Proxmox VE ships with a firewall managed from the web UI. It works at three levels (datacenter, node and VM/container), and the Proxmox firewall setup order matters: add allow rules first, enable the firewall second.
Before you start
- Console or IPMI access in case you lock yourself out.
- Your admin IP address (check your IP).
How the levels work
| Level | Where | Protects |
|---|---|---|
| Datacenter | Datacenter → Firewall | Global switch, cluster-wide rules, security groups, IP sets |
| Node | Node → Firewall | The Proxmox host itself |
| VM / CT | VM → Firewall | Traffic to that guest's NICs |
Proxmox firewall setup step by step
- Go to Datacenter → Firewall → IPSet and create a set named
managementwith your admin IPs. Proxmox automatically allows these to reach port 8006 and SSH when the datacenter firewall is on. - Add datacenter rules: accept TCP
8006(web UI) and22(SSH) from your admin IPs. In clusters, cluster traffic between nodes is allowed automatically on the local network. - Under Datacenter → Firewall → Options, set Firewall to Yes. The default input policy is DROP.
- Test in a new browser window and SSH session before closing your existing ones.
Warning: If you lock yourself out, log in through the console and run pve-firewall stop, then fix the rules.
Rules for VMs and containers
- Open the VM → Firewall and add rules, for example accept TCP 80 and 443.
- In Firewall → Options for the VM, set Firewall to Yes and choose the input policy.
- On the VM's network device (Hardware → Network Device), tick Firewall. Rules do nothing without this.
Security groups
Create a group at Datacenter → Firewall → Security Group, for example webserver with ports 80 and 443, and insert it into any VM's rules. Changing the group updates every VM that uses it.
Check afterwards
pve-firewall statusshows the firewall running.- Test blocked and allowed ports from outside with
nc -zv HOST 8006.
Troubleshooting
- Rules ignored for a VM: the Firewall box on the network device is not ticked, or the VM firewall option is off.
- Cluster nodes lose quorum: make sure corosync traffic is allowed if nodes talk over a non-local network.
Frequently asked questions
Is the Proxmox firewall enough on its own?
It is a strong outer layer; keep a firewall inside important VMs too.
Does it support IPv6?
Yes, rules apply to both IPv4 and IPv6 unless you specify addresses.
Should port 8006 be open to the internet?
Better not. Restrict it to admin IPs or a VPN (WireGuard VPN).