Layer 7 firewall sounds so wrong

You forgot telemetry 🤗

I may be dumb but I apply the firewall at the router level (OPNsense). That should be fine, right?

I wake up

I want to upgrade Proxmox

Open Amazon

Check the price of my wishlisted RAM

Cry

Go back to sleep

When will this end? 😭😭

Redirection errors, as per my my experience, can be due to

1. Incorrect destination port/IP (Checking the mapping)
2. Incorrect sub domain mapping (Check DNS)
3. Target website is https, so it’s expecting something else in the caddy request. You can resolve this by reducing the security options in the target website.

I have used caddy with immich but I didn’t require any modified redirection options.

The trick is to not mess around with proxmox 😉

Currently it has 4 cores. No problems so far, but i’ll be on the lookout. Thanks!

If you don’t mind the warning “Woah, I don’t trust this website”, you don’t need to buy any domains. Just use local certificates.

Sample caddyfile that I use

#------------- general options
{
    local_certs
}
#------------- services
service.server.lan {
	reverse_proxy <INTERNAL SERVER IP>:<INTERNAL SERVER PORT>
}

However, you need to have a DNS entry which points *.server.lan to the correct server. You can now visit https://service.server.lan/ which should point correctly.

Best of luck!

wanted a free solution

ends up buying a domain

Welcome to the club, buddy!

I am looking for a PDF editor which has support for digital signature. There are some which perform add a gpg signature, but clients want to see the green tick that Adobe provides. That’s why I have a internet-less Windows 7 VM having only Adobe Reader and Filezilla.

I think you have a typo here, eth1 is WAN not WLAN

Corrected!

When the VM goes down you can still configure the network manually on your PC and access proxmox directly

Yes, that’s why having this MGMT port is so important. Time to make some more cables :P

This is why the hardcoded ip will still work.

For some of the critical infra, I will probably hardcode the IP

I saw that you added the detail that you’re also running another vm - AFAIR you could route that via the management port as well with via proxmox without added complexity.

I’ve elaborated upon this in this comment in this thread. Please check and let me know your opinions.

Thanks, i may go this route.

FYI, you might occasionally run into issues where the NIC “GUID” changes so your VM won’t be able to start.

I think this is the same issue as a Linux host forgetting where to mount a disk since the UUID was not written in fstab.

But why does the GUID change? Can’t it be hard-coded?

Want setting change that requires a reboot from proxmox would result in a total lots of the network

Did you mean a setting change in proxmox? If yes, then I understand the risks.

Also, after the reboot does the setup comeback online automatically? Or do you need to perform some manual intervention?

So if you want to go that route I recommend you to use eth3 as dedicated port for proxmox.

I need a clarification here.

• eth1 = WAN. So it gets a public IP.
• eth2 = LAN. So it will get a 192.168.1.1 IP (this is usually hard-coded during OPNsense setup)
• eth3 = MGMT.
  • If this is out-of-band, that is, it will work even when OPNsense VM is down, how will it get the IP?
  • Should the IP for MGMT be hard-coded? Should it be in the same subnet or needs to be different?
  • If I want to access via MGMT, what will the routing table of the device on the other end (the desktop from which I will access Proxmox via MGMT) look like?

If you have any resources regarding this setup, please share.

Thank you for your response.

Edit: Changed WLAN to WAN

Enable pci passthrough for the card, use the onboard interface for proxmox management.

This is exactly what I want to do! If you have any resources which implements this, kindly share.

I understand completely. But I will try my best to keep the Proxmox setup as stable as possible (no unnecessary fiddling/power backup). This is mostly an experiment. I have my old router as backup as well. I just wish I had the foresight to buy a router which had OpenWRT support :(

Are you hosting more VMs on Proxmox that need network via a virtual switch?

Only one more VM which will host some services (to be accessed via a reverse proxy)

Are you providing network to other physical devices as well via a switch, so you need to output to that?

The Proxmox is connected to a switch, and all my other devices (other servers/PC/access point) are connected to this switch. Ideally, these services will connect to the OPNsense VM and get IP via DHCP from OPNsense.

Do you want OPNsense to be your gateway and assign IPs, or do you have a router?

OPNsense should be my public facing gateway, similar to what my current router (TP-Link) is doing. Currently, my router is connected to an ISP GPON. But it seems the GPON acts only as a fiber to ethernet converter. I use my ISP provided credentials on my ROUTER to authenticate with my ISP (via PPPoE)

As you have 3 NICs and sound like you want to use them, let’s assume you aren’t doing RoaS, but this could all be done on one (very busy) NIC.

RoaS? Router as a Service? I have no idea. I want to the 3rd port, but if you feel like this is a bit complicated, I can leave it for now, provided I don’t incur a heavy penalty for using the LAN port for traffic and Proxmox management.

And … you can do this!

Thank you, I needed that! I am just starting out with Proxmox and OPNsense and it seems a bit overwhelming. I am trying to start out small. In case everything blows up, I still have my old TP-Link router.

PS: Please check the original post as I have added a diagram regarding what I want to do.

Isn’t docker on windows just Linux in a trenchcoat?

That kind of thinking is too advanced for the general populace

It’s always standard OPSEC to anonymize/obfuscate your infra details.

If they are really concerned about privacy, host a local LLM and query it. You’ll get a subservient AI which doesn’t argue with you about data permanence, and all your data stays inhouse. Stop participating in public forums.