TESTING / TROUBLESHOOTING / RECOVERY
How I Test Firewalls in Proxmox
When I install a new firewall, I don't try every feature at once. I start with a working WAN and LAN connection, test it from a client and build on that. Repeating the same steps makes it easier to spot what is different between products.
The first round of tests
- Boot and management: check the initial interfaces, how to reach the UI or CLI and whether management access is limited to the lab.
- WAN: confirm DHCP or static addressing on the intended upstream, then check DNS and outbound connectivity.
- LAN: connect a Windows or Linux VM, check DHCP/DNS and establish the default route.
- NAT and forwarding: check outbound connections, then use a selected RDP or service port forward as a simple inbound test.
- Policy: try traffic that should succeed and traffic that should be blocked. These negative checks are not complete for every platform yet.
- Recovery: record what changes after restarting the firewall or restoring a snapshot, rather than assuming its runtime state is permanent.
What caused trouble
An early DHCP problem in the lab WAN needed tests at the switch, gateway, Linux bridge and guest NIC. During the IPFire setup, the WAN was initially attached to the wrong virtual bridge. Storage health and KDE graphics problems also turned into their own investigations.
One lesson has been to distinguish basic network separation from full security isolation. Different Linux bridges make a useful lab layout, but I still need to test IPv4 and IPv6 paths toward all protected services.
The comparison I want to build
| Area | What I want to check |
|---|---|
| Connectivity | WAN and client address assignment, DNS, IPv4/IPv6, routing and NAT |
| Firewall behavior | Allowed and denied connections, state handling and logging |
| Identity | RADIUS/802.1X where supported, certificates and management authentication |
| Guest access | Captive portal behavior, session handling and IPv6 leakage |
| Performance | Throughput, CPU use per core, latency and packet loss under comparable traffic |
| Recovery | Restart behavior, configuration backup and restored functionality |
Future test environment
I plan to add a dedicated IPv6-only upstream and a separate physical Wi-Fi access point. That would let me try captive portals, PacketFence, EAP-TLS and other NAC scenarios with real clients while keeping the normal home Wi-Fi out of the experiments. Commercial firewall evaluations are also on the roadmap, subject to trial and licensing conditions.
Firewall platforms tested so far → More troubleshooting notes →