Proxmox Hardening
Took over a stalled firewall build on a client's OVH-hosted Proxmox server and delivered a locked-down network reachable only through a VPN.
Architecture at a glance
data flows left to right- Admin device
- OpenVPN tunnel
- pfSense firewall
- Internal bridge
- Internal servers
connectedfail2banKey-only SSHConfig backup
The problem
A previous attempt to put the client’s servers behind a firewall had stopped partway. The router VM would not start and the servers were exposed directly on the public internet.
What I did
- Found the root cause of the earlier failure: the internal bridge was created in the Proxmox UI but never applied, so the router VM could not start.
- Found one OVH virtual MAC assigned to two running VMs on the same bridge.
- Installed pfSense on an OVH additional IP with a non-local gateway, and moved the servers onto an internal network behind it.
- Switched host SSH to key-only and added a fail2ban jail for the Proxmox web UI, tested against real logs.
- Set up OpenVPN with its own certificate authority and a VPN-only user, so RDP to the Windows server works only through the tunnel.
- Backed up the firewall configuration.