Setting Proxmox behind Opnsense Firewall

[StoneCodes]

Hi,
iam trying to secure the proxmox host (dedicated server at hetzner) via a vm firewall (in this case opnsense).
But iam not really sure how to do it.
The functionallity i now have is:
I have 2 Public IP-Addresses one for the proxmox host and one for the opnsense vm.
The opnsense vm is working as gateway and firewall for all the vms in the private network (10.0.0.0/24)

Is it even possible to set the proxmox host behind this vm firewall?

Iam providing my network config i have right now.

auto lo
iface lo inet loopback

iface eno1 inet manual

auto vmbr0
iface vmbr0 inet static
        address  ***.***.***.124
        netmask 255.255.255.224
        gateway ***.***.***.97
        pointopoint ***.***.***.97
        bridge_ports eno1
        bridge_stp off
        bridge_fd 0

        up ip route add ***.***.***.58/32 dev vmbr0
        up ip route add 10.0.0.0/24 via ***.***.***.58 dev vmbr0

        up sysctl -w net.ipv4.ip_forward=1
        up sysctl -w net.ipv4.conf.eno1.send_redirects=0

auto vmbr30
iface vmbr30 inet static
        address 10.0.0.0
        netmask 255.255.255.0
        bridge_ports none
        bridge_stp off
        brdige_fd 0

 

[Rhinox]

Is it even possible to set the proxmox host behind this vm firewall?

It is possible, but I do not recommend it at all. If your VM-firewall goes down (and does not start), you have no way to fix it, except going to your server and using its console (or wipe it out and re-install completely). Bad things do happen sometimes, OPNsense-update can be screwed, VPN-server can crash, etc, etc.

In my setup I'm using dedicated firewall as front-end for Proxmox. BTW even that picture is still simplified, there are a few more tweaks (console-access, ip/power-switch, etc)...

 

[StoneCodes]

Well i see the downsides of my wanted setup you showed here, but i would like to test it. Its no production environment right now.
And if it turns into one iam gonna search for a solution with a hw firwall like u suggested.
So right now any help for the bridging would be appreciated