Are my rules corrects for securing proxmox

[openaspace]

Hi.
Are my rules correct?
Thank you in advance.
I have performed a full tcp and udp port scan with Zenmap and the proxmox host appear completely without open ports.
-------------------------
Rules are applied on the main cluster ,not node:

• any INPUT connection from my static ip, also dedicated rule for my static ip for proxmox port and ssh;
• any OUTPUT connection from enp4s0 main host to my static ip;
• Drop any icmp;
• General IN DROP.

Firewall enabled on the node with no rules ( cascade from cluster)
Firewall not enabled on the vmbr0 where is running pfsense with it's own rules.

enp4s0 host ethernet
vmbr0 bridge to the main host -> pfsense dedicated public ip
vmbr1 pfsense private virtual network

 

[Richard]

Are my rules correct?

Depends on what you want to achieve (you did not mention it). In case of high complexity the best practice is to try - AFAIU that's exactly what you were going to do already.