Networking & NAT

IP zones (IPAM)

Define IP zones (subnets with a gateway and nameservers) under Settings, and NexoVirt manages address allocation for you. When creating a guest you can pick DHCP or allocate the next free address from a zone, which is injected as a static configuration.

• Zones show a live allocation table.
• Reinstalling a guest keeps its IP; deleting it releases the address.
• You can change or release a guest’s IP from its detail page’s Network tab.
• NexoVirt can scan a host’s bridges to pre-fill new zones and reconcile addresses already in use.

NAT & port-forwarding

For guests on a private bridge, the per-host NAT page (admin-only) lets them reach the internet through the host’s WAN interface (MASQUERADE) and lets you expose them with port-forwards, mapping a public port on the WAN interface to a private guest’s port.

The WAN interface and private subnet are pre-filled from NexoVirt’s network detection. Manage port-forwards in a table and apply the rules with one click, behind a confirmation. Applying rules enqueues a job to the host agent, which is what actually writes the firewall rules on the node.

Safety is built in

The host agent only ever manages its own dedicated firewall chains. It never touches built-in or Proxmox firewall rules, and it refuses to masquerade anything that isn’t a private (RFC1918) network. Rules persist across a reboot.

Read-only firewall view

The Networking page has an Analyze button that reads the host’s current firewall: iptables, nftables, ufw, firewalld and pve-firewall. It normalizes whichever stack is active into one rule model and shows you its current rules plus a NAT map, so you can spot conflicts before changing anything.

Caution

This view is strictly read-only, it never modifies firewall state. The latest analysis is stored and shown with an “as of” marker so the page loads instantly, and a background job keeps it in sync every few minutes.

Network map

A read-only host network topology shows the host’s classified bridges (WAN / private / internal), the guests on each bridge (matched by IP), and a NAT/port-forward overlay: a quick visual of how traffic flows on a host.

Next steps

• Guests to allocate a zone IP at create time.
• Hosts & onboarding for the agent that applies NAT and reads the firewall.
• REST API for scripting host and guest queries.