Put a VM behind an external firewall

Use External firewall when a regular guest's traffic is filtered by a customer firewall on the same network — often a pfSense or OPNsense VM in the pool (see Create a firewall VM in a Cloud Pool). The platform then will not apply a hypervisor firewall to that guest.

This checkbox is hidden for appliance templates. Those VMs already are the firewall.

At create time

1. Start New VM (see Create a virtual machine in a Cloud Pool).
2. Choose a normal Linux or Windows image — not pfSense or OPNsense.
3. Attach a NIC on the firewall's LAN (usually SDN).
4. Check External firewall. Help text: traffic is filtered by a customer firewall on this network; do not apply a hypervisor firewall.
5. The organization-firewall picker disappears. Click Create machine.

On an existing VM

1. Open the VM → Firewall.
2. Click External firewall.
3. Confirm. Turning it on detaches hypervisor firewalls from this VM.

The tab then shows:

This VM's traffic is managed by an external firewall appliance. Integrated firewalls have been disabled for this VM.

What is hidden or removed

Control	When External firewall is on
Wizard firewall picker	Hidden
Attach Firewall / Create Firewall on the VM	Hidden
Firewall enabled toggle and Add rule	Removed, not greyed out

The Attached Firewalls card can still appear. Shared rule sets themselves live on the pool Firewalls tab; that list says to open a VM's Firewall tab to attach. You attach from the VM, not from the pool tab — and only while External firewall is off.

Turn External firewall off again if you need the integrated rule editor or to attach a shared firewall.

Tips

• Put the guest on the appliance LAN (SDN) before you rely on the appliance for filtering.
• Keep Web Console available in case you lock yourself out of the network path.
• Appliance VMs use a different Firewall-tab message — see Firewall appliance templates (pfSense and OPNsense).

Related guides

• Firewall appliance templates (pfSense and OPNsense)
• Create a firewall VM in a Cloud Pool
• Firewalls for Cloud Pools
• Networks in Cloud Pools

Still stuck?

Open a support ticket from Support → Tickets if the checkbox will not stay on, hypervisor rules still apply, or you cannot reach the guest after moving it behind the appliance.