[closed] Masquerading in Proxmox 7

[greg]

Greetings

I'm configuring a new Proxmox host which unfortunatly will have to run on a single IP, so I need masquerading for incoming connections.
I used to do that with a custom iptables script, but I wonder if I can do it directly with the Proxmox firewall GUI?

Thanks in advance

Regards

 

[oguz]

hi,

I used to do that with a custom iptables script, but I wonder if I can do it directly with the Proxmox firewall GUI?

no, not really. you can follow the instructions on our wiki though [0]

[0]: https://pve.proxmox.com/wiki/Networ...ith_tt_span_class_monospaced_iptables_span_tt

 

[greg]

Thanks for your answer.
I was hoping the new Proxmox would allow to manage that directly in the GUI, but that's ok I will continue using my old scripts (which are basically the same approach as what is in the wiki).
Regards

 

[oguz]

Thanks for your answer.
I was hoping the new Proxmox would allow to manage that directly in the GUI, but that's ok I will continue using my old scripts (which are basically the same approach as what is in the wiki).
Regards

you can make a feature request on our bugtracker [0]

[0]: https://bugzilla.proxmox.com

 

[t.lamprecht]

We won't add NAT/masquarading in the pve-firewall, but you could look into using SDN which already supports that via the "simple" zone: https://pve.proxmox.com/pve-docs/chapter-pvesdn.html#pvesdn_zone_plugin_simple

Needs to be installed currently as it's still in beta, but we got some good feedback already, fyi: the main author is quite active in the sdn beta thread: https://forum.proxmox.com/threads/proxmox-7-0-sdn-beta-test.69655/page-25

 

[greg]

Thanks for your answer. This seems way too complicated for a simple iptable command. It would have been handy to have it in the proxmox GUI as it can now request https certs, but since it's only a one-time configuration to have all the work done in a dedicated tool such as Traefik, so I'll go on with that.

 

[t.lamprecht]

Yeah, SDN is a bit more powerful, but FWIW, it'd be a one time config there too. Anyhow, use what works, and you can work with, so going for Traefik can surely be fine.

Just some context here: The Let's Encrypt/ACME implementation is currently mainly intended for the PVE nodes themselves, but yes, they could be used for doing exit gateway stuff, as you also figured - we could definitively see how we can implement the gateway part nicely and without the full SDN complexity exposed, IMO definitively interesting to look into in the future.