UFW () protects traffic reaching an individual Linux VM’s own network stack, but Proxmox includes its own separate firewall layer that operates a level higher — filtering traffic at the hypervisor level before it even reaches individual VMs. Understanding Proxmox firewall configuration lets you apply consistent network security policies across your entire cluster, VMs, and containers alike, regardless of what’s running inside each one.
Why Use Proxmox’s Firewall Instead of (or Alongside) Guest Firewalls
Proxmox’s firewall operates independently of whatever’s running inside each VM, meaning it works identically whether a guest is running Linux, Windows, or anything else — useful specifically because not every guest OS has an equally convenient firewall configuration story. It also lets you define rules centrally at the Datacenter or Node level, applying consistent baseline policies across many VMs without configuring each one’s internal firewall individually.
Understanding the Three Levels
Proxmox’s firewall applies rules at three distinct scopes, evaluated together:
- Datacenter level – rules applying cluster-wide, to every node and VM unless more specific rules override them
- Node level – rules specific to the Proxmox host itself (protecting the web UI, SSH, and cluster communication ports)
- VM/Container level – rules specific to an individual guest’s network traffic
Enabling the Firewall
The firewall is disabled by default and needs to be explicitly enabled at each level you want it active:
- Go to Datacenter → Firewall → Options.
- Set Firewall to
Yes. - Repeat at the Node and individual VM levels you want protected.
Important: enable rules allowing necessary access (like the Proxmox web UI and SSH) before enabling the firewall itself at the Node level, or you risk locking yourself out of the web interface entirely.
Setting Up Datacenter-Level Default Rules
Under Datacenter → Firewall → Rules, define baseline rules that apply across your entire cluster — for example, explicitly allowing your management subnet to reach Proxmox’s web UI port (8006) while denying it from elsewhere.
Configuring Node-Level Protection
At the individual node level (Node → Firewall), add rules specifically protecting host-level services:
Allow: TCP port 8006 (web UI) from your trusted subnet only
Allow: TCP port 22 (SSH) from your trusted subnet only
Allow: cluster communication ports between cluster nodesConfiguring VM-Level Rules
For an individual VM, go to that VM’s Firewall tab and add rules specific to what that particular guest should allow — for example, a web server VM might allow inbound 80/443 from anywhere but restrict SSH access to your management subnet only, entirely independent of whatever firewall configuration (if any) exists inside the guest OS itself.
Using Security Groups
Rather than redefining the same set of rules repeatedly across multiple VMs with similar needs, Proxmox supports Security Groups — reusable rule sets you define once (Datacenter → Firewall → Security Groups) and then apply to any VM needing that same baseline policy, keeping consistent rules easier to maintain across many similar VMs.
Using IPSets for Reusable Address Groups
Similarly, IPSets let you define a named group of IP addresses or subnets once (your trusted management network, for instance) and reference that group across multiple rules, rather than retyping the same IP ranges repeatedly and risking inconsistency if that range ever changes.
Combining with VLAN Segmentation
Proxmox’s firewall works naturally alongside the VLAN segmentation covered in earlier guides — VLANs handle broad network-level isolation between device categories, while Proxmox’s firewall adds more granular, per-VM control within and across those segments, giving you defense at multiple layers rather than relying on network segmentation alone.
Logging Firewall Activity
Enable logging on specific rules to monitor what’s actually being blocked or allowed, useful both for troubleshooting a rule that’s unexpectedly blocking legitimate traffic and for general security visibility, similar in spirit to the UFW logging covered in the earlier firewall guide.
Testing Before Fully Locking Down
As with any firewall configuration, test changes carefully — start with permissive logging-only rules to understand actual traffic patterns before switching to a strict default-deny policy, and always maintain physical or out-of-band console access to your Proxmox nodes in case a firewall misconfiguration locks out your normal management access entirely.
Final Thoughts
Configuring Proxmox’s built-in firewall adds a hypervisor-level security layer that operates consistently across every VM and container regardless of the guest operating system, complementing rather than replacing guest-level tools like UFW. For homelab clusters running a real mix of Linux and non-Linux guests, this centralized approach ensures consistent baseline security policy without depending entirely on each individual guest’s own firewall configuration.
Leave a Reply