you may also need to open port 8080 or 443 for the control plane, depending on your architecture. Ensure that these rules are placed above any general deny rules to take precedence.
It is important to note that Proxmox firewall rules apply to the node's physical interfaces. If your VMs or containers have their own network bridges, you must configure the firewall settings within each individual VM/LXC entity. This allows the guest OS to handle its own internal routing while the host handles external access control.
Wireguard Issue on Home WiFi - Troubleshooting GuideBlocking Traffic and Default Deny Policy
Once your allow rules are in place, enforce a default deny policy. In the Firewall Options, ensure that "Default Input Policy" is set to "Deny" and "Default Forward Policy" is set to "Deny." This ensures that any traffic not explicitly permitted by your rules is dropped. This is the cornerstone of network security, preventing accidental exposure of other services like HTTP, HTTPS, or SMB.
To block specific unwanted traffic, you can add explicit deny rules before the final catch-all. For example, if you want to block all traffic from a known malicious IP range, create an IP Set for that range and add a rule with Action set to "Drop" and Source set to that IP Set. Placing drop rules higher in the list than allow rules ensures they are evaluated first.
Remember that the Proxmox firewall does not filter traffic between VMs on the same bridge unless you enable MAC spoofing and configure the bridge firewall appropriately. For inter-VM isolation, consider using separate VLANs or configuring the firewall within each VM. This layered approach provides defense in depth.
Verification and Maintenance
After applying your rules, test connectivity from both allowed and disallowed sources. Use tools like nc or nmap to verify that port 22 is accessible only from your admin IPs and that port 51820 is reachable from your Netbird clients. Check the Proxmox firewall logs under the "Logs" tab to monitor denied attempts. These logs provide valuable insights into potential intrusion attempts or misconfigurations.
Regularly review your IP Sets and rules to remove outdated entries. As your network evolves, you may need to update admin IP ranges or adjust VPN client permissions. Automating updates via scripts or integrating with dynamic DNS services can streamline this process. Always backup your configuration before making significant changes to ensure you can restore the previous state if issues arise.
Frequently Asked Questions
Why can't I connect to my VM after enabling the Proxmox firewall?
This usually happens because the default input policy is set to deny, and no allow rules exist for the VM's IP or port. You must explicitly add a rule allowing traffic to the specific VM IP address and the required service port, such as SSH (22) or VNC (5900).
Does the Proxmox firewall affect traffic between containers on the same bridge?
No, the node firewall primarily filters traffic entering or leaving the physical network interfaces. Traffic between VMs or containers on the same Linux bridge is handled by the kernel's networking stack and is not filtered by the Proxmox firewall GUI rules unless you specifically configure bridge filtering.
How do I allow ICMP ping from all sources?
Add a new firewall rule with Action set to "Allow," Protocol set to "ICMP," and leave the Source field empty or set to "Any." This permits ping requests from any IP address to your node or specific VMs, which is useful for network diagnostics.
Can I use CIDR notation directly in the firewall rules instead of IP Sets?
Yes, you can enter CIDR notation directly in the Source or Destination fields of a rule, such as 192.168.1.0/24. However, using IP Sets is recommended for managing multiple IPs or frequently changing ranges, as it centralizes management and improves rule clarity.
What happens if I lock myself out of the Proxmox shell?
If you accidentally block your own IP, you can regain access via the Proxmox console provided by your hypervisor (e.g., ESXi, Hyper-V, or physical KVM). From the console, you can disable the firewall temporarily or edit the configuration files located in /etc/pve/firewall/ to restore access.