Networking Server SysAdmin Technology Virtualization

Deploying Proxmox 7 behind a firewall VM

How I run Proxmox with a single IP and MAC address.


Network information

Since I’m using Hetzner for the basis of this article, I could use their dashboard, Robot, to obtain the IP, netmask, and gateway by hovering my cursor over my server’s IP address:

For the sake of posterity and based upon Gushmazuko‘s Gist, Install any OS on Hetzner VDS, I’ll also demonstrate how to discover this information from within a Debian-based rescue system:

NIC name

NIC_NAME="$(udevadm info -e | \
grep -A 20 ^P.*$(ls /sys/class/net | grep ^e) | \
cut -d "=" -f2)"; echo $NIC_NAME;

In my case, it was enp41s0.


NIC_IP=$(ip -f inet addr show $NIC_NAME | awk '/inet / {print $2}'); echo $NIC_IP;

In my case, it was Using a CIDR calculator or looking at the Wikipedia article for Wildcard Masking, you can see that the /26 matches up to the netmask in the above screenshot,

NIC Gateway

NIC_GATEWAY=$(ip -4 route list 0/0 | cut -d ' ' -f 3); echo $NIC_GATEWAY;

In my case, it was


NIC_MAC=$(ip link show $NIC_NAME | grep link/ether | awk '{print $2}'); echo $NIC_MAC;

In my case, it was ca:fe:41:c0:ff:ee (not really)

Your results will be different, but these were my results which I used for installing Proxmox and building two network configurations for Proxmox (recovery and runtime) as well as configuring a virtualized firewall, and what you’ll see in the upcoming step, Configuration:

  • NIC Name: enp41s0
  • NIC IP:
  • NIC CIDR: /26
  • NIC Netmask:
  • NIC Gateway:

Storage information

To list the block devices attached to the server, and more specifically, the two NVMe SSD that I want to install Proxmox on:

lsblk | grep nvme | awk '{print $1}'

In my case, they were:

  1. nvme0n1 located at /dev/nvme0n1
  2. nvme1n1 located at /dev/nvme1n1

10 replies on “Deploying Proxmox 7 behind a firewall VM”

Great post. Thank you so much – exactly what I was looking for!
But I’m missing a step-by-step guide to include Traefik 2 to your setup.
Or can’t I simply find it?

Great post. Thanks!
I’m just in the process to replicate your setup.
Nearly everything is working but I can’t get any DNS servers working on OPT2. The traffic is routed over the WireGuard-VPN, all fine.
But it seems that any UDP traffic is blocked and I can’t figure out where to unblock it. Any hints much appreciated! Thank you.

Hi Andreas,

Off the top of my head, maybe I forgot to document the DNS Resolver section, but will have to go re-read my article and look for anything that I might have missed, but am in the middle of bee season (video of some of it: https://LTG.FYI/YouTube) and helping restore multiple ranches, so it may take me a moment.

I’ll e-mail you and try to figure it out with you. Once you and I figure this out, I’ll make appropriate edits to the article or one of us can write here in the comments about what needed to be changed.


EDIT: I e-mailed you and the e-mail bounced back as an invalid address. Please feel free to reach out again with a way for me to contact you, so that we can try and figure out what the problem is.

Thank you so much for your tutorial!!!

I can’t access the Ingress server from the VMS_Hetzner network, from external it’s working.
Like in your example: “Now I can access the simple server remotely by visiting
I can access the website from my browser, but not from a browser running with any VM on the VMS_Hetzner network.
Any idea which Firewall rule is blocking the access from VMS_Hetzner to WAN_Hetzner?

Hi Loomer, you are most welcome! 🙂

I used the interface’s address for the VMs to access the firewall interface. Please see for an example of a Virtual Machine accessing the firewall’s GUI via the VM interface address to configure it instead of the WAN address.

Best regards,

EDIT: I e-mailed you and the e-mail bounced back as an invalid address. Please feel free to reach out again with a way for me to contact you.

I am new to proxmox and your article just blew me away.

I just got the hetzner with 15hdd (no nvme) and I asked for KVM to install proxmox directly on the baremetal

But you do some sort of magic.
you boot into recovery and install proxmox in qemu?
I cannot say I follow
I am not sure I follow (and obviously I already broke my setup trying to change the network settings)

Hi Marcin,

I’ll e-mail you so that we can schedule a time for me to have office hours with you; you screen share with me in observation mode so that I can tell you what to click on and help you get up and running.

I’ll make a YouTube video out of it and then add one or more relevant videos to this article.

Talk soon,
Louis T. Getterman IV

Leave a Reply

Your email address will not be published. Required fields are marked *