Learn Proxmox VE - Software-Defined Networking (SDN) & Internal Firewall

#Introduction

Episode 9 gave you a tidy physical network. Episode 10 takes it one step further: building a virtual network managed entirely from Proxmox — without ever touching a physical switch. This is the world of Software-Defined Networking (SDN).

In the second half, you'll enable Proxmox's internal firewall: a tiered defense from the datacenter down to each individual VM, complete with security groups and IP sets. By the end of the episode, you'll be able to build isolated virtual networks and fortify them with firewall rules.

#Proxmox SDN

#Virtual Network Zones and VNets

Proxmox SDN introduces two main concepts. A Zone is a virtual network domain — where virtual network traffic originates. A VNet is a logical network inside a zone, equivalent to a VLAN or virtual subnet. The combination lets you create isolated networks between VMs without any physical switch configuration.

Zone (e.g. simple-zone) -> VNet (e.g. web-net, db-net) -> VM

Everything is managed in Datacenter -> SDN in the web UI. Once a zone is created, you just create VNets and attach VMs to them.

#Zone Types: Simple and VLAN

• Simple Zone: creates a virtual network inside the node without needing physical VLAN tags. VMs on the same VNet can communicate with each other, and the traffic is translated to a local bridge. Suitable for homelabs and laboratories.
• VLAN Zone: maps VNets to physical VLANs in your network, so VMs across different nodes can communicate through the same physical network. This is the bridge between the virtual and physical worlds.

Simple : isolation inside the node, without physical tags
VLAN   : isolation between nodes via physical VLAN tags

#VXLAN and EVPN for Large Scale

For large clusters and data centers, Proxmox SDN supports VXLAN overlay — a layer 2 network over a layer 3 network — and EVPN (Ethernet VPN) as the modern control plane. Both allow VNets to span scattered nodes without being tied to physical topology. It's enough to understand this phase as the direction of Proxmox SDN development; your focus should be on simple and VLAN zones first.

#Creating a VNet Step by Step

The practical flow for creating a virtual network in the web UI:

1. Open Datacenter -> SDN -> Zones and create a new zone.
2. Choose the zone type: Simple or VLAN.
3. Open Datacenter -> SDN -> VNets and create a VNet inside that zone.
4. Assign the VNet to the available bridge or VLAN.
5. In the VM's network configuration, select the VNet as the destination bridge.

Create zone -> create VNet -> choose bridge -> attach to VM

Once the VNet is created, it appears as a virtual bridge in the network list on the VM page. Select that VNet as the bridge, and the VM immediately becomes a member of its virtual network.

#Testing VNet Isolation

To make sure isolation works, create two VMs in different VNets and test connectivity:

ping 10.10.10.5   # from a VM in the web-net VNet

If the two VNets are indeed separate, pings between VNets should fail, while pings within the same VNet succeed. This is a quick verification that network segregation is working.

#Proxmox Built-in Firewall

#Firewall Hierarchy

The Proxmox firewall follows a three-level hierarchy, and rules at an upper level apply to all levels below it:

• Datacenter level: global rules for all nodes.
• Node level: rules applying to traffic to and from the node.
• VM/Container level: rules per VM or container.

Datacenter -> Node -> VM/CT

Enable the firewall at Datacenter -> Firewall -> Options for the datacenter level, and enable it per VM on the VM's firewall page. Without being enabled, the firewall does nothing.

#Security Groups and Rules

Security Groups are collections of rules reusable across many VMs. A common pattern: create a web-server group with rules opening ports 80 and 443, then attach it to all web VMs.

IN  ACCEPT TCP  from 10.0.0.0/8 to port 443
IN  DROP  TCP  to all other ports
OUT ACCEPT all

Rules are evaluated in order: the first matching rule wins. Put the most specific rules at the top and deny rules at the bottom.

#IP Sets and Macros

To manage long lists of IPs, Proxmox provides IP sets — lists of addresses that can be referenced by a single name across many rules. Proxmox also has built-in macros like ACCEPT, DROP, and TRACKED to shorten the writing. The combination of IP sets and macros keeps firewall configuration readable even with hundreds of rules.

cat /etc/pve/firewall/cluster.fw

The cat /etc/pve/firewall/cluster.fw command shows the datacenter-level firewall configuration file — where cluster-level rules and IP sets are stored.

#Writing Rules via the CLI

Firewall rules are stored as text files in /etc/pve/firewall/. Each level has its own file: cluster.fw for the datacenter, <node>.fw for the node, and <id>.fw for VMs. Rules are written with an easy-to-read syntax:

[IN]
ACCEPT tcp from 10.0.0.0/8 to vm:100 port 80
DROP tcp from 0.0.0.0/0 to vm:100
 
[IPSet]
webserver 10.0.0.10,10.0.0.11

Thanks to these text-based files, firewall configuration can be managed with git and reviewed like code — an approach highly favored by teams applying infrastructure as code.

#Closing

Episode 10 completed your network defense: building zones and VNets with SDN, choosing the right zone type, understanding the firewall hierarchy from datacenter down to VM, and tidying up rules with security groups, IP sets, and macros.

The key takeaways:

• SDN creates virtual zones and VNets without physical switch configuration.
• Simple zones for local isolation; VLAN zones for cross-node.
• VXLAN and EVPN bring SDN to data center scale.
• The firewall is tiered: datacenter, node, then VM/CT.
• Security groups allow rule reuse across VMs.
• Use IP sets and macros for readable configuration.

In the next episode, episode 11, we will cover backup and restore strategy — leveraging vzdump with various backup modes, scheduling backup jobs, and getting to know Proxmox Backup Server with incremental backups, deduplication, and encryption. Your network is secure; now it's time to make sure your data can always be restored!