# Client Area Everything the end customer sees in the WHMCS client area: VM overview with real-time status, noVNC console, performance charts, reinstall, snapshots, backups, password reset, reverse DNS, ISO mount and firewall management. Available features are controlled per product by the administrator. # Overview ### Proxmox KVM module **[WHMCS](https://puqcloud.com/link.php?id=77)** ##### [Order now](https://puqcloud.com/whmcs-module-proxmox-kvm.php) | [Download](https://download.puqcloud.com/WHMCS/servers/PUQ_WHMCS-Proxmox-KVM/) | [FAQ](https://faq.puqcloud.com/) The Overview page is the main management screen displayed when a client opens their Proxmox KVM service. It provides real-time VM status information, quick action buttons, and a complete network configuration summary. ## Action Buttons At the top of the page, action buttons allow the client to perform common operations: - **Start** — Power on the virtual machine - **Stop** — Gracefully shut down the virtual machine - **noVNC** — Open a browser-based VNC console session (see [noVNC](02-novnc.md)) - **Charts** — View performance usage graphs (see [Charts](03-charts.md)) Below the real-time information panel, additional management buttons provide access to: - **Reinstall** — Reinstall the operating system - **Snapshots** — Manage VM snapshots - **Backups** — Manage backups and schedules - **Reset password** — Reset the root/admin password - **revDNS** — Configure reverse DNS records - **ISO** — Mount or unmount ISO images - **Firewall** — Manage firewall policies and rules The visibility of each button depends on the Client Area Permissions configured by the administrator for the product. ## Information on Real Time The overview displays live VM metrics that auto-refresh every 7 seconds: | Field | Description | |-------|-------------| | **Status** | Current VM state (running / stopped) with uptime counter | | **CPU** | Current CPU utilization percentage and number of allocated cores | | **RAM** | Current memory usage with used/total values and a progress bar | | **System disk** | System disk size with R/W throughput (MB/s) and IOPS limits | | **Additional disk** | Additional disk size with R/W throughput (MB/s) and IOPS limits (if configured) | | **Network adapter** | Network adapter model, MAC address, and link speed | ![VM overview](https://doc.puq.info/uploads/images/gallery/2026-04/embedded-image-s5ana790.png) ## Network Configuration Below the real-time information panel, the network configuration section displays the complete networking setup for the VM: - **IPv4** — Primary IPv4 address with subnet mask, plus any additional IPv4 addresses - **GW** — IPv4 gateway address - **DNS** — Configured DNS servers (primary and secondary) - **IPv6** — Primary IPv6 address with prefix length, plus any additional IPv6 addresses - **GW** — IPv6 gateway address - **Domain** — The assigned domain name for the VM An informational note reminds the client that only the main IP address is automatically configured on the network interface. Additional IP addresses must be configured manually inside the VM. ![Network configuration](https://doc.puq.info/uploads/images/gallery/2026-04/embedded-image-31j6p1xb.png) ## Disabled actions When a feature is not permitted by the product's client-area permissions (or is temporarily unavailable — for example, during a backup or snapshot operation), the corresponding button stays **visible but dimmed** and is not clickable. This is intentional: the client can see the full list of features the product offers, even if specific ones are not allowed in their plan, and clearly understands the state of their VM while operations are in progress. > **Changed in v3.0.** Feature permissions have moved from the legacy `configoption12` checkboxes to the new Bootstrap-based **Client permissions** panel in the product settings. All permission flags are preserved during upgrade, so the end-user behavior is identical to v2.x. ## Navigation menu Every sub-page in the client service area (Snapshots, Backups, Firewall, Reset password, revDNS, ISO, Charts, Reinstall) has a sidebar **navigation menu** that allows the client to jump between settings without going back to the overview each time. ![Client area sidebar](https://doc.puq.info/uploads/images/gallery/2026-04/embedded-image-omhgmoss.png) If the client navigates directly to a page for a feature that the product does not allow, they see an **Access Denied** error message instead of the feature's UI. The `Overview` and `noVNC` buttons cannot be hidden — they are always available. ## Error messages The client area displays two common error messages: - **Something went wrong** — returned when WHMCS cannot reach the Proxmox server (network issue, credentials invalid, API service down) or when the VM is no longer present on Proxmox. Check the [Log Collection](../08-troubleshooting/01-log-collection.md) chapter for diagnostics. - **Access Denied** — returned when the client tries to open a page (via a direct URL or a bookmarked link) for a feature that is not enabled for their product. # noVNC Console ### Proxmox KVM module **[WHMCS](https://puqcloud.com/link.php?id=77)** ##### [Order now](https://puqcloud.com/whmcs-module-proxmox-kvm.php) | [Download](https://download.puqcloud.com/WHMCS/servers/PUQ_WHMCS-Proxmox-KVM/) | [FAQ](https://faq.puqcloud.com/) The noVNC console provides browser-based remote access to the virtual machine's display, allowing clients to interact with their VM directly without requiring a separate VNC client application. ## Accessing the Console 1. Navigate to the service detail page and click the **noVNC** button in the action bar. 2. A **CONNECT** button will appear along with a note indicating that the link is a one-time connection valid for 10 seconds. 3. Click **CONNECT** to open the noVNC console in a new browser tab. ![noVNC connect button](https://doc.puq.info/uploads/images/gallery/2026-04/embedded-image-d9g6avod.png) ## Connecting After clicking the CONNECT button, a new browser tab opens and establishes a secure, encrypted WebSocket connection to the Proxmox VNC proxy. A status indicator in the console confirms the connection, showing the target QEMU VM identifier. ![noVNC console connecting](https://doc.puq.info/uploads/images/gallery/2026-04/embedded-image-l795mkvr.png) ## Console View Once connected, the full noVNC console is displayed, providing direct keyboard and mouse interaction with the VM. The console toolbar on the left side provides additional controls for clipboard, screen scaling, and connection settings. ![noVNC console connected](https://doc.puq.info/uploads/images/gallery/2026-04/embedded-image-1au3mapa.png) ## Important Notes - The console connection link is **one-time use** and expires after **10 seconds**. If the link expires, click the noVNC button again to generate a new one. - The VM must be in a **running** state to open a console session. - The noVNC feature must be enabled in the product's Client Area Permissions by the administrator. - The connection is encrypted (TLS) between the browser and the VNC proxy server. - Full keyboard input is supported, including special key combinations (Ctrl+Alt+Del, etc.) via the console toolbar. # Charts ### Proxmox KVM module **[WHMCS](https://puqcloud.com/link.php?id=77)** ##### [Order now](https://puqcloud.com/whmcs-module-proxmox-kvm.php) | [Download](https://download.puqcloud.com/WHMCS/servers/PUQ_WHMCS-Proxmox-KVM/) | [FAQ](https://faq.puqcloud.com/) The Charts page provides visual performance graphs showing resource utilization of the virtual machine over time. Data is sourced from Proxmox VE RRD (Round Robin Database) statistics and rendered using the Google Charts library. ## Available Charts The page displays four resource usage graphs: | Chart | Description | |-------|-------------| | **CPU Usage** | Processor utilization as a percentage of allocated cores over time | | **RAM Usage** | Memory consumption showing used vs. available RAM | | **Disk I/O Usage** | Disk read and write throughput, displayed as separate Read MB/s and Write MB/s lines | | **Network Usage** | Network traffic volume with separate lines for inbound (In MB/s) and outbound (Out MB/s) traffic | ## Time Period Tabs Charts can be viewed across different time ranges using the tab buttons at the top of the page: - **Hour** — Last 60 minutes of data - **Day** — Last 24 hours of data - **Week** — Last 7 days of data - **Month** — Last 30 days of data - **Year** — Last 12 months of data Clicking a tab reloads all four charts with data for the selected time period. ![Charts usage](https://doc.puq.info/uploads/images/gallery/2026-04/embedded-image-cmepx0f7.png) ## Notes - The Charts feature must be enabled in the product's Client Area Permissions by the administrator. - The VM must be running to generate new data points. Historical data is available even when the VM is stopped. - Data granularity varies by time period: shorter periods show more detailed data points, while longer periods are averaged. # Reinstall ### Proxmox KVM module **[WHMCS](https://puqcloud.com/link.php?id=77)** ##### [Order now](https://puqcloud.com/whmcs-module-proxmox-kvm.php) | [Download](https://download.puqcloud.com/WHMCS/servers/PUQ_WHMCS-Proxmox-KVM/) | [FAQ](https://faq.puqcloud.com/) The Reinstall page allows clients to reinstall the operating system on their virtual machine. This is a destructive operation that replaces the current OS with a fresh installation from the selected template. ## Process 1. Navigate to the service and click **Reinstall** in the sidebar or from the action buttons on the overview page. 2. A warning is displayed: reinstalling will **completely remove all data on all disks** of the virtual machine, and **all snapshots will also be deleted**. 3. Select the desired operating system from the **Select operating system** dropdown. The available options are configured by the administrator in the product settings. 4. To protect against accidental reinstallation, type the word **REINSTALL** in the confirmation field. 5. Click the **Reinstall** button to begin the process. ![Reinstall page](https://doc.puq.info/uploads/images/gallery/2026-04/embedded-image-oqm5qtqm.png) ## What Happens During Reinstall - The VM is stopped if currently running. - All data on all disks is destroyed. - All existing snapshots are deleted. - The VM is redeployed from the selected OS template using the module's deploy pipeline. - Cloud-init configuration is reapplied (hostname, IP addresses, DNS, user credentials). - **Network identity is preserved** — the original IPv4/IPv6 addresses, the **same network card MAC address**, the VLAN tag and the VMID are kept so that inventory systems, firewalls and DNS records continue to work without changes. - A new root password is generated and sent to the client via email. > **Backups survive a reinstall.** The reinstall procedure explicitly deletes only the VM's disks and snapshots — any existing **backup archives are kept intact**. This gives you a safety net: even after reinstalling a brand-new OS, you can still restore a previous backup to return to the pre-reinstall state. Use this carefully. ## Important Notes - This operation is **irreversible** for the data on the VM disks. All data will be permanently lost. - The Reinstall feature must be enabled in the product's Client Area Permissions by the administrator. - Only OS templates approved by the administrator appear in the dropdown list. - The VM must not be locked by another operation (backup, snapshot, migration) when initiating a reinstall. - The `REINSTALL` confirmation word must be typed **in capital letters** exactly — it's an intentional speed-bump to prevent accidental reinstalls. # Snapshots ### Proxmox KVM module **[WHMCS](https://puqcloud.com/link.php?id=77)** ##### [Order now](https://puqcloud.com/whmcs-module-proxmox-kvm.php) | [Download](https://download.puqcloud.com/WHMCS/servers/PUQ_WHMCS-Proxmox-KVM/) | [FAQ](https://faq.puqcloud.com/) The Snapshots page allows clients to create, rollback, and remove point-in-time snapshots of their virtual machine. Snapshots capture the complete state of the VM, including disk contents and memory (if running), enabling quick recovery to a known good state. > **Snapshots are not backups.** They are intended as a quick safety net during system administration work (package updates, config changes, etc.) — that's why their lifetime is enforced and limited (1–10 days). For long-term data protection use the [Backups](06-backups.md) feature instead. ## Snapshot Quota The snapshot quota is displayed at the top of the page as a counter (e.g., **2/3**), showing the number of existing snapshots out of the maximum allowed. The quota limit is configured by the administrator in the product settings. ## Creating a Snapshot 1. Navigate to the service and click **Snapshots** in the sidebar. 2. Optionally enter a description in the **Snapshot description** text field. 3. Click the **Take Snapshot** button. 4. The snapshot is created in the background. Once complete, it appears in the list below. ## Managing Snapshots Each snapshot in the list displays: - **Name** — The snapshot identifier - **Date and time** — When the snapshot was created - **Remaining lifetime** — A countdown showing how long until the snapshot is automatically deleted (e.g., "0 days 23:59:54") For each snapshot, two actions are available: - **Rollback** — Restore the VM to the exact state captured by this snapshot. The VM will be stopped during the rollback process. - **Remove** — Permanently delete this snapshot to free up storage space and quota. ![Snapshots page](https://doc.puq.info/uploads/images/gallery/2026-04/embedded-image-wzhis8um.png) ## Snapshot Lifetime Snapshots have a configurable lifetime set by the administrator in the product settings. When the lifetime expires, the snapshot is automatically removed by the cron system. The remaining lifetime for each snapshot is displayed in the snapshot list. ## Important Notes - Snapshots consume additional storage space on the Proxmox node. The more changes are made after a snapshot, the larger the snapshot data grows. - The VM must not be locked by another operation (backup, migration, etc.) when creating or managing snapshots. - Rolling back to a snapshot will discard all changes made after the snapshot was taken. - The maximum number of snapshots is determined by the product configuration. # Backups ### Proxmox KVM module **[WHMCS](https://puqcloud.com/link.php?id=77)** ##### [Order now](https://puqcloud.com/whmcs-module-proxmox-kvm.php) | [Download](https://download.puqcloud.com/WHMCS/servers/PUQ_WHMCS-Proxmox-KVM/) | [FAQ](https://faq.puqcloud.com/) The Backups page provides full VM backup management, including scheduled automatic backups, manual on-demand backups, restore from backup, and backup removal. ## Scheduled Automatic Backups The top section of the page displays the backup schedule configuration with a day-of-week grid. For each day of the week (Sunday through Saturday), the client can: - **Enable or disable** the day using the checkbox. - **Set the time** for the backup to run on that day. After configuring the schedule, click **Save Schedule** to apply the changes. When a schedule is configured, the system will automatically create backups at the specified times and delete old backups that exceed the retention quota. An informational note confirms: "If the schedule is configured, the system will automatically create backups and delete old backups." ## Backup Quota The backup quota is displayed as a counter next to the **Backups** heading (e.g., **1/10**), showing the number of existing backups out of the maximum allowed. The quota limit is configured by the administrator in the product settings. ## Creating a Manual Backup 1. Optionally enter a note in the **Backups notes** text field to identify the backup. 2. Click the **Backup now** button. 3. The backup task is submitted to Proxmox and runs in the background. Progress is monitored by the WHMCS cron system. ## Backup List Each backup in the list displays: - **Date and time** — When the backup was created - **Description** — The note entered when creating the backup - **Size** — The storage size of the backup (e.g., 300 GiB) For each backup, two actions are available: - **Restore** — Restore the VM from this backup. The VM will be stopped during the restore process. - **Remove** — Permanently delete this backup to free up storage space and quota. A warning note reminds the client: "In the case of a backup restore, all snapshots of Virtual Machine will be deleted." ![Backups page](https://doc.puq.info/uploads/images/gallery/2026-04/embedded-image-pi4fcsne.png) ## How scheduled backups run On each cron tick the backup task: 1. Checks which VMs have the current weekday enabled in their schedule. 2. Checks whether the configured time-of-day for today is already in the past (so that the job runs once per day, not repeatedly). 3. Checks whether today's backup already exists — if yes, skips. 4. Checks whether there is a free backup slot. If the quota is full, the **oldest** backup is deleted first to make room. 5. Creates the new backup and monitors the Proxmox task until completion. ## Backup restoration Before a backup is restored, the VM must be in a **powered off** state. After a successful restore the module automatically re-applies the current package parameters to the restored VM: 1. Set CPU & RAM if different from the restored values 2. Resize system disk if different 3. Re-apply system disk bandwidth limits 4. Create additional disk if needed 5. Resize additional disk if needed 6. Re-apply additional disk bandwidth limits 7. Re-apply network configuration (bridge, VLAN, bandwidth, MAC) 8. Start the VM 9. Send the **Backup restored** email to the client If the restore fails for any reason, the client is given the option to retry the restore or to reinstall the virtual machine from scratch. ## Important Notes - Backups are stored on the backup storage configured in Proxmox by the administrator. - Restoring a backup will stop the VM and delete all existing snapshots. - Backup creation runs as a background task; large VMs may take considerable time to back up. - Scheduled backups are executed by the WHMCS cron system. Ensure that the cron is running properly for scheduled backups to function. - **While a backup is being created or restored, all other VM management operations are suspended** — Start/Stop, Reinstall, Reset password, Snapshots and package changes are locked until Proxmox releases the backup lock. - The datastore used for backups must either not rotate backup copies, or rotate them in a way that does not interfere with the number of spare copies purchased by the client. # Reset Password ### Proxmox KVM module **[WHMCS](https://puqcloud.com/link.php?id=77)** ##### [Order now](https://puqcloud.com/whmcs-module-proxmox-kvm.php) | [Download](https://download.puqcloud.com/WHMCS/servers/PUQ_WHMCS-Proxmox-KVM/) | [FAQ](https://faq.puqcloud.com/) The Reset Password page allows clients to generate a new root/admin password for their virtual machine. The new password is applied via cloud-init and sent to the client by email. ## Process 1. Navigate to the service and click **Reset password** in the sidebar. 2. Review the informational note about cloud-init requirements. 3. Click the **Reset Password** button. 4. A new password is automatically generated by the system. 5. Cloud-init applies the new password to the VM. 6. The new password is sent to the client via the configured email template. ![Reset password page](https://doc.puq.info/uploads/images/gallery/2026-04/embedded-image-0lhxbp5n.png) ## Cloud-Init Requirement An informational note on the page states: "Password reset requires cloud-init packages installed on the VM. If reset succeeds but password doesn't change, connect via noVNC and change manually." This means: - The **cloud-init** package must be installed and properly configured inside the VM's operating system. - The **QEMU guest agent** is recommended for the password change to take effect immediately. - If cloud-init is not installed or not functioning, the password reset command will succeed on the API level but the actual password inside the VM will not change. In this case, the client should use the noVNC console to log in and change the password manually. ## Important Notes - The Reset Password feature must be enabled in the product's Client Area Permissions by the administrator. - The VM should be in a **running** state for the password change to be applied by cloud-init. - The generated password is random and secure. The client receives it only via the configured email template. - If the VM was deployed from a template that does not include cloud-init, this feature will not work as expected. > **Changed in v3.0.** The password reset flow now works on a **running** VM via cloud-init (and the QEMU guest agent if installed) — the client does not need to stop the VM first. In **v2.x and earlier**, the client had to manually power off the VM before resetting the password; the module then generated the new password, rewrote cloud-init and started the VM back up. If you are documenting behaviour for clients running an older version, keep that difference in mind. # Reverse DNS ### Proxmox KVM module **[WHMCS](https://puqcloud.com/link.php?id=77)** ##### [Order now](https://puqcloud.com/whmcs-module-proxmox-kvm.php) | [Download](https://download.puqcloud.com/WHMCS/servers/PUQ_WHMCS-Proxmox-KVM/) | [FAQ](https://faq.puqcloud.com/) The Reverse DNS page allows clients to configure PTR (pointer) records for all IP addresses assigned to their virtual machine. Reverse DNS records map IP addresses back to hostnames and are commonly required for mail servers and other services that perform reverse lookups. ## Configuration 1. Navigate to the service and click **revDNS configure** in the sidebar. 2. Each IP address assigned to the VM (both IPv4 and IPv6) is listed with an editable hostname field. 3. Enter the desired hostname for each IP address. 4. Click the **Save** button to apply the changes. The page lists all assigned addresses, including: - All IPv4 addresses (primary and additional) - All IPv6 addresses (primary and additional) Each address has its own hostname input field, allowing independent reverse DNS configuration per IP. ![Reverse DNS page](https://doc.puq.info/uploads/images/gallery/2026-04/embedded-image-m9u1juvh.png) ## DNS Propagation An informational note at the top of the page states: "DNS changes take 1-8 hours to propagate across servers." After saving, the reverse DNS records are automatically synchronized with the configured DNS provider (Cloudflare or HestiaCP, as configured in the addon module). However, due to DNS caching and propagation across the internet, the changes may not be visible to all resolvers immediately. ## Important Notes - The RevDNS feature must be enabled in the product's Client Area Permissions by the administrator. - The DNS addon module must be configured with the appropriate reverse DNS zones for the IP ranges used by the VM. - Hostnames must be in a valid DNS format (e.g., `mail.example.com`). - Reverse DNS is particularly important for email delivery. Many mail servers reject messages from IP addresses without proper PTR records. ## Ticket-based fallback > **Still supported for operators without a DNS API.** If your reverse-DNS infrastructure does not expose an API (neither Cloudflare, HestiaCP nor PowerDNS), the module can fall back to **opening a WHMCS ticket** when the client requests a revDNS change — you then apply the change by hand on your DNS server. > > This is configured in the product settings under **Integrations → Revdns ticket / RevDNS ticket department**. When a ticket department is selected, saving the reverse-DNS form creates a new WHMCS ticket in that department with the requested IP→hostname mapping instead of calling the DNS provider. > **Changed in v3.0.** With the PowerDNS provider added alongside Cloudflare and HestiaCP, most deployments can now use the automatic path and do not need the ticket fallback any more. The ticket mode is still available for mixed setups or for operators who deliberately want manual approval of every PTR change. # ISO Mount ### Proxmox KVM module **[WHMCS](https://puqcloud.com/link.php?id=77)** ##### [Order now](https://puqcloud.com/whmcs-module-proxmox-kvm.php) | [Download](https://download.puqcloud.com/WHMCS/servers/PUQ_WHMCS-Proxmox-KVM/) | [FAQ](https://faq.puqcloud.com/) The ISO Mount page allows clients to mount and unmount ISO images on their virtual machine's virtual CD/DVD drive. ISO images are organized into categorized folders for easy browsing. ## Currently Mounted ISO If an ISO image is currently mounted, it is displayed at the top of the page with a highlighted status bar showing the filename (e.g., "Mounted: alpine-standard-3.21.3-x86_64.iso") and an **Unmount** button to eject it. ## Browsing Available ISOs ISO images are organized into folders by category. Each folder displays: - **Folder name** — The category name (e.g., ALPINE, DEBIAN, TAHR), shown with a folder icon - **File count** — The number of ISO files in that folder Inside each folder, individual ISO files are listed with their full filename and a **Mount** button. ### How the categorization works To keep the ISO list readable the module derives the folder name from the **part of the filename before the first `-` character**: - `Debian-12.5.0-amd64-netinst.iso` → folder **Debian** - `alpine-standard-3.21.3-x86_64.iso` → folder **alpine** - `myimage.iso` (no dash at all) → folder **OTHER** Follow this convention when uploading ISOs to your Proxmox ISO storage. PUQcloud publishes a set of pre-built ISO images that are named in this convention and ready to use — see the ISO storage on [files.puqcloud.com](https://files.puqcloud.com/). ## Mounting an ISO 1. Navigate to the service and click **ISO mount** in the sidebar. 2. Browse the available ISO folders to find the desired image. 3. Click the **Mount** button next to the ISO file. 4. The ISO is attached to the VM's virtual CD/DVD drive and becomes available for booting or installation. ## Unmounting an ISO 1. Locate the currently mounted ISO at the top of the page. 2. Click the **Unmount** button. 3. The ISO is ejected from the virtual CD/DVD drive. ![ISO mount page](https://doc.puq.info/uploads/images/gallery/2026-04/embedded-image-twvhbmfz.png) ## Use Cases - **Recovery operations** — Boot from a rescue ISO to repair a broken system - **Manual OS installation** — Install an operating system from an ISO image - **Additional software** — Mount driver or utility ISOs for installation - **Diagnostics** — Boot diagnostic tools (e.g., memtest, disk utilities) ## Important Notes - The ISO mount feature must be enabled in the product's Client Area Permissions by the administrator. - Available ISO images are sourced from the ISO storage configured in the Proxmox product settings. Only ISOs uploaded by the administrator to that storage will appear. - To boot from a mounted ISO, the VM's boot order may need to be configured to include the CD/DVD drive. - Only one ISO can be mounted at a time. Mounting a new ISO will replace the currently mounted one. # Firewall ### Proxmox KVM module **[WHMCS](https://puqcloud.com/link.php?id=77)** ##### [Order now](https://puqcloud.com/whmcs-module-proxmox-kvm.php) | [Download](https://download.puqcloud.com/WHMCS/servers/PUQ_WHMCS-Proxmox-KVM/) | [FAQ](https://faq.puqcloud.com/) The Firewall page provides clients with full control over their virtual machine's Proxmox firewall, including default policies and individual traffic rules. ## Firewall Policies At the top of the page, two default policies can be configured: - **Input Policy** — The default action for incoming traffic (ACCEPT or DROP) - **Output Policy** — The default action for outgoing traffic (ACCEPT or DROP) After selecting the desired policy values from the dropdown menus, click the **Save** button to apply them. These policies determine what happens to traffic that does not match any specific rule. ## Firewall Rules Below the policies section, the rules table displays all configured firewall rules. The rule count is shown as a badge next to the heading (e.g., **4**). ### Rules Table Columns | Column | Description | |--------|-------------| | **#** | Rule position number (determines evaluation order) | | **Dir** | Traffic direction: **IN** (inbound) or **OUT** (outbound) | | **Action** | What to do with matching traffic: **ACCEPT** (allow, shown in green) or **DROP** (block, shown in red) | | **Proto** | Protocol filter (e.g., tcp, udp, any) | | **Source** | Source IP address or network (or "any" for all sources) | | **S.Port** | Source port or port range (or "any" for all ports) | | **Dest** | Destination IP address or network (or "any" for all destinations) | | **D.Port** | Destination port or port range (or "any" for all ports) | | **Comment** | Optional description of the rule's purpose | ### Adding a Rule Click the **+ Add Rule** button to open the rule creation modal. Fill in the rule parameters (direction, action, protocol, source, destination, ports, and comment) and save. ### Reordering Rules Rules are evaluated in order from top to bottom. The drag handle (grid icon) on the left side of each rule row allows drag-and-drop reordering. Drag a rule up or down to change its evaluation priority. The first matching rule determines the action taken on the traffic. ### Deleting a Rule Click the red delete button on the right side of a rule row to remove it. The rule is deleted immediately. ![Firewall rules page](https://doc.puq.info/uploads/images/gallery/2026-04/embedded-image-rcdpnygy.png) ## How Rules Are Evaluated 1. Incoming or outgoing traffic is checked against the rules in order, starting from rule #0. 2. The first rule that matches the traffic's direction, protocol, