Stop Thousands of Brute-force Attacks in Just 5 Minutes
If you are exposing SSH or Web ports for your Proxmox cluster to the Internet, check the logs at /var/log/auth.log. You’ll see dozens of strange IPs constantly “guessing” passwords every minute. My personal lab with 12 VMs once recorded over 5,000 failed login attempts in a single night, mostly from IP ranges where I never have any users.
Manually creating thousands of firewall rules is an impossible task. That’s why you need IPSet. Instead of forcing the CPU to match packets against 1,000 individual rules, IPSet bundles them into a single list. Thanks to the hash table mechanism in the Linux kernel, checking whether an IP is on the blacklist happens almost instantaneously, regardless of how large the list is.
Quick Start: Enable Firewall and Create a Basic IPSet
Before automating, we need to understand the Proxmox firewall structure. The system is managed at three levels: Datacenter (Global), Node (Physical Server), and Virtual Machine/Container.
Step 1: Enable Datacenter-level Firewall
- Access the Proxmox Web UI.
- Select Datacenter > Firewall > Options.
- Set Firewall to
Yes.
Warning: Create an ACCEPT rule for ports 8006 and 22 from your local IP before clicking Save. Otherwise, you will lock yourself out of the server.
Step 2: Initialize the IPSet
In Datacenter > Firewall > IPSet, click Create. Name it blacklist_country. This will be the “container” for the IP ranges we want to block later.
Step 3: Apply the Blocking Rule
Go to Datacenter > Firewall, select Add with the following parameters:
- Direction: in
- Action: DROP
- Source:
+blacklist_country(The plus sign is mandatory for Proxmox to understand this is an IPSet list). - Enable: Checked.
Why is IPSet Superior to Standard Rules?
When using traditional iptables rules, the system checks packets sequentially from top to bottom. If you block 5,000 IP ranges, the 5,001st valid packet must go through 5,000 comparisons. This wastes CPU resources and increases network latency.
With IPSet, Proxmox utilizes O(1) algorithmic complexity. Whether your list contains 10 or 100,000 IPs, the processing time remains constant. This is the best way to protect your system while maintaining maximum bandwidth.
Automating GeoIP Blocking with a Script
Copy-pasting thousands of CIDR lines from IPDeny into the web interface is a nightmare. I usually use a script to fetch the IP list of a country (e.g., China – CN, or Russia – RU) and push it directly into Proxmox via the pvesh tool.
#!/bin/bash
# IPSet name created in the UI
IPSET_NAME="blacklist_cn"
COUNTRY_CODE="cn"
# Download the latest IP range list
curl -s -o /tmp/${COUNTRY_CODE}.zone http://www.ipdeny.com/ipblocks/data/countries/${COUNTRY_CODE}.zone
# Read each line and push to the Datacenter IPSet
while read -r line; do
pvesh create /cluster/firewall/ipset/${IPSET_NAME} --cidr "$line" > /dev/null 2>&1
done < /tmp/${COUNTRY_CODE}.zone
echo "Finished updating the blacklist for ${COUNTRY_CODE}"After running it, you will see the blacklist_cn IPSet automatically populated with network ranges. With just a single DROP rule pointing to this IPSet, all connection attempts from that country will be rejected right at the gateway.
Practical Tips from an Administrator
1. Don’t block blindly
Many people tend to block all foreign countries. However, if you are using Cloudflare, country-based blocking at the Proxmox level might accidentally block Cloudflare’s IPs. Prioritize blocking at the Application Proxy layer first, and only use IPSet for sensitive services like SSH.
2. Priority Rules
In Proxmox, rules are executed from top to bottom. A fatal mistake is placing DROP rules below ACCEPT rules. Always remember: Block first, allow later. Always place IPSet rules at Sequence 0 or 1.
3. Use Security Groups for multiple VMs
If you manage dozens of VMs, don’t configure the firewall for each one individually. Create a Security Group (e.g., Web-Protection), add the IPSet rule to it, and then assign this group to all VMs. When an update is needed, you only have to edit it in one place.
4. Monitor Logs regularly
Don’t just set it and forget it. Enable info level logging on the DROP rule. Checking Firewall > Log helps you see if you’re accidentally blocking potential customers or identifying new attack waves to respond to in time.
Conclusion
Using IPSet is a professional way to turn Proxmox into a solid shield. It not only provides better security but also optimizes hardware performance. Don’t forget to set up a Cronjob to run the update script weekly, as country IP ranges change over time.
