Between UFW on individual servers, pfSense/OPNsense at the network edge, and Proxmox’s own hardware, there’s actually a fourth layer worth understanding: Proxmox’s built-in firewall, operating directly at the hypervisor level and capable of filtering traffic per VM, per node, or across the entire datacenter, independent of whatever firewall the guest OS itself might be running.

What Makes Proxmox’s Firewall Different

Unlike UFW (), which runs inside a specific guest OS and only protects that one system, Proxmox’s firewall operates at the hypervisor level, filtering traffic before it even reaches a VM’s virtual network interface. This means it can enforce rules even for VMs running operating systems without their own convenient firewall tooling, and provides a consistent management layer across your entire cluster from one place.

The Three Levels of Proxmox Firewall Rules

• Datacenter level – rules applying cluster-wide, to every node and VM unless more specific rules override them
• Node level – rules specific to a particular physical Proxmox host, affecting traffic to and from that node itself
• VM/Container level – rules specific to an individual VM or LXC container’s virtual network interface

Rules cascade from broadest (Datacenter) to most specific (individual VM), letting you set sensible defaults centrally while still allowing per-VM customization where needed.

Enabling the Firewall

The firewall must be explicitly enabled at each level you want it active:

1. Go to Datacenter → Firewall → Options.
2. Set Firewall to Yes.
3. Repeat similarly at the Node and individual VM levels for anything you want protected.

Setting a Default Policy

Similar to UFW’s deny-by-default approach, Proxmox’s firewall lets you define default input and output policies:

1. Under Datacenter → Firewall → Options.
2. Set Input Policy to DROP for a secure default, then explicitly allow only needed traffic through specific rules.

Creating Security Groups

Security groups let you define reusable sets of rules applied consistently across multiple VMs, rather than manually recreating the same rules individually for every VM with similar needs:

1. Go to Datacenter → Firewall → Security Groups.
2. Click Create, name the group (e.g., “web-services”), and add rules like allowing inbound traffic on ports 80 and 443.
3. Apply this security group to any VM needing that same rule set, rather than configuring each individually.

Adding VM-Specific Rules

For rules specific to just one VM:

1. Select the VM, go to Firewall → Rules.
2. Click Add, specifying direction (in/out), action (accept/drop/reject), protocol, and port.

A Practical Example: Restricting a Database VM

For a VM running a database that should only accept connections from specific other VMs, rather than being reachable from your entire network:

1. Select the database VM’s firewall rules.
2. Add a rule allowing the database port only from the specific source IP(s) of VMs that legitimately need access.
3. Ensure the default policy drops everything else, since this VM shouldn’t be broadly reachable at all.

Combining with IP Sets

For rules referencing multiple specific IP addresses or ranges repeatedly, define an IP Set (under Datacenter → Firewall → IP Sets) once, then reference it across multiple rules — useful for defining your “trusted management devices” once and reusing that definition across several VM-specific rules rather than repeating the same IP list everywhere.

Proxmox Firewall vs Guest OS Firewall vs Network Firewall

These three layers genuinely complement rather than replace each other:

• Proxmox firewall – hypervisor-level protection, consistent regardless of guest OS, manageable centrally across the cluster
• Guest OS firewall (UFW, etc.) – additional protection specific to that OS, useful as defense-in-depth even if the Proxmox-level rule was somehow misconfigured
• Network firewall (pfSense/OPNsense) – protects at the network edge, before traffic even reaches your Proxmox cluster at all

Running all three isn’t redundant — it’s real defense-in-depth, where a misconfiguration or gap at one layer doesn’t necessarily expose you entirely, since the other layers still provide protection.

Logging Firewall Activity

Enable logging on specific rules to help troubleshoot connectivity issues or monitor for unexpected traffic patterns, viewable through the Proxmox web interface or integrated into the broader logging setup (Loki, ) for more comprehensive, searchable log analysis.

Final Thoughts

Understanding and configuring Proxmox’s built-in firewall adds a truly valuable hypervisor-level protection layer, consistent across every VM and container regardless of the guest OS’s own firewall capabilities. Combined with UFW at the guest level and pfSense/OPNsense at the network edge , Proxmox’s firewall completes a really layered security approach where no single misconfiguration point leaves your homelab’s VMs fully exposed.

Related Posts

• How to Set Up Automatic Proxmox Backups
• How to Set Up GPU Passthrough in Proxmox
• How to Migrate a Physical Server to Proxmox (P2V Migration)