proxmox/docs/04-configuration/UDM_PRO_PROXMOX_FIREWALL_FIX.md

Proxmox Firewall Access Fix

Last Updated: 2026-01-14
Status: Active Documentation Issue: Proxmox firewall blocking access from Default network (192.168.0.0/24)
Solution: Configure firewall rules to allow Default network

---

Problem

Proxmox hosts may have firewall rules that block traffic from different subnets. Even though we changed the dev machine IP to 192.168.11.4, we should also fix the firewall to allow access from the Default network (192.168.0.0/24) for future flexibility.

---

Proxmox Hosts

Host	IP Address	Status
ml110	192.168.11.10	✅ Accessible
r630-01	192.168.11.11	✅ Accessible
r630-02	192.168.11.12	✅ Accessible

---

Solution: Configure Firewall Rules

Method 1: Automated Script (Recommended)

cd /home/intlc/projects/proxmox
./scripts/proxmox/fix-firewall-access.sh

What it does:

• Checks connectivity to all Proxmox hosts
• Adds firewall rule to allow 192.168.0.0/24
• Enables firewall if needed
• Compiles and restarts firewall

Method 2: Manual Configuration via Web UI

For each Proxmox host:

1. Access Web UI:

   • ml110: https://192.168.11.10:8006
   • r630-01: https://192.168.11.11:8006
   • r630-02: https://192.168.11.12:8006

2. Navigate to Firewall:

   • Datacenter → Firewall → Host Firewall

3. Add Rule:

   • Click "Add" or "Create"
   • Action: Accept
   • Source: 192.168.0.0/24
   • Protocol: All (or specific: TCP, UDP, ICMP)
   • Comment: "Allow Default Network"
   • Click "Create"

4. Enable Firewall (if not enabled):

   • Options → Enable: Yes
   • Save

Method 3: Manual Configuration via SSH/CLI

For each host, SSH and edit firewall config:

# SSH to host
ssh root@192.168.11.10  # ml110
# or
ssh root@192.168.11.11  # r630-01
# or
ssh root@192.168.11.12  # r630-02

# Edit host firewall
nano /etc/pve/firewall/host.fw

Add or update:

[OPTIONS]
enable: 1

[RULES]
# Allow Default Network (192.168.0.0/24)
IN ACCEPT -source 192.168.0.0/24 -log nocomment

Save and apply:

# Compile firewall rules
pve-firewall compile

# Restart firewall
pve-firewall restart

---

Firewall Rule Details

Rule Configuration

Action: ACCEPT
Direction: IN (incoming)
Source: 192.168.0.0/24
Destination: Any
Protocol: All
Port: Any
Log: No (nocomment)

Why This Rule?

• Allows Default network to access Proxmox hosts
• Maintains security - only allows specific source network
• Enables management from Default network devices
• Doesn't affect existing VLAN 11 access

---

Verification

Test Connectivity from Default Network

If you have a device on Default network (192.168.0.x):

# Test ping
ping -c 3 192.168.11.10  # ml110
ping -c 3 192.168.11.11  # r630-01
ping -c 3 192.168.11.12  # r630-02

# Test HTTPS (Proxmox web UI)
curl -k https://192.168.11.10:8006
curl -k https://192.168.11.11:8006
curl -k https://192.168.11.12:8006

# Test SSH
ssh root@192.168.11.10

Check Firewall Status

# On each Proxmox host
ssh root@192.168.11.10 "pve-firewall status"
ssh root@192.168.11.11 "pve-firewall status"
ssh root@192.168.11.12 "pve-firewall status"

View Firewall Rules

# View host firewall rules
ssh root@192.168.11.10 "cat /etc/pve/firewall/host.fw"
ssh root@192.168.11.11 "cat /etc/pve/firewall/host.fw"
ssh root@192.168.11.12 "cat /etc/pve/firewall/host.fw"

# View cluster firewall rules
ssh root@192.168.11.10 "cat /etc/pve/firewall/cluster.fw"

---

Additional Firewall Considerations

Proxmox Cluster Communication

If cluster nodes can't communicate, ensure firewall allows:

# Corosync ports (cluster communication)
IN ACCEPT -p tcp -dport 5405,5406,5407 -log nocomment

# SSH (for cluster management)
IN ACCEPT -p tcp -dport 22 -log nocomment

Web UI Access

Proxmox web UI uses port 8006 (HTTPS). Ensure it's accessible:

# Allow HTTPS access
IN ACCEPT -p tcp -dport 8006 -log nocomment

VM/Container Access

If VMs/containers need access, configure VM/container firewall rules separately.

---

Troubleshooting

Firewall Not Applying

1. Check firewall status:

   pve-firewall status
   

2. Verify config syntax:

   pve-firewall compile
   

3. Check logs:

   journalctl -u pve-firewall -f
   

Still Can't Access

1. Check if firewall is enabled:

   • Web UI: Datacenter → Firewall → Options
   • CLI: pve-firewall status

2. Verify rule exists:

   grep "192.168.0.0/24" /etc/pve/firewall/host.fw
   

3. Check rule order:

   • Rules are processed top to bottom
   • More specific rules should come first
   • Block rules should come after allow rules

4. Test from different source:

   • Try from VLAN 11 device
   • Try from Default network device
   • Check if issue is network-specific

SSH Access Issues

If SSH is blocked:

1. Add SSH rule:

   IN ACCEPT -p tcp -dport 22 -log nocomment
   

2. Or allow all from Default network:

   IN ACCEPT -source 192.168.0.0/24 -log nocomment
   

---

Security Considerations

Current Configuration

• ✅ Allows access from Default network (192.168.0.0/24)
• ✅ Allows access from VLAN 11 (192.168.11.0/24)
• ⚠️ Consider restricting to specific IPs if needed

Enhanced Security (Optional)

If you want more restrictive access:

# Allow only specific IPs from Default network
IN ACCEPT -source 192.168.0.23 -log nocomment  # Specific dev machine
IN ACCEPT -source 192.168.0.1 -log nocomment   # UDM Pro

Or use IP sets:

# Create IP set
[IPSET ipfilter-net]
192.168.0.23
192.168.0.1

# Use in rule
IN ACCEPT -source +ipfilter-net -log nocomment

---

Related Documentation

• UDM_PRO_PROXMOX_CLUSTER.md - Cluster configuration
• UDM_PRO_ROUTING_ISSUE_RESOLVED.md - Routing fix
• UDM_PRO_NETWORK_ISOLATION_CHECK.md - Network isolation

---

Last Updated: 2026-01-14