Skip to main content

Port Forwarding

Your VMs only have private addresses, so the internet can't reach them directly. A port forward tells the Proxmox host: "Traffic arriving on port X of the public IP goes to port Y on VM Z."

Internet ──► YOUR-PUBLIC-IP:2222 ──► host ──► 10.10.10.20:22 (VM)

:::tip Prefer a web interface? Port forwards are configured on the command line. If you'd rather click through a GUI, use the OPNsense router setup instead. :::

Reserved ports​

These ports are used by the Proxmox host. Do not forward them:

PortUsed for
22/tcpSSH to the host
8006/tcpProxmox web interface
3128/tcpSPICE console proxy (only if you use SPICE)

Each public port can only be forwarded to one VM. To run several websites on ports 80/443, see Hosting Websites.

Adding a port forward​

Open the host shell (Node → Shell, or SSH to the host) and edit the network configuration:

cd /etc/network
cp interfaces interfaces.backup-$(date +%F)
nano interfaces

Find the vmbr1 section and add two lines per forward, one post-up (adds the rule) and one post-down (removes it). Keep the indentation:

auto vmbr1
iface vmbr1 inet static
    address 10.10.10.1/24
    ...existing lines...
    # SSH to web01
    post-up   iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 2222 -j DNAT --to 10.10.10.20:22
    post-down iptables -t nat -D PREROUTING -i vmbr0 -p tcp --dport 2222 -j DNAT --to 10.10.10.20:22

Save (Ctrl+O, Enter, Ctrl+X) and apply:

cd /etc/network
ifreload -a

Test from your own computer:

cd ~
ssh -p 2222 user@YOUR-PUBLIC-IP

Examples​

Copy the line pair that matches your case and adjust the ports and IP.

Web server (HTTP + HTTPS) on VM 10.10.10.10:

    post-up   iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 80  -j DNAT --to 10.10.10.10:80
    post-down iptables -t nat -D PREROUTING -i vmbr0 -p tcp --dport 80  -j DNAT --to 10.10.10.10:80
    post-up   iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 443 -j DNAT --to 10.10.10.10:443
    post-down iptables -t nat -D PREROUTING -i vmbr0 -p tcp --dport 443 -j DNAT --to 10.10.10.10:443

UDP service, e.g. WireGuard on VM 10.10.10.30:

    post-up   iptables -t nat -A PREROUTING -i vmbr0 -p udp --dport 51820 -j DNAT --to 10.10.10.30:51820
    post-down iptables -t nat -D PREROUTING -i vmbr0 -p udp --dport 51820 -j DNAT --to 10.10.10.30:51820

Port range, e.g. a game server on VM 10.10.10.40:

    post-up   iptables -t nat -A PREROUTING -i vmbr0 -p udp --dport 27015:27030 -j DNAT --to 10.10.10.40
    post-down iptables -t nat -D PREROUTING -i vmbr0 -p udp --dport 27015:27030 -j DNAT --to 10.10.10.40

Windows Remote Desktop on VM 10.10.10.50, using a non-standard public port:

    post-up   iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 33890 -j DNAT --to 10.10.10.50:3389
    post-down iptables -t nat -D PREROUTING -i vmbr0 -p tcp --dport 33890 -j DNAT --to 10.10.10.50:3389

:::warning Don't expose RDP or databases Remote Desktop, MySQL, PostgreSQL, Redis and similar services are constantly attacked when open to the internet. Prefer a VPN (e.g. WireGuard) and connect to your VMs through it. :::

Checking active forwards​

cd /root
iptables -t nat -L PREROUTING -n -v --line-numbers

Each forward should appear exactly once. If you see duplicates after editing, reboot the host or run:

cd /etc/network
ifdown vmbr1 && ifup vmbr1

Removing a port forward​

Delete both lines (post-up and post-down) for that forward from /etc/network/interfaces. Then remove the active rule. Either reboot the host, or delete it by number:

cd /root
iptables -t nat -L PREROUTING -n --line-numbers
iptables -t nat -D PREROUTING <number>

Why the GUI shows a comment on vmbr1​

The Proxmox network GUI shows post-up lines as a comment on vmbr1. That's normal. Don't edit vmbr1 in the GUI and click "Apply Configuration" without checking the file afterwards, because GUI edits can rewrite the section.

Was this page helpful?