In short, rules higher in the chain have precedence over those below them.Ħ.

Treat each Rule Chain as if the order of the rules does matter because it seemingly does (which makes sense) on some of the chains, particularly the guest machine chains. Be sure to set the default input/output polices to “Accept” BEFORE enabling the firewall and be sure to all “Accept” rules for ports and services BEFORE adding the drop rule to each chain!ĥ. The default policy (set in firewall options tab for Datacenter Tier and Guest Systems) should be set to “Accept” and a default drop rule should be added to every Rule chain on all tiers. Guest systems must have the firewall enabled on each guest nic interface in addition to enabling it generally.Ĥ. Blank fields in Rules = “Any” or “All” in traditional firewall parlance.ģ. Proxmox Cascading Firewall rules don’t work as described.Ģ. Finally, in Debian, disable the root account.Ĭhange the default SSH port from 22 to something else.ġ. The logout and log back in to ProxMox and make sure the account works.ĥ. In the ProxMox Web Panel, add the new user account you created in Debian to the admins group in the ProxMox panel. In the ProxMox Web Panel, create a new “admins” user group and give the group the “Administrator” permission.Ĥ. In Debian, Add a new user account and then add the account to the sudo group.

Here is the list of things to do to secure your ProxMox + Debian Node.Ģ.

Proxmox web interface port