How to enable node level firewall rules that do not apply to guests?

[Proxygen]

I need to allow 22 and 8006 for a node, since it is outside my local LAN. How do I allow these ports for the node but not for guests? Is the only choice to specifically add a security group with 2 drop rules for each guest?

 

[tim]

These are 2 logical zones please see: https://pve.proxmox.com/pve-docs/pve-admin-guide.html#chapter_pve_firewall