I have a Proxmox installed and an OpenBSD VM in front of all the others to play the role of NAT, firewall, DNS and DHCP.
I have a fully functional DNS and DHCP. My DHCP is correctly updating my DNS records. My NAT is also working well since my other VMs can reach the internet.
Now I would like to have a working firewall and incoming NAT rules.
For instance I have a VM named nginx, which can be contacted though
In short terms, this is what I want to do:
- Redirect 80 and 443 ports to my
- Block everything that comes from the WAN interface (em0) except what is natted (80 and 443 to nginx) and SSH.
- But I also want to allow everything that comes from the LAN interface (em1).
Here is my current
set skip on lo block return # block stateless traffic pass # establish keep-state # Define interfaces ext_if=em0 int_if=em1 # Allow SSH connections pass in on $ext_if inet proto tcp from any to ($ext_if) port 22 # Allow VMs to get out of the network pass out on $ext_if inet from $int_if:network to any nat-to $ext_if