A pfSense or OPNsense firewall as a virtual machine
One VM that filters, routes and terminates your VPN tunnels, in front of everything else on the server.
Starting at from €13.99/mo
Introduction
Putting a virtual firewall in front of your machines changes how you build a server. Instead of tuning each VM's firewall separately, a single machine — pfSense or OPNsense — takes the traffic, filters it, and hands it to an internal network where the other VMs hold no public address at all.
Technically, the firewall VM carries two interfaces: one on the public bridge with one of your IPv4 addresses, one on an internal bridge created in Proxmox. The other machines only see the second. What is not explicitly allowed does not get in, and that is decided in one place.
The S plan at €13.99/month is plenty for the firewall itself: these systems are happy with 2 GB in most cases. Save the memory for what lives behind it. And keep a fallback route to the Proxmox console: an over-enthusiastic rule can lock you out.
What the server brings, across the whole range
Proxmox VE already installed
The server arrives with <strong>Proxmox VE</strong> in place and its web interface reachable. You create your virtual machines and LXC containers from the browser, without a support ticket or a wait. <strong>Reinstalls are unlimited</strong>: an experiment that goes wrong is redone in minutes.
RAM, because that is what runs out first
On a hypervisor it is almost never the processor that caps out first: it is <strong>memory</strong>, because every virtual machine reserves its own. The range starts at <strong>16 GB</strong> and goes up to <strong>96 GB</strong>, which leaves room to stack several VMs without starving them.
Unlimited snapshots and backups
A snapshot before an update, another before a configuration change: that is what separates a test from a gamble. Neither the count nor the frequency is billed, so nothing discourages taking one more.
Up to 16 additional IPv4 addresses
Each VM can hold its own public address, which avoids routing everything through port forwards on the host. Useful as soon as a virtual firewall, a web server and a third-party service have to coexist cleanly.
What it is trusted with
Filter before reaching the VMs
A single rule set, applied upstream. The VMs behind no longer need to expose anything directly to the internet.
Terminate a VPN
WireGuard or OpenVPN to reach the internal network from outside, without opening a port on every machine. It is the most common use.
Link an office to the server
A site-to-site tunnel between the premises and the VDS: workstations reach internal services as if they were local.
Segment into several networks
One network for production, one for staging, one for administration. The firewall decides what crosses between them, and most of the time the answer is nothing.
Watch the traffic go by
These systems log and chart what comes in and out. It is often the first time anyone really looks at what their server does.
Frequently asked questions
Both descend from the same ancestor and cover the same needs. OPNsense releases more often and has a newer interface; pfSense has a wider community. We neither impose nor preinstall either.
One is enough if everything goes through the firewall and you forward ports. You can order up to 16 if some VMs must be reachable directly.
2 GB of RAM and 2 vCore cover most situations, VPN included. Encryption costs CPU: past a few hundred megabits of tunnel, you need to scale up.
The Proxmox console stays reachable from the client area, independently of the VM's network. That is your way back in: never apply a rule without knowing how to undo it.