# Enabling the Firewall in my Proxmox Cluster


[//]: # (published: 2026-11-01)
[//]: # (language: en-US)
[//]: # (title: Enabling the Firewall in my Proxmox Cluster)
[//]: # (tags: selfhosted, proxmox)

<figure>
  <img src="https://blog.nocturnal.garden/img/dead-hedge.png" alt="Picture taken of a dead hedge, sticks shifted between greenery">
  <figcaption>You shall not pass - separating different areas while leaving defined openings (not fireproof). <br> © Simon Mannweiler&nbsp;/&nbsp;<a href="https://commons.wikimedia.org/wiki/Main_Page">Wikimedia Commons</a>/ CC BY-SA 4.0</figcaption> 
</figure>

I'm running most of my selfhosted stuff in my Proxmox cluster. It's behind a physical OpnSense box, but the hosts and guests had no such separation and they are connected with an unmanaged switch. I'm about to move a *big* service (used by more people than my household/close friends) into my server from Hetzner (~~European Digital Soverereignty~~ DIY infrastructure without billionaires) and since that's a bit more exposed than my private stuff, I wanted to embolden the separation. 

Proxmox has a builtin firewall that allows you to control traffic between the nodes and guests. Since a root-compromised host with ufw/iptables could disable it's outgoing firewall connections, keeping the local firewall config up to date on each host with Docker involved is a pain and I liked the idea of a central management interface, this sounded like the most natural way. The planned service will get it's own VM.

## Pre-enabling preparations

As usual, the [Proxmox documentation](https://pve.proxmox.com/wiki/Firewall) is quite helpful and mentions that it's easy to lock yourself out with the firewall. While I have physical access to the nodes, I wanted to prevent that and allowed SSH and the Web UI (port 8006) from the [HAN](https://en.wikipedia.org/wiki/Home_network) (in which my laptop and phone are). I kept the guest firewalls disabled to prevent one fuckup at a time.

## Enabling the guest firewalls

After enabling the firewall on node/cluster level and verifying everything worked, I enabled the firewalls on each guest VM (5 that offer services on their ports at that time). I mostly did id like this:

- Enabling ssh from the HAN
- Checking which services are running on the guest
    - I gave up on documenting this and just check my reverse proxy config since every service, public or not, runs through that
- Allow accessing them from the HAN and other necessary VMs (e.g. Prometheus to exporter ports)
- Enable firewall on guest
- Check if something breaks (usually detected by Prometheus) and fix it

This was both fun and tedious. It led me to each corner of my services and I made some notes to change the port some services expose.

All in all, I think it took me a bit over an hour. The Proxmox interface is good, I just wished for port aliases since I have ranges for those that I (inconsistently) follow on all guests, like 9100:9200 for monitoring exporters to be scraped by Prometheus.

It's been on my look-into list for a good while and now that I had a reason to actually do it, I'm glad I did. One more step on my way to move the big service! There's at least one other thing I want to do, which I might blog about after doing.