[SOLVED] Hetzner Proxmox with pfsense config

Kingster8400

New Member
Mar 8, 2026
2
0
1
Trying to setup the networking side so that my VMs in Proxmox can receive packets (want to set up some game servers). Think I've messed up my routing somewhere but been at it for a couple days and can't figure it out.

My WAN port for pfsense is vmbr0 and my LAN port for my vms is vmbr1
On the firewall I can ping 1.1.1.1 but on my VMs on the LAN network it can only ping the firewall and other devices on the LAN but cannot access the internet - though once on a test client machine it did access the internet but after restarting it the internet access was lost again. I also have had intermittent access to the pfsense web portal via a machine on the LAN. DHCP also works within the LAN.

Any help would be appreciated!

https://community.hetzner.com/tutor...ure-proxmox_ve#step-2---network-configuration

Followed the Hetzner guide for the NAT Masquerade configuration

Proxmox Interfaces setup:

source /etc/network/interfaces.d/*

auto lo
iface lo inet loopback

iface lo inet6 loopback

auto enp4s0
iface enp4s0 inet static
address hetznerip/26
gateway hetznerip gateway
up route add -net hetznerip netmask 255.255.255.192 gw hetznerip dev enp4s0
#post-up echo 1 > /proc/sys/net/ipv4/ip_forward

post-up iptables -t nat -A PREROUTING -i enp4s0 -p tcp -m multiport ! --dports 22,8006 -j DNAT --to 10.35.9.2
post-down iptables -t nat -D PREROUTING -i enp4s0 -p tcp -m multiport ! --dports 22,8006 -j DNAT --to 10.35.9.2

iface enp4s0 inet6 static
address 2a01:4f8:212:19d7::2/64
gateway fe80::1

auto vmbr0
iface vmbr0 inet static
address 10.35.9.1/24
bridge-ports none
bridge-stp off
bridge-fd 0
post-up iptables -t nat -A POSTROUTING -s '10.35.9.0/24' -o enp4s0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '10.35.9.0/24' -o enp4s0 -j MASQUERADE

auto vmbr1
iface vmbr1 inet static
address 10.36.9.1/24
bridge-ports none
bridge-stp off
bridge-fd 0


1772991645239.png
 
I'm stupid :D - just changed the firewall IP to .254 and it now works.. as the IP was being used by the interface. VM's can now access the internet and its being forwarded as it should.