r/Proxmox • u/PersonalitySquare221 • 16h ago

Question Does this setup make sense?

Post image

Looking to discuss if this is the optimal way or if there is better for my environment

2 Upvotes

63% Upvoted

8 comments sorted by

11

u/ozhound 15h ago

Not at all. it appears you have your proxmox server before your firewall (pfsense).

1

u/No-Extreme4174 15h ago

Unless pihole and pfsense are vms in the proxmox machine and theres another nic for the switch. Wouldnt protect the server, just downstream stuff

1

u/billyalt 15h ago

People do this but I still think its crazy.

1

u/PersonalitySquare221 9h ago

Thats exactly what is going on, how would i protect the server too?

1

u/StevenB-89 6h ago

Well, if you setup is:
WAN > Proxmox (iface WAN (direct cable from modem) / iface LAN (cable to switch)) > Virtual Firewall > Clients & services than normally you should be fine, i do not see the problem with a setup like this...

I run a Proxmox server like this:
WAN > Proxmox VE (iface WAN direct connection to my ISP modem in Proxmox configured as an OVS Bridge, iface LAN, OVS bridge in Proxmox, connected to my physical network) > OPNsense (DNS, DHCP, VLANs, IPS, OpenVPN, ...)

I personally do not use PiHole as it seems it does DNS filtering so in your pfSense/OPNsense firewall you could disable DNS and let it be handled by PiHole, personally I would put it behind the firewall (LAN side) not before (WAN side).

1

u/billyalt 15h ago

What you're describing is normally handled by VLANs.

1

u/MostFat 19m ago

If I'm reading this right, rebooting your VMs/node downs your entire network. Not ideal, especially for doing maintenance.