Security of firewall rule to block LAN communication

[coolness448]

I created a new firewall security group with the following rules and enabled the firewall in a VM.
IN ACCEPT -log nolog
OUT ACCEPT -dest 192.168.1.1 -log nolog
OUT DROP -dest 192.168.0.0/16 -log nolog
It appears to of successfully blocked all LAN communication because I can no longer ping local devices from that VM. I am wondering how secure this is. Say for example I were to enable root ssh on that VM, port forward 22 and post my IP and password online. Obviously I would quickly get DDOSed and have malware put on the VM and whatever but what are the chances of, for example, somebody accessing unsecured samba shares on my network. Would the only way of that happening be a major vulnerability in proxmox to be discovered and exploited? If so I'm assuming that would be quite rare. I should mention I am not trying to do something stupid nor am I incredibly paranoid, I just want to learn about if there is anything else to it. Id imagine that VLANs would be the normal way to do this but my router doesn't support them.

 

[_gabriel]

There isn't vulnerability in drop rules firewall, except human error configuration as always.
Overriding this is not possible within VM/Guest.

 

[shanreich]

If you want to publically expose your PVE host on the internet the better solution would be to use a VPN like WireGuard.

 

[coolness448]

If you want to publically expose your PVE host on the internet the better solution would be to use a VPN like WireGuard.

I am not wanting to publically expose the host. The purpose was actually to be able to port forward software I don’t trust in a VM without the chance of a vulnerability in that software to affect my host or other VMs.