Enabling the Firewall in my Proxmox Cluster https://blog.nocturnal.garden/article/proxmox-firewall

I'm running most of my selfhosted stuff in my Proxmox cluster. It's behind a physical OpnSense box, but the hosts and guests had no such separation and they are connected with an unmanaged switch. I'm about to move a big service (used by more people than my household/close friends) into my server from Hetzner (~~European Digital Soverereignty~~ DIY infrastructure without billionaires) and since that's a bit more exposed than my private stuff, I wanted to embolden the separation.

Proxmox has a builtin firewall that allows you to control traffic between the nodes and guests. Since a root-compromised host with ufw/iptables could disable it's outgoing firewall connections, keeping the local firewall config up to date on each host with Docker involved is a pain and I liked the idea of a central management interface, this sounded like the most natural way. The planned service will get it's own VM.

Pre-enabling preparations

As usual, the Proxmox documentation is quite helpful and mentions that it's easy to lock yourself out with the firewall. While I have physical access to the nodes, I wanted to prevent that and allowed SSH and the Web UI (port 8006) from the HAN (in which my laptop and phone are). I kept the guest firewalls disabled to prevent one fuckup at a time.

Enabling the guest firewalls

After enabling the firewall on node/cluster level and verifying everything worked, I enabled the firewalls on each guest VM (5 that offer services on their ports at that time). I mostly did id like this:

• Enabling ssh from the HAN
• Checking which services are running on the guest
  • I gave up on documenting this and just check my reverse proxy config since every service, public or not, runs through that
• Allow accessing them from the HAN and other necessary VMs (e.g. Prometheus to exporter ports)
• Enable firewall on guest
• Check if something breaks (usually detected by Prometheus) and fix it

This was both fun and tedious. It led me to each corner of my services and I made some notes to change the port some services expose.

All in all, I think it took me a bit over an hour. The Proxmox interface is good, I just wished for port aliases since I have ranges for those that I (inconsistently) follow on all guests, like 9100:9200 for monitoring exporters to be scraped by Prometheus.

It's been on my look-into list for a good while and now that I had a reason to actually do it, I'm glad I did. One more step on my way to move the big service! There's at least one other thing I want to do, which I might blog about after doing.