PVE firewall zone-based isolation lab

This lab demonstrates zone-based micro-segmentation using the built-in PVE firewall, without needing an external router/firewall VM.

Steps

1. Create test VMs

qm create 911 --name web --memory 1024 --cores 1 \
  --net0 virtio,bridge=vmbr0 --ostype l26
qm create 912 --name db --memory 1024 --cores 1 \
  --net0 virtio,bridge=vmbr0 --ostype l26
qm create 913 --name admin --memory 1024 --cores 1 \
  --net0 virtio,bridge=vmbr0 --ostype l26
qm start 911 912 913

Note each VM’s IP (use qm guest exec or check the GUI).

2. Enable the firewall cluster-wide

In the GUI: Datacenter → Firewall → Options → Firewall: Yes.

Or via CLI:

pvesh set /cluster/firewall/options --enable 1

3. Define security groups

# /etc/pve/firewall/group.cfg (cluster-wide)
group: web
  IN ACCEPT -p tcp --dport 80 -destination 192.168.1.0/24
  IN ACCEPT -p tcp --dport 443 -destination 192.168.1.0/24

group: db
  IN ACCEPT -p tcp --dport 5432 -source 192.168.1.50/32  # only from web
  IN DROP

group: admin
  IN ACCEPT -p tcp --dport 22 -source 10.0.0.0/24  # only from management
  IN ACCEPT -p icmp

4. Apply groups to VMs

pvesh set /vms/911/config --firewall 1
pvesh set /vms/911/firewall/groups --group web

pvesh set /vms/912/config --firewall 1
pvesh set /vms/912/firewall/groups --group db

pvesh set /vms/913/config --firewall 1
pvesh set /vms/913/firewall/groups --group admin

5. Verify isolation

From the web VM (911):

# Substitute the addresses you noted in step 1:
DB_IP=10.0.0.12
ADMIN_IP=10.0.0.13

ping -c 2 "$DB_IP"          # Should succeed (rule allows)
ssh "admin@$DB_IP"          # Should fail (db rules block ssh from anyone)
ping -c 2 "$ADMIN_IP"       # Should fail (admin rules only allow from mgmt)

From the admin VM (913):

# Substitute the addresses you noted in step 1:
WEB_IP=10.0.0.11
DB_IP=10.0.0.12

ping -c 2 "$WEB_IP"          # Should fail (web rules only allow 80/443)
ping -c 2 "$DB_IP"           # Should fail (db rules only allow 5432 from web)

6. Verify SSH bastion

SSH from your laptop into the admin VM using a host alias:

ssh admin@<admin-ip>
# Should succeed (your laptop is in the mgmt subnet)

7. Audit the rules

pvesh get /cluster/firewall/rules
# Expected: list of all rules compiled from the groups

# On the host, see the live iptables rules:
iptables -L -n -v | grep -E 'tap|fwbr'

Verification

• web VM can reach db on 5432 but not admin on any port
• admin VM cannot reach web or db
• SSH into admin works only from the management subnet
• All VMs can reach the gateway (for apt updates etc.)

Cleanup

qm stop 911 912 913 && qm destroy 911 912 913
# Remove the firewall groups file
rm /etc/pve/firewall/group.cfg

Notes

• The PVE firewall is a layer above iptables — it manages conntrack and rule ordering automatically.
• For multi-host clusters, the rules are cluster-wide but applied per VM on the host the VM is running on.
• For external segmentation, pair this with an SDN zone or external firewall.