Networking Server SysAdmin Technology Virtualization

Deploying Proxmox 7 behind a firewall VM

How I run Proxmox with a single IP and MAC address.


  • Knowledge of the Linux Operating System and network security — this is a tutorial for advanced users!
  • A dedicated server, such as an Hetzner Dedicated Server or an Intel NUC — in an upcoming article, I’ll cover how I use one to run multimedia, climate control, spotlights, and cameras:


You have two ways to go about obtaining a bare-metal server with Hetzner:

  1. Dedicated
  2. Auctioned

There are differences in the hardware choices, but the most notable difference is the setup fee that’s approximately the cost of the first month of service. I went with the dedicated option because I didn’t want to wait up to a day to see if I won an auction and try again if I didn’t, and I wanted to hit the ground running and get to work immediately. I opted for an AX41-NVMe server:

  • CPU Model: AMD Ryzen™ 5 3600 6-Core Processor
  • CPU speed: 3.6 GHz
  • CPU sockets: 1
  • CPU cores per socket: 6
  • CPU threads per core: 2
  • CPUs: 1 * 6 * 2 = 12 (so, 12 virtual CPUs will be available)
  • RAM: 64 GB DDR4
  • Storage: 2 x 512 GB NVMe SSD
  • Location: Helsinki, Finland
    • Due to rising energy costs in Germany with the ongoing Russian war, I opted for locating the server in Helsinki, Finland for a slightly cheaper price.

Once the server is setup, Hetzner will send an e-mail letting you know that the server is booted into the Rescue System. As the instructions state, you can now access your new server with the details provided in the e-mail, or at a later time you can use the Rescue and Reset tabs in the dashboard:

10 replies on “Deploying Proxmox 7 behind a firewall VM”

Great post. Thank you so much – exactly what I was looking for!
But I’m missing a step-by-step guide to include Traefik 2 to your setup.
Or can’t I simply find it?

Great post. Thanks!
I’m just in the process to replicate your setup.
Nearly everything is working but I can’t get any DNS servers working on OPT2. The traffic is routed over the WireGuard-VPN, all fine.
But it seems that any UDP traffic is blocked and I can’t figure out where to unblock it. Any hints much appreciated! Thank you.

Hi Andreas,

Off the top of my head, maybe I forgot to document the DNS Resolver section, but will have to go re-read my article and look for anything that I might have missed, but am in the middle of bee season (video of some of it: https://LTG.FYI/YouTube) and helping restore multiple ranches, so it may take me a moment.

I’ll e-mail you and try to figure it out with you. Once you and I figure this out, I’ll make appropriate edits to the article or one of us can write here in the comments about what needed to be changed.


EDIT: I e-mailed you and the e-mail bounced back as an invalid address. Please feel free to reach out again with a way for me to contact you, so that we can try and figure out what the problem is.

Thank you so much for your tutorial!!!

I can’t access the Ingress server from the VMS_Hetzner network, from external it’s working.
Like in your example: “Now I can access the simple server remotely by visiting
I can access the website from my browser, but not from a browser running with any VM on the VMS_Hetzner network.
Any idea which Firewall rule is blocking the access from VMS_Hetzner to WAN_Hetzner?

Hi Loomer, you are most welcome! 🙂

I used the interface’s address for the VMs to access the firewall interface. Please see for an example of a Virtual Machine accessing the firewall’s GUI via the VM interface address to configure it instead of the WAN address.

Best regards,

EDIT: I e-mailed you and the e-mail bounced back as an invalid address. Please feel free to reach out again with a way for me to contact you.

I am new to proxmox and your article just blew me away.

I just got the hetzner with 15hdd (no nvme) and I asked for KVM to install proxmox directly on the baremetal

But you do some sort of magic.
you boot into recovery and install proxmox in qemu?
I cannot say I follow
I am not sure I follow (and obviously I already broke my setup trying to change the network settings)

Hi Marcin,

I’ll e-mail you so that we can schedule a time for me to have office hours with you; you screen share with me in observation mode so that I can tell you what to click on and help you get up and running.

I’ll make a YouTube video out of it and then add one or more relevant videos to this article.

Talk soon,
Louis T. Getterman IV

Leave a Reply

Your email address will not be published. Required fields are marked *