Proxmox and pfSense: How does proxmox know "not to listen" on the port connected to WAN?

[ott]

When using proxmox to run pfSense, i.e. as the edge router/firewall: How does proxmox know "not to listen" on the port connected to WAN?

As I have learned, per default Proxmox listens on all interfaces (https://pve.proxmox.com/pve-docs/pveproxy.8.html)

I have run pfSense bare metal for years, but got new HW and consider running pfSense as VM. Arguments regarding whether to run edge router/firewall as VM aside. How do you set up (harden) proxmox/cluster such that it "secure"?

 

[shrdlicka]

Hi,
if you don't give the WAN interface an IP in /etc/network/interfaces it won't listen on that interface. So for example something like this if eno1 is your wan interface.

iface eno1 inet manual


auto vmbr0
iface vmbr0 inet static
    bridge-ports eno1
    bridge-stp off
    bridge-fd 0

iface eno2 inet manual

auto vmbr1
iface vmbr1 inet static
    address 192.168.10.20/24
    gateway 192.168.10.1
    bridge-ports eno2
    bridge-stp off
    bridge-fd 0

pfSense would need both vmbr0 and vmbr1

 

[ott]

Thanks again!

So, in your example, eno1 will never get an IP (even if my ISP provides one) since it is set to manual? However, if it was iface eno1 inet dhcp it would, right?

The pfsense VM has a two vNICs connected to each of the vmbr's (vWAN -> vmbr0 and vLAN -> vmbr1). vLAN naturally has my .1 IP, and vWAN is assigned an IP from my ISP, correct?

 

[shrdlicka]

So, in your example, eno1 will never get an IP (even if my ISP provides one) since it is set to manual?

Yes without DHCP it will never try to get one.

However, if it was iface eno1 inet dhcp it would, right?

Yes that would happen. On a sidenote: as far as I remember it is not idea to let the physical interface have an IP if there is a network bridge attached.

vLAN naturally has my .1

.1 in the some local network i presume

IP, and vWAN is assigned an IP from my ISP, correct?

Yes you should get an IP via DHCP on that interface.

 

[ott]

.1 in the some local network i presume

Yes, correct.

Is there any (security) benefit to adding host based access control(/etc/default/pveproxy)? e.g.:

ALLOW_FROM="10.0.0.0/24"
DENY_FROM="all"
POLICY="allow"

 

[shrdlicka]

Limiting access can help in regards to security. You can set the LISTEN_IP as well https://pve.proxmox.com/pve-docs/pveproxy.8.html