Networking, NAT & port forwarding

Where network settings live

Everything that belongs to one Proxmox connection is reached from a node page > Network tab:

• Network services: one tile per service with its current state and a Set up, Manage or Open button: NAT & port forwarding, WireGuard VPN, Firewall, Network map, IP zones and SDN projects. The NAT, VPN and Firewall tiles are only shown to admins who may manage hosts.
• Interfaces: the node’s interfaces with CIDR, gateway, bridge ports and a Role (see below).
• Firewall: a summary of the last firewall analysis (tools and rules found).
• IPv4 forwarding: a switch that turns net.ipv4.ip_forward on or off on the node and persists it. A yellow on, not persisted badge means a reboot would turn it off again. Private guest networks (NAT, SNAT on SDN, the VPN) need forwarding to reach the internet.
• DynDNS: a free *.nxvdns.link name for the node, see DynDNS.

NAT, the firewall, the map and the VPN each open their own page (/panel/hosts/{id}/nodes/{node}/network/{nat|firewall|map|vpn}) with a breadcrumb back to the node’s Network tab.

Settings that are not tied to one connection are in the Networking menu of the sidebar: IP zones, SDN projects, SDN templates and Firewall presets. The VPN has its own VPN menu entry, see WireGuard VPN.

Clusters

NAT, port forwards, the firewall and the VPN are stored per connection, not per node. On a cluster, the pages show “This setting applies to the whole cluster …” and you can open them from any of its nodes; the data is the same. An old host-level link such as /panel/hosts/{id}/nat opens the node page directly on a single node and shows a node chooser on a cluster.

Bridge classification

NexoVirt classifies each interface from the last inventory, without a live Proxmox call:

Role	Meaning
WAN	Has a public address: the uplink to the internet.
Private	Has a private (RFC1918 or private IPv6) address: a guest network behind the node.
Internal	A bridge without an address.
Other	Anything else.

The roles pre-fill the NAT settings and annotate the Detected networks list when you create an IP zone, so you pick the right bridge.

NAT & port forwarding

The NAT & port forwarding page lets guests on a private bridge reach the internet through the node’s WAN interface (MASQUERADE) and exposes their services with port forwards (DNAT): a public port on the WAN interface is mapped to a port on a private guest.

1. Open the node page, Network tab, and click Set up (or Manage) on the NAT & port forwarding tile.
2. Under NAT settings, turn on Enable NAT, check the WAN interface (for example vmbr0) and the Private CIDR (an RFC1918 subnet such as 10.0.10.0/24; only traffic from this range is masqueraded). Both are pre-filled from the bridge classification. Leave Enable MASQUERADE (outbound NAT) on so private guests can reach the internet. Click Save settings.
3. Under Port forwards, add rows inline: Proto (tcp or udp), Public port, Destination IP, Dest port, an optional Comment and Enabled.
4. Click Apply now and confirm. The node agent writes the rules on the node.

Public port takes a single port (443), a list (25,465) or a range (30000-30100). A different Dest port is only possible for a single port; lists and ranges forward to the same port numbers. Overlapping public ports on the same protocol are refused. The destination must be in the private CIDR or in one of the connection’s SDN project subnets.

Saved settings take effect when you click Apply now or change a port forward.

Import from node scan reads port forwards that already exist on the node (from the last firewall analysis, Re-scan refreshes it) and lets you select the ones to bring under NexoVirt. Imported forwards are added to the panel only; nothing changes on the node until you click Apply now.

What the agent touches

The agent only manages its own NEXOVIRT-PRE, NEXOVIRT-POST and NEXOVIRT-FWD chains. Built-in and Proxmox chains are never flushed. It refuses to masquerade anything that is not a private (RFC1918) range, turns on IPv4 forwarding, and makes the rules survive a reboot with a nexovirt-nat.service systemd unit. Incorrect rules can still disrupt the node’s networking, so do not apply rules you are unsure about.

Firewall

The Firewall page has two parts: a read-only view of everything active on the node, and the Proxmox firewall rules you can edit.

