Proxmox Firewall

The built-in firewall works at three levels: datacenter (cluster), node (host) and guest (VM or container). Rules are stored in /etc/pve and replicated across the cluster.

Documentation: Proxmox VE Firewall

Verification: config file locations, the port list, and pve-firewall status|start|stop|localnet were checked against the docs. The docs state that traffic is blocked by default once enabled (with an exception for GUI and SSH from the local network), but do not give exact default policy values, so the “input DROP, output ACCEPT” detail below is from experience and unverified. pve-firewall compile and simulate are not documented for the legacy iptables firewall (compile appears for the newer nftables proxmox-firewall), so they are not listed. No command was executed.

See also: Proxmox Networking · Proxmox Users, Permissions, API Tokens and pvesh · Proxmox Clustering and HA · UFW (uncomplicated firewall) · IPTables

Enable Safely #

The firewall is off until enabled at the datacenter level (Datacenter -> Firewall -> Options -> Firewall). Once on, incoming traffic is blocked unless allowed, apart from the web UI and SSH from the local network. Add rules for your own management network before enabling, and keep console access ready.

Enabling at the datacenter level is not enough for guests: each VM or container also needs its firewall enabled (Firewall -> Options) and the NIC’s Firewall checkbox ticked.

Config Files #

Format:

[OPTIONS]
enable: 1
policy_in: DROP

[RULES]
IN ACCEPT -source 192.168.1.0/24 -p tcp -dport 8006 -log nolog
IN SSH(ACCEPT) -source 192.168.1.0/24

Rules are <IN|OUT|GROUP> <ACTION> [options]. Actions: ACCEPT, DROP, REJECT. Macros such as SSH, HTTP, HTTPS, Ping, DNS expand to the right ports.

Ports to Allow #

Keep the cluster and migration networks on their own subnet and allow them with IP sets (Proxmox Clustering and HA).

IP Sets, Aliases and Security Groups #

• Alias: a name for an IP or CIDR (mgmt = 192.168.1.0/24).
• IP set: a named list, reusable in rules with +<SETNAME>. The special management set is allowed to reach the UI and SSH.
• Security group: reusable rule bundle, applied with GROUP <NAME>.

Typical Setup #

1. Datacenter: create IP set management with your admin network, add rules for 8006 and 22.
2. Datacenter: enable firewall, keep default policy for input as DROP.
3. Nodes: enable the node firewall (Node -> Firewall -> Options).
4. Guests: enable per guest, add only the inbound ports needed.
5. Check logs: journalctl -u pve-firewall and the firewall log in the GUI.

If you lock yourself out, use the console, run pve-firewall stop, fix the rules in /etc/pve/firewall/cluster.fw or the node file, then pve-firewall start. On Debian-based guests, a host firewall inside the guest can be done with UFW (uncomplicated firewall).