don't know if i get you right. If you use the same (public) ip for the proxmox server as the firewall, you might need selective nat.
So to send any tcp traffic arriving on the proxmox public ip to the vm-firewall at 10.99.99.1 except port ssh/22 and webgui/8006 to proxmox
put this in...