Current node firewall

Analyze asks the agent to read iptables, nftables, ufw, firewalld and pve-firewall, and parses the output into one rule model: per tool, per table and chain, with colored action badges, the raw output per tool, and a NAT map of DNAT forwards and MASQUERADE/SNAT rules. It also lists port forwards managed by NexoVirt that still have a manual DNAT rule on the node (leftover duplicates).

This view never changes the node. The latest analysis is stored and shown with an “as of” time, so the page opens instantly; php spark firewall:collect refreshes it every 5 minutes from cron.

Proxmox firewall rules

Below the analysis you manage the Proxmox VE firewall itself:

• Scope: Datacenter (cluster-wide rules) or Node: <name> (rules of this node).
• Rules: add and edit inline: On, Action (ACCEPT, DROP, REJECT), Dir (in, out), Proto, Dport (443 or 8000:8100), Source and Comment. Advanced match fields (macro, destination, source port, interface) are kept on existing rules but are not editable inline yet.
• Edit policy: Firewall enabled, Default inbound policy and Default outbound policy. Before you enable the firewall with a DROP or REJECT inbound policy, NexoVirt adds inbound ACCEPT rules for SSH (22) and the Proxmox API (8006) from your current IP and any Extra allowed sources you enter (for example the panel server’s IP or 203.0.113.0/24), so you do not lock yourself out.
• Scan node: lists rules found on the node (iptables and friends) that you can add to the Proxmox ruleset. Rules already in Proxmox, NAT rules and unsupported rules are shown for reference only.
• Security groups: named rule sets (Add group, then Add rule with action, direction, protocol, ports, source, destination and optional macro).
• Aliases & IP sets: named addresses (Add alias: name + IP / CIDR) and address lists (Add IP set, then Add member).

Note

Writing firewall rules needs the Manage firewall permission, NAT changes need Manage NAT / port forwarding (relevant when you use Enterprise admin roles).

Network map

The Network map page is read-only:

• Topology: the classified bridges, their subnets, the guests on each bridge (matched by IP in the bridge’s CIDR) and a NAT and port-forward overlay.
• Proxmox SDN: the zones, VNets, subnets and controllers of the connection.

IP zones (IPAM)

Networking > IP zones defines address pools that new guests get static IPs from. A zone has a Name, a Node / cluster, a Family (IPv4 or IPv6), a Bridge, an optional VLAN tag, the CIDR, a Gateway, an optional Range start / Range end (narrows the pool, required for IPv6) and Nameservers. A Subnet preview (prefix, usable hosts, netmask, network, broadcast, first to last) updates as you type, and Detected networks lists the selected node’s bridges with their role so you can pre-fill the form.

Open a zone to see its Addresses with their status (free, assigned, reserved) and act on single addresses: Reserve a free one, Free a reserved one, or Release an assigned one.

• Rescan reconciles the pool against the panel’s own guests: addresses in use by a guest are reserved with a note, addresses of guests that are gone are freed. This also runs when you create a zone.
• Scan network (IPv4 zones) ping-sweeps the network through the node agent and reserves every address that answers, including devices outside Proxmox such as a router, so they are never handed out.

In the guest create wizard you choose DHCP or a zone; with a zone, the next free address is allocated and written into the guest’s static network configuration. Reinstalling a guest keeps its IP, deleting the guest releases it, and the guest’s Network tab lets you change or release the address (applied at the next reboot).

The guest Network tab also has an Anti-spoofing IP filter: Restrict this guest to its assigned IP. It needs an IPAM address and turns on the guest’s firewall.

Firewall presets and the guest firewall

Networking > Firewall presets holds reusable rule sets (New preset: name, description, Enabled and a list of rules). Enabled presets appear as Firewall presets checkboxes in the create wizard and in the Apply preset… list on a guest’s Firewall tab.

The guest Firewall tab manages the Proxmox firewall of one guest: Enable firewall, the Inbound default policy and Outbound default policy, and its Rules (Add rule). If the datacenter firewall is off, the tab warns that guest rules have no effect and offers Enable datacenter firewall. Customers can add their own rules in the portal; rules set by an admin are shown to them but locked. See Guests.

Next steps

• SDN & project networks for isolated per-project networks.
• WireGuard VPN to reach private guest networks from your devices.
• DynDNS for a stable name per node.
• The node agent, which applies NAT, reads the firewall and scans networks.