VM network without seeing main router?

[Joseph Chrzempiec]

Hello, Is it possible to give a VM internet access but not let that VM reach the network? So they can't type in a router address of any kind.

Edit: What I mean is to isolate a VM to the internet only and not the rest of the network to other vm or router. I'm sorry I'm no means a linux or programmer, But I'm trying. So please forgive me if I'm phrasing this wrong.


Joseph

 

[gurubert]

Put that VM into a separate VLAN which only terminates on the router.

 

[Joseph Chrzempiec]

Put that VM into a separate VLAN which only terminates on the router.

Hello thank you. I never never did a Vlan before. And My router doesn'tr support Vlan. Does proxmox support that?

 

[Dunuin]

Hello, Is it possible to give a VM internet access but not let that VM reach the network? So they can't type in a router address of any kind.

Edit: What I mean is to isolate a VM to the internet only and not the rest of the network to other vm or router. I'm sorry I'm no means a linux or programmer, But I'm trying. So please forgive me if I'm phrasing this wrong.

What you are basically talking about is a DMZ. So a dedicated DMZ subnet where clients in that subnet can go online but got no access to your LAN subnet.
For that you will probably need a additional router because your ISPs router most probably won'T be able to route/NAT between multiple subnets. If you are lucky your router got something like a "guest mode" which you could activate for a specific enthernet port. AVM routers for example got this and stuff connected to this "guest port" will be in an isolated subnet with access to the internet but without access to your LAN. But atleast with AVM routers you won't be able to create port-forwards to this guest subnet, so its not that useful to host services and not a real alternative to getting an additional second router for a real DMZ.

One way to accomplish such a DMZ would be to run a OPNsense or pfsense VM on your PVE host. But that is not beginner friendly, even if everything can by done using a webUI.

 

[Joseph Chrzempiec]

What you are basically talking about is a DMZ. So a dedicated DMZ subnet which can go online but got no access to your LAN subnet.
For that you will need a additional router because your ISPs router most probably won'T be able to route/NAT between several subnets.

One way to accomplish such a thing would be to run a OPNsense or pfsense VM on your PVE host.

hello, i'm not Dmz'ing anything. I have multiple VM on proxmox all of them can access the internet. However I want to Isolate one of them just so it won't access the network but still be able to get on the internet.

 

[gurubert]

However I want to Isolate one of them just so it won't access the network but still be able to get on the internet.

Which is also called a DMZ or a separate network (aka VLAN).

You could try to achieve something similar with Proxmox' builtin firewall feature. But this will not save you from a misconfiguration in the VM.

 

[Dunuin]

Dont mix a "DMZ network" with what the consumer routers often wrongly describe as DMZ. They often call it "DMZ" when they actually mean a "exposed host". Which are completely different things.

https://en.wikipedia.org/wiki/DMZ_(computing)

 

[Joseph Chrzempiec]

Dont mix a "DMZ network" with what the consumer routers often wrongly describe as DMZ. They often call it "DMZ" when they actually mean a "exposed host". Which are completely different things.

https://en.wikipedia.org/wiki/DMZ_(computing)

I have a Pfsense Router. I have never done a Vlan or Dmz on it. I didn't even know There was Vlan on pfsense until Yesturday.


Joseph

 

[Dunuin]

Thats one of the great things a hardware router, like a pfsense or OPNsense, offers. But to really make use of it you also need a managed switch that supports tagged vlans. I've got alot of isolated subnets here so I can use the OPNsense firewall rules to manage which subnet might access what. A vlan for guests, so I need need to give guests access to my private services/data. A IoT vlan so smart home stuff can't go online unless I allow specific IPs/domains so they can't collect private data and send them to china or whereever that manufacturer sits and sells my data. A retro vlan for old devices that won't get any updates any longer and therefore shouldn't be allowed to go online anymore (but which I still want to access locally). A DMZ vlan for VMs that host services that should be accessible from the internet but shouldn't have the rights to access my LAN. A trusted LAN vlan which can access all other vlans and the internet. A vlan just for management. There are basically endless possibilities to increase the security and privacy by splitting your single LAN up into several separated subnets using VLAN with the pfsense in the middle controlling what might be routed and what not.

 

[Pierre-Yves]

Hello
You can probably reach your goal using Proxmox firewall host rules for the VM you do not want to communicate with others VMs.
Create an IPSet with all you VMs except the one you talk about and create a rule on your VM to block all trafic going to that IPSet.
It's a stupid answer as VLAN or FW (PFsense or OPNSense) will carry this far better but it may work ...
Regards