Advanced 21 min

Proxmox firewall (pve-firewall)

Enable the firewall datacenter and VM, create incoming/outgoing rules and secure your services hosted on Proxmox.

#Firewall#Security#pve-firewall

Ready to start your service? Check offers and order online.

Proxmox firewall (pve-firewall)

The firewall Proxmox VE filter traffic at the individual data center, node or VM/CT level. It completes the guest firewall (ufw, Windows Firewall) and anti-DDoS network Anthony IT Solutions. This guide activates pve-firewall and creates secure rules.

Enable firewall

Datacenter → Firewall → Options → Firewall: Yes
Node → Firewall → idem if rules per node
VM/CT → Firewall → Enable for machine rules
Order: specific VM rules before general data center rules

Recommended rules (VM web)

Directorate	Action	Port	Source
IN	ACCEPT	22/tcp	Your admin IP
IN	ACCEPT	80,443/tcp	All
IN	DROP	All	All (end)

Groups & macros

Use reusable security groups (web, db, ssh-admin) assigned to multiple VMs for consistency. Macros Proxmox simplify SSH, HTTP, HTTPS.

Test the rules from an external IP after activation. A DROP rule too early can block SSH and require VNC console to fix.

Logs & debug

Enable logging on suspicious rules
See Syslog node or Firewall log VM tab
Correlation with monitoring

Anti-DDoS Interaction

The anti-DDoS edge filter volumetric before your VDS. The Proxmox firewall manages end filtering by service (ports, sources).

Troubleshooting

Service inaccessible, missing rule, incorrect order, double firewall guest
Lockout SSH, VNC console, temporarily disable VM firewall