Virtualized Firewall with Color-Coded Zones
Physical Layout
Internet (ISP)
|
| [Physical NIC 1 - RED/WAN]
|
┌────▼────────────────────────────────────────┐
│ Proxmox Host (4 NICs) │
│ │
│ NIC1: enp1s0 (RED - WAN/Internet) │
│ NIC2: enp2s0 (Trunk - VLANs 10,20,30) │
│ NIC3: enp3s0 (Optional trunk/backup) │
│ NIC4: enp4s0 (Proxmox management) │
│ │
│ ┌─────────────────────────────────────┐ │
│ │ Proxmox SDN Configuration │ │
│ │ │ │
│ │ Zone: RED (no VLAN, direct) │ │
│ │ Zone: GREEN (VLAN 10) │ │
│ │ Zone: ORANGE (VLAN 20) │ │
│ │ Zone: BLUE (VLAN 30) │ │
│ └─────────────────────────────────────┘ │
│ │
│ ┌─────────────────────────────────────┐ │
│ │ Firewall VM (IPFire/OPNsense) │ │
│ │ │ │
│ │ vtnet0 → vmbr0 (RED) [WAN] │ │
│ │ vtnet1 → vmbr10 (GREEN) [LAN] │ │
│ │ vtnet2 → vmbr20 (ORANGE) [DMZ] │ │
│ │ vtnet3 → vmbr30 (BLUE) [Wireless]│ │
│ └─────────────────────────────────────┘ │
│ │
│ ┌─────────────┐ ┌─────────────┐ │
│ │ Server VMs │ │ DMZ VMs │ │
│ │ (GREEN) │ │ (ORANGE) │ │
│ │ → vmbr10 │ │ → vmbr20 │ │
│ └─────────────┘ └─────────────┘ │
└─────────────────────────────────────────────┘
|
| [Physical NIC 2 - Trunk with VLANs]
|
┌────▼────┐
│ Managed │
│ Switch │
│ (VLANs) │
└────┬────┘
|
┌─────────┼─────────┐
| | |
[VLAN 10] [VLAN 20] [VLAN 30]
GREEN ORANGE BLUE
Servers DMZ Wireless
Proxmox Network Configuration
Bridge Configuration
# /etc/network/interfaces
# Management interface (Proxmox web UI access)
auto enp4s0
iface enp4s0 inet static
address 10.1.2.10/24
gateway 10.1.2.1
# RED Zone - WAN/Internet (dedicated, no VLAN)
auto vmbr0
iface vmbr0 inet manual
bridge-ports enp1s0
bridge-stp off
bridge-fd 0
bridge-vlan-aware no
# This bridge is ONLY for firewall WAN interface
# VLAN-aware trunk bridge for internal zones
auto vmbr1
iface vmbr1 inet manual
bridge-ports enp2s0
bridge-stp off
bridge-fd 0
bridge-vlan-aware yes
bridge-vids 10 20 30
# Carries all internal VLANs
# GREEN Zone - Servers (VLAN 10)
auto vmbr10
iface vmbr10 inet manual
bridge-ports enp2s0.10
bridge-stp off
bridge-fd 0
# Proxmox host can have IP here for management
# address 10.10.10.2/24
# ORANGE Zone - DMZ (VLAN 20)
auto vmbr20
iface vmbr20 inet manual
bridge-ports enp2s0.20
bridge-stp off
bridge-fd 0
# BLUE Zone - Wireless (VLAN 30)
auto vmbr30
iface vmbr30 inet manual
bridge-ports enp2s0.30
bridge-stp off
bridge-fd 0
Alternative: Using Proxmox SDN (Web UI)
Instead of manual bridge config, use Proxmox SDN:
Datacenter → SDN → Zones:
Zone: zone_red
Type: Simple
Bridge: vmbr0
Zone: zone_green
Type: VLAN
Bridge: vmbr1
Tag: 10
Zone: zone_orange
Type: VLAN
Bridge: vmbr1
Tag: 20
Zone: zone_blue
Type: VLAN
Bridge: vmbr1
Tag: 30
Datacenter → SDN → VNets:
VNet: red_wan
Zone: zone_red
VNet: green_servers
Zone: zone_green
Subnet: 10.10.10.0/24
Gateway: 10.10.10.1 (firewall)
VNet: orange_dmz
Zone: zone_orange
Subnet: 10.20.20.0/24
Gateway: 10.20.20.1 (firewall)
VNet: blue_wireless
Zone: zone_blue
Subnet: 10.30.30.0/24
Gateway: 10.30.30.1 (firewall)
Firewall VM Configuration
VM Hardware Settings
VM ID: 100 (Firewall)
Hardware:
- CPU: 2 cores (or more if doing IDS/IPS)
- Memory: 2048 MB (4096 if using Suricata/IPS)
- Disk: 20GB (thin provisioned)
Network Devices:
net0: virtio, bridge=vmbr0 (RED/WAN)
net1: virtio, bridge=vmbr10, tag=10 (GREEN)
net2: virtio, bridge=vmbr20, tag=20 (ORANGE)
net3: virtio, bridge=vmbr30, tag=30 (BLUE)
Options:
- Start at boot: Yes
- Start/Shutdown order: 1 (starts first)
Firewall Zone Mapping
Inside the firewall VM (IPFire example):
Interface Assignment:
RED (WAN): vtnet0 → vmbr0 → Internet
GREEN (LAN): vtnet1 → vmbr10 (VLAN 10) → Servers
ORANGE (DMZ): vtnet2 → vmbr20 (VLAN 20) → DMZ
