💻 Proxmox VE Course III-B-1. Activating Proxmox Integrated Firewall: Datacenter Level Settings (English Translation)

🛡️ The Beginning of Ironclad Security: What is Proxmox Integrated Firewall?

From the moment you expose a virtualized server to the outside world, threats from numerous hacking attempts and port scans begin

Proxmox VE provides a powerful built-in #firewall function to protect the entire cluster from these threats

The Proxmox firewall system has a three-tier inheritance structure: Datacenter - Node - Virtual Machine (VM/CT), allowing for very systematic management

Among these, the 'Datacenter level' setting, the highest level, is a core process that determines the security guidelines for the entire infrastructure

In this #lecture, we will master the #method of activating the integrated firewall, the first step in server security, and the precautions for initial setup

---

1. Hierarchy and Operating Principles of Proxmox Firewall

Before starting security settings, you must understand how Proxmox filters packets

A. Three-Tier Hierarchy

• Datacenter: Establishes global security policies applied to all nodes and VMs

• Node: Sets host-level rules specialized for individual physical servers

• VM/CT: Applies individual port permission rules suitable for the characteristics of each service (HTTP, DB, etc.)

B. Inheritance and Priority

• Macros or security groups set at a higher level can be called and reused at a lower level

  This is a great help in maintaining consistency in the security settings of numerous VMs

C. #Data Flow Control (netfilter)

• Proxmox firewall operates based on the Linux kernel's netfilter and iptables/nftables

  Therefore, it can implement #performance and reliability comparable to hardware firewalls within a virtualized environment

---

2. Activating Firewall at the Datacenter Level

The first thing to do is wake up the dormant firewall engine

A. Enabling the Firewall

1. Select 'Datacenter' at the top of the Proxmox GUI\

2. Navigate to the 'Firewall' -> 'Options' menu\

3. Change the 'Firewall' item to 'Yes'

   Caution: The default policy applies immediately upon clicking this button, so you must ensure in advance that the administrator access port (8006) is not blocked

B. Default Policy Settings (Input/Output Policy)

• Input Policy: Determines the default behavior for traffic entering the datacenter (usually 'Drop' recommended)\

• Output Policy: Determines the behavior for outgoing traffic (usually 'Accept' maintained)

  Basically, a 'whitelist' method that blocks everything coming in and only opens what is necessary is most advantageous for security

C. GUI Configuration Guide

• You can adjust these options on the 'Datacenter' -> 'Firewall' -> 'Options' screen

  This setting affects all physical #NICs and virtual interfaces within the cluster

---

3. Preventing Admin Lock-out and Setting Essential Rules

You must prevent the 'Lock-out' phenomenon where even the administrator cannot access the server after turning on the firewall

A. Pre-permitting Management Port (8006)

• Before activating the firewall globally, first add rules to allow port 8006 (Proxmox GUI) and port 22 (SSH) in 'Datacenter' -> 'Firewall' -> 'Rules'

  Specifying the source (Source) so that access is possible only from a specific administrator #IP address further maximizes security

B. Utilizing Macros

• Proxmox has pre-defined frequently used port numbers like HTTP, HTTPS, and MySQL in the form of 'macros'

  You can quickly create #network security rules by simply selecting a macro without having to memorize complex port numbers

C. Flexibility of #Software Defined Security

• Security groups defined at the datacenter level can be applied to hundreds of VMs with a single click, dramatically increasing operational efficiency

  This becomes a core #resource for managing large-scale #virtualization infrastructure

---

4. Ensuring #Stability Through Monitoring and Logging

This is the process of checking if the firewall is working correctly and what attacks are being blocked

A. Log Level Configuration

• You can set the log level (LogLevel) in the 'Options' menu

  During initial setup, it is good to set it to 'info' or 'notice' to observe blocked traffic in real-time

B. Real-time Log Verification

• The 'Datacenter' -> 'Firewall' -> 'Log' tab shows the source IP, destination port, etc., of blocked packets in real-time

  Through this, you can identify abnormal access attempts and establish response strategies

C. #Infrastructure Security Optimization

• The firewall goes beyond simple blocking and also plays a role in maintaining the overall system performance

  By blocking unnecessary broadcast packets or DDOS attack attempts at a high level, you can expect an #optimization effect that reduces the CPU load of the host node

Datacenter-level firewall configuration is the heart and foundation of Proxmox security

I hope you make your virtualized environment a safer fortress through the activation process learned today

---

Firewall, Lecture, Method, Data, Performance, Network, Virtualization, Stability, Infrastructure, Optimization

---

Optimal performance, best cost efficiency! Experience Proxmox VE-based hosting that perfectly fits your project. Go to Luzen Hosting