Deploying Proxmox 7 behind a firewall VM

Configuration

Proxmox

First, download the Proxmox ISO to the server, and take note of the path. For the sake of simplicity, I saved it to /tmp/proxmox.iso using the following command after I right-clicked on the download link and copied the generated URL:

wget \
    --output-document="/tmp/proxmox.iso" \
    "https://PROXMOX-DOWNLOAD-URL"

Then, download a VNC client such as Screens and configure it to use an SSH tunnel to your server with VNC running on the local host:

Install

Using information from above, specifically, the ISO path and the NVMe SSD device paths, it’s now time to launch the Proxmox installer via virtualization:

qemu-system-x86_64 \
    -enable-kvm \
    -smp 4 \
    -m 4096 \
    -boot d \
    -cdrom /tmp/proxmox.iso \
    -drive file=/dev/nvme0n1,format=raw,media=disk \
    -drive file=/dev/nvme1n1,format=raw,media=disk \
    -vnc 127.0.0.1:0

When you proceed, the installer will warn you that it doesn’t support KVM virtualization. Click OK to proceed to the next step.

When you reach the target installation screen, consider employing redundancy with ZFS RAID1 to run your system so that it will continue running even if one of your two hard drives fails:

Since Daylight Saving Time is the bane of my existence I disable it in the installer by selecting the timezone of one of the few sensible states out of the entirety of the U.S.A., Arizona (GMT -7). Once I have Proxmox up and running, I proceed to switch the system from Arizona to UTC:

After setting the location and time zone, you will be prompted to create an administrator account. Please ensure that your password is complex, because your management interface will be briefly exposed on the Internet in one of the subsequent steps until we secure it behind the virtualized firewall.

Remember the network information that we gathered in the beginning of this article? This is where it comes into play, which behind the scenes is provisioning /etc/network/interfaces which we will modify in an upcoming step. Please note that the interface is wrong due to emulation, and we will fix that in a subsequent step. For an initial DNS server, I use 1.1.1.1.

On the topic of DNS: once I have Proxmox up and running, I proceed to add additional DNS servers, such as Google’s DNS.

Before proceeding with the installation, please confirm that your settings are correct. Upon completion, the only option will be to reboot the server (whether or not you enable automatic reboot) and the initial installation screen will appear again. When the initial installation screen appears, switch back to your rescue terminal and hit CTRL-C (^C) to stop emulating the Proxmox installer.

Network

Now it’s time to launch our freshly installed Proxmox and work on the network configuration:

qemu-system-x86_64 \
    -enable-kvm \
    -smp 4 \
    -m 4096 \
    -boot c \
    -drive file=/dev/nvme0n1,format=raw,media=disk \
    -drive file=/dev/nvme1n1,format=raw,media=disk \
    -vnc 127.0.0.1:0

After logging in with the user, root, and the password that you set in the installer, you’ll need to create two files in /etc/network/ which will be used to overwrite /etc/network/interfaces based upon your needs:

1. Recovery
2. Runtime

Recovery

Remember the steps that we used to obtain the NIC Name? That comes into play here. Let’s start by modifying /etc/network/interfaces and subsequently backing it up to /etc/network/config-recovery.

To replace the NIC Name from ens3 (which was set during the virtualized installation) to my NIC Name, enp41s0:

sed -i 's/ens3/enp41s0/g' /etc/network/interfaces

Now add a second network bridge which will be used in a subsequent step for configuration:

cat << 'EOF' >> /etc/network/interfaces

auto vmbr1
iface vmbr1 inet static
        address 192.168.1.2/29
        gateway 192.168.1.1
        bridge-ports none
        bridge-stp off
        bridge-fd 0
#Firewall LAN: Proxmox — vtnet1

EOF

The final result of /etc/network/interfaces:

source /etc/network/interfaces.d/*

auto lo
iface lo inet loopback

iface enp41s0 inet manual

auto vmbr0
iface vmbr0 inet static
	address 65.109.71.115/26
	gateway 65.109.71.65
	bridge-ports enp41s0
	bridge-stp off
	bridge-fd 0
#Firewall WAN — vtnet0

auto vmbr1
iface vmbr1 inet static
        address 192.168.1.2/29
        gateway 192.168.1.1
        bridge-ports none
        bridge-stp off
        bridge-fd 0
#Firewall LAN: Proxmox — vtnet1

Now that we have a working configuration file, let’s back it up to /etc/network/config-recovery and also build the foundation of our runtime network configuration:

{

    cp -va \
        /etc/network/interfaces \
        /etc/network/config-recovery \
    ;

    cp -va \
        /etc/network/interfaces \
        /etc/network/config-runtime \
    ;

}

Runtime

This is going to be a bit of an exotic setup that may seem daunting at first. This is based on a Proxmox forum post, [TUTORIAL] Proxmox @ Hetzner, using a single public IPv4 address (+IPv6/64) while all traffic, including host goes through virtualized Firewall (ex. Pfsense), by effgee. The objectives of this configuration are:

• Use a Single IP address.
• Change the server’s physical MAC address to an unused one. Since I keep bees, I opted for “beeeeeeeeees!”: be:ee:ee:ee:ee:e5 — you can set this to whatever you want since it’s not going to be used.
• Place a virtualized firewall in front of everything, including the Proxmox host with the server’s physical MAC address: ca:fe:41:c0:ff:ee
• Create four network bridges:
  1. WAN: Internet ↔︎ Firewall
  2. LAN: Firewall ↔︎ Proxmox
  3. LAN: Firewall ↔︎ Virtual Machines on initial IP address
  4. Optional LAN: Firewall ↔︎ Virtual Machines on additional IP address(es)

/etc/network/config-runtime

source /etc/network/interfaces.d/*

auto lo
iface lo inet loopback

auto enp41s0
iface enp41s0 inet manual
	hwaddress ether be:ee:ee:ee:ee:e5
#Physical Card

auto vmbr0
iface vmbr0 inet manual
	bridge-ports enp41s0
	bridge-stp off
	bridge-fd 0
	bridge_maxwait 0
	pre-up ebtables -t nat -A POSTROUTING -j snat --to-src ca:fe:41:c0:ff:ee -o enp41s0
#Firewall WAN — vtnet0

auto vmbr1
iface vmbr1 inet static
	address 192.168.1.2/29
	gateway 192.168.1.1
	bridge-ports none
	bridge-stp off
	bridge-fd 0
#Firewall LAN: Proxmox — vtnet1

auto vmbr2
iface vmbr2 inet static
	address 172.16.0.0/24
	gateway 172.16.0.1
	bridge-ports none
	bridge-stp off
	bridge-fd 0
#Firewall LAN: VMs (Single IP) — vtnet2

auto vmbr3
iface vmbr3 inet static
	address 172.16.1.0/24
	gateway 172.16.1.1
	bridge-ports none
	bridge-stp off
	bridge-fd 0
#Firewall LAN: VMs (Optional: Additional IP) — vtnet3

This concludes our network configurations. Inside of the emulated Proxmox instance, shut it down:

shutdown -h now

Now in the rescue shell, reboot the physical server, which should load into Proxmox:

reboot

After a moment, you should be able to access your Proxmox instance by going to https://YOUR-SERVER-IP:8006/ and logging in with the root account and the password that you set during installation.

Assuming that you’re using Proxmox for personal or evaluation use, you’ll need to switch from the enterprise to community Proxmox repository:

Now that the repositories are configured, refresh and upgrade the packages. A window will open with a terminal, and after upgrading, you can install Mosh if you’re like me, and need to maintain connections when roaming or across cellular and satellite connections. Depending on what was upgraded, you may need to reboot the node after you finish: