I run some china box with 5 integrated 2.5GBe NICs, 48GB RAM and 2x 500GB SSD/NVMe. CPU is Celeron® 6305 @ 1.80GHz, two cores or HT, who knows…

On this I run Proxmox. I didn’t like Proxmox integrated firewall, so I rolled my own.

all containers unprivileged

one container is the firewall. it has all up+down stream NICs mapped via bridges, cable internet, backup 5g internet on dedicated ports. one port to the switch with a few VLANs, and one bridge that is local to the Proxmox for the local VLANs.

Every service I operate sits in its own network/segment, usually with a /30 netmask. VMs/containers have a eth0 device in this and the firewall defined as default gw. On the firewall the VLAN interfaces are named as the container/service. So the interfaces are not eth0 but wan, wan5g, frigate etc. Great for readability.

Some networks like “family” or “guest” or the one with the APs/WLAN-controller are /24. Bit big, but what ever.

I have a structured netfilter firewall script, fw.sh calling it’s parts under fw.d/*fw. Each service is managed individually, sometimes widely open (iptables -A FORWARD -i frigate -o wan* -j ACCEPT) but usually down to the required ports. Database, reverse proxy etc all on separate containers.

There is also like 30 VPN configs from 2 VPN providers. I have a home assistant dashboard where I can direct specific devices to use specifig VPNs. My webradio is routed via UK so I can enjoy BBC2.

root@mercury:~# ip rule show
0:      from all lookup local
20:     from all lookup main suppress_prefixlength 1
300:    from XXX lookup wan_table
310:    from xx.xx.0.254 lookup wan5g_table
1000:   from all fwmark 0x1 lookup bbc-ss-lon
1001:   from all fwmark 0x1 lookup bbc-ss-man
3000:   from xx.xx.11.18 lookup pm-gb
4000:   from all lookup wan_table
5000:   from all lookup wan_table
5100:   from all lookup wan5g_table
32766:  from all lookup main
32767:  from all lookup default

ip rule also does the fail over to wan5g if required. There are some rules where I tried to auto-filter BBC traffic with marked connections via dnsmasq, but BBC knows all my VPNs (not BBC radio it seems).

IPSec VPNs and other OpenVPNs (dialup, site2site) are handled via a dedicated LXC. There is a tor entry node container, for a few services and one of the public WLANs. Firewall makes sure certain traffic can only exit via certain upstream interfaces, vpn*, wan, wan*… very helpful

I didn’t like opensense… don’t know why. Work a lot with firewalls in my job (mainly check point, fortigate) so have some professional background.