Hello everyone, I'm interested in using Proxmox for a home lab, and I was wondering why all the home labs I see use external firewalls like pfSense, WatchGuard, etc., instead of simply relying on the built-in firewall in Proxmox. Is the integrated firewall insufficient for protection?
Relevance of Proxmox firewall
- Thread starter Arthur777
- Start date
well I can't speak for others, but for me, I don't want to virtualize my firewall, so it is not running on proxmox. I have pfSense running on its own hardware. Plus it is awfully hard to duplicate what pfSense does (all the different features and functions) using just the Proxmox firewall. pfSense and the Proxmox firewall were built for different purposes and different use cases.
Ideally you combine both. A proper firewall appliance like pfsense/OPNsense for inter-subnet/VLAN-routing/firewalling (you should run your services isolated in DMZs, isolated management subnet for SSH/webUIs and so on) as well as all the nice features (intrusion prevention, VPN, recursive DNS, whatever).
That combined with the PVE firewall to block every guest-to-guest communication inside a subnet that isn't absolutely required.
So basically you use the PVE firewall instead of running something like UFW/iptables on the guestOS as a compromised guest could disable its own firewall while this isn't possible with the PVE firewall unless your PVE host got compromized too (and then you got way bigger problems...).
That combined with the PVE firewall to block every guest-to-guest communication inside a subnet that isn't absolutely required.
So basically you use the PVE firewall instead of running something like UFW/iptables on the guestOS as a compromised guest could disable its own firewall while this isn't possible with the PVE firewall unless your PVE host got compromized too (and then you got way bigger problems...).
Last edited: