One dedicated Pool and VLAN per lab
Technically enforcedNo routing is allowed between lab VLANs and the production network.
MandatoryPR-GOVLABONPREM-A-01
Network and security
Network isolation
Section titled “Network isolation”Each lab has a dedicated VLAN. No routing is allowed between lab VLANs and the production network.
Default firewall
Section titled “Default firewall”Strict policy: inbound denied, outbound allowed. Any inbound opening must be justified and approved with the administrators.
No direct public IP
Section titled “No direct public IP”No resource in a Proxmox lab can be given a direct public IP. Exposure on the Internet goes through an approved mechanism (reverse proxy, VPN), never through direct exposure of the VM.
Authentication
Section titled “Authentication”Multi-factor authentication (MFA) is mandatory for any access to the Proxmox interface.
Applicable rules
Default firewall
Technically enforcedInbound denied by default, outbound allowed by default.
MandatoryPR-GOVLABONPREM-A-01
No direct public IP
Technically enforcedNo lab resource may be given a direct public IP.
MandatoryPR-GOVLABONPREM-A-01
MFA required
Technically enforcedMulti-factor authentication is required to access Proxmox.
MandatoryPR-GOVLABONPREM-A-01