126 lines
3.9 KiB
Markdown
126 lines
3.9 KiB
Markdown
# Hetzner Proxmox VE Single Setup
|
|
|
|
This repo is about the installation of Proxmox 7.X on Hetzner with pfsense as firewall for WAN, IP floating with additional IP address for the VM's to allow SNAT.
|
|
|
|
# Hetzner Promox Architecture
|
|
|
|
<img src="img/proxmox/arch.png" alt="Alt-Text" title="Hetzner Proxmox Architecture" />
|
|
|
|
## 1. Install Proxmox on Hetzner
|
|
|
|
ssh root@178.63.13.156
|
|
|
|
#run
|
|
installimage
|
|
|
|
Chose the right image:
|
|
|
|
<img src="img/proxmox/proxmox-0.png" alt="Alt-Text" title="" />
|
|
<img src="img/proxmox/proxmox-1.png" alt="Alt-Text" title="" />
|
|
|
|
Change install config
|
|
|
|
From:
|
|
|
|
SWRAIDLEVEL 1
|
|
|
|
To:
|
|
|
|
SWRAIDLEVEL 0 (to use all Storage sda+sdb)
|
|
|
|
From:
|
|
|
|
HOSTNAME Proxmox-Ve.localhost
|
|
|
|
To:
|
|
|
|
proxmox-single.lab.local (you can call it what ever you want)
|
|
|
|
From:
|
|
|
|
PART /boot ext3 512M
|
|
PART lvm vg0 all
|
|
|
|
LV vg0 root / ext3 15G
|
|
LV vg0 swap swap swap 6G
|
|
|
|
To:
|
|
|
|
PART /boot ext**4** 512M
|
|
PART lvm vg0 all
|
|
|
|
LV vg0 root / ext4 100G
|
|
LV vg0 swap swap swap 24G #(available RAM * 1/2)
|
|
LV vg0 data /var/lib/vz ext4 3500G #(Remaining memory after deduction of root for storing images and containers)
|
|
|
|
The installation takes up to 15 minutes.
|
|
|
|
## 2. Set root password and disable port 111
|
|
|
|
After installation a password must be assigned to the root user if access to the Hetzner machine is via ssh-key. The access will be done via the Linux PAM authentication module.
|
|
|
|
passwd
|
|
New password: xy...
|
|
Retype new password:xy...
|
|
|
|
Proxmox opens port 111 by default, which is a security risk. Therefore, the port must be disabled.
|
|
|
|
iptables -A INPUT -p tcp -m tcp --dport 111 -j DROP
|
|
iptables -A INPUT -p udp -m udp --dport 111 -j DROP
|
|
sudo /sbin/iptables-save
|
|
|
|
Now open the Proxmox-Webconsole with your ordered server IP-Address (MAIN-IP) and login with root and your password:
|
|
|
|
https://178.10.10.10:8006
|
|
|
|
## 3. Add additional IP-Address and fetch Metadata
|
|
|
|
To enable routing to external networks (SNAT), you'll need to request an extra IP address, since the primary IP of the Hetzner VM doesn't support this function.
|
|
|
|
You'll need to request a MAC address for the IP address. This MAC address will be later essential for the pfsense VM that handles routing to the WAN.
|
|
|
|
## 4. Config Network
|
|
|
|
Clone this git repository and execute the script:
|
|
|
|
./script/nework_config.sh
|
|
|
|
All necessary information (main server ip, gateway, etc.) can be taken from the hetzner robot page like this:
|
|
|
|
MAIN-IP + Meta:
|
|
<img src="img/hetzner/fetch-meta-0.png" alt="Alt-Text" title="" />
|
|
ADD-IP + Meta + MAC:
|
|
<img src="img/hetzner/fetch-meta-2.png" alt="Alt-Text" title="" />
|
|
|
|
## 5. Upload images (pfsense and fedora)
|
|
|
|
<img src="img/proxmox/proxmox-2.png" alt="Alt-Text" title="" />
|
|
|
|
## 6. Create VM and install pfsense
|
|
|
|
<img src="img/pfsense/pfsense-0.png" alt="Alt-Text" title="" />
|
|
<img src="img/pfsense/pfsense-1.png" alt="Alt-Text" title="" />
|
|
<img src="img/pfsense/pfsense-2.png" alt="Alt-Text" title="" />
|
|
<img src="img/pfsense/pfsense-3.png" alt="Alt-Text" title="" />
|
|
<img src="img/pfsense/pfsense-4.png" alt="Alt-Text" title="" />
|
|
<img src="img/pfsense/pfsense-5.png" alt="Alt-Text" title="" />
|
|
<img src="img/pfsense/pfsense-6.png" alt="Alt-Text" title="" />
|
|
|
|
Now start the pfsense (VM) and install with default settings
|
|
|
|
## 7. Create VM and install fedora (workstation)
|
|
|
|
The steps are identical to pfsense except for the choice of bridge. There vmbr1 (DMZ/LAN) must be selected.
|
|
|
|
<img src="img/fedora/fedora-0.png" alt="Alt-Text" title="" />
|
|
<img src="img/fedora/fedora-1.png" alt="Alt-Text" title="" />
|
|
If you check the IP-Address from the created VM (in my case fedora workstation) like:
|
|
<img src="img/fedora/fedora-2.png" alt="Alt-Text" title="" />
|
|
You will see the ADD-IP-Address. So SNAT is working and you can extend to config pfsense over the UI for your purpose.
|
|
|
|
<img src="img/pfsense/pfsense-7.png" alt="Alt-Text" title="" />
|
|
|
|
Default credentials are set to **username:** **_admin_** with **password:** **_pfsense_**.
|
|
|
|
## **Finished, enjoy your Proxmox Environment!**
|