Proxmox PVE-Firewall and OPNSense

[eXRuLeZz]

Hello all,

I have the following question:

I would like to configure Proxmox's firewall (pve-firewall) to allow SSH and Proxmox WebGUI only from my home and one of my VPN's but in the same time to not mess with my VMs traffic, as I have OPNSense with its own IP (additional IP from Hetzner, as my server is from Hetzner). As far as I know the Hetzner's router will bypass my Proxmox MAIN IP and send the traffic to the second IP (my OPNSesnse VM) using the MAC Address for the 2nd IP. IN this case if I config Proxmox's firewall to only allow incoming connections to SSH port, Ping and Proxmox's WebGUI from my IPs, this should not "harm" my OPNSense? I am correct?

Note: My Main IP and the 2nd IP are from the same network and use the same gateway if that matters somehow.

Does anyone have similar config?

Thank you in advance.

 

[shanreich]

If I understand your setup correctly, then no it should not be an issue since the Datacenter / Node firewall is independent from the VM firewall.

 

[eXRuLeZz]

Yes, I would like to use PVE-Firewall to restrict access to Proxmox's SSH and WebGUI only, and for VMs networking, I will setup the first VM using OPNSense which will act as a router and firewall, so that all VMs will be firewalled by OPNSense.

Thank you @shanreich