BLUE (Wireless): vtnet3 → vmbr30 (VLAN 30) → Wireless clients
IP Addressing Scheme
RED (WAN): DHCP or static from ISP
GREEN (Servers): 10.10.10.0/24
- Firewall: 10.10.10.1
- Proxmox: 10.10.10.2
- VMs: 10.10.10.10-254
ORANGE (DMZ): 10.20.20.0/24
- Firewall: 10.20.20.1
- Web server: 10.20.20.10
- Mail server: 10.20.20.11
BLUE (Wireless): 10.30.30.0/24
- Firewall: 10.30.30.1
- DHCP range: 10.30.30.100-200
Management: 192.168.100.0/24
- Proxmox: 192.168.100.10
Traffic Flow Examples
Internet Access from Server VM
Server VM (10.10.10.50)
↓ via vmbr10 (VLAN 10)
Firewall GREEN interface (10.10.10.1)
↓ routing + NAT
Firewall RED interface
↓ via vmbr0
Physical NIC 1 (enp1s0)
↓
Internet
DMZ to Server Communication (blocked by default)
DMZ VM (10.20.20.10)
↓ via vmbr20 (VLAN 20)
Firewall ORANGE interface (10.20.20.1)
↓ [FIREWALL RULES - usually DENY]
Firewall GREEN interface (10.10.10.1)
↓ via vmbr10 (VLAN 10)
Server VM (10.10.10.50)
Wireless Client to Internet
Wireless device (10.30.30.150)
↓ via Access Point (VLAN 30 tagged)
Physical Switch (VLAN 30)
↓ via trunk
Physical NIC 2 (enp2s0, VLAN 30)
↓ via vmbr30
Firewall BLUE interface (10.30.30.1)
↓ routing + NAT
Firewall RED interface
↓
Internet
External Switch Configuration
Your managed switch needs VLAN configuration:
Port 1: Trunk (to Proxmox NIC 2)
- Tagged VLANs: 10, 20, 30
- Untagged: none
Port 2-10: GREEN (Servers)
- Untagged VLAN: 10
Port 11-15: ORANGE (DMZ)
- Untagged VLAN: 20
Port 16-24: Access Points
- Tagged VLAN: 30 (wireless clients)
- Or untagged VLAN 30 if AP doesn't do VLANs
VM Deployment Example
Web Server in DMZ
VM ID: 200 (Web Server)
Hardware:
- CPU: 2 cores
- Memory: 2048 MB
- Disk: 50GB
Network:
net0: virtio, bridge=vmbr20, tag=20
Inside VM:
IP: 10.20.20.10/24
Gateway: 10.20.20.1 (firewall)
DNS: 10.10.10.53 (if you have internal DNS)
Firewall rules needed:
ORANGE → RED: Allow HTTP/HTTPS outbound
RED → ORANGE: Allow HTTP/HTTPS to 10.20.20.10 (port forward)
ORANGE → GREEN: Deny (except specific DB server on specific port)
Database Server on GREEN
VM ID: 201 (Database Server)
Network:
net0: virtio, bridge=vmbr10, tag=10
Inside VM:
IP: 10.10.10.20/24
Gateway: 10.10.10.1
Firewall rules:
ORANGE (10.20.20.10) → GREEN (10.10.10.20:3306): Allow
GREEN → Any: Default allow to internet
High Availability Considerations
If you want redundancy:
Proxmox Node 1: Proxmox Node 2:
NIC1 → RED NIC1 → RED (failover)
NIC2 → Trunk (active) NIC2 → Trunk (standby)
NIC3 → Cluster link NIC3 → Cluster link
NIC4 → Management NIC4 → Management
Firewall VM with HA enabled (Proxmox HA manager)
Shared storage (Ceph or NFS) for VM disks
Security Notes
- Proxmox management network (an RFC1918 range on its own VLAN) should be on GREEN or separate VLAN
- Firewall VM gets CPU pinning for better performance
- Enable virtio for all network interfaces (better performance)
- Disable MAC learning on bridges if having issues
- Log firewall rules to monitor traffic between zones
- Regular backups of firewall VM configuration
Migration from Physical Firewall
- Document current setup (rules, port forwards, DHCP, DNS)
- Deploy firewall VM with RED on separate test network
- Configure GREEN zone first, test connectivity
- Add ORANGE and BLUE, verify isolation
- Migrate rules one zone at a time
- Test thoroughly before switching production traffic
- Keep old firewall as backup for a few weeks
Performance Considerations
With 4 NICs and virtualized firewall:
- Expected throughput: 1-2 Gbps (with virtio)
- Latency: ~1ms additional vs physical
- CPU usage: ~5-15% per core under load
If you need 10G or more:
- Consider PCI passthrough of NIC to firewall VM
- Or use SR-IOV for near-native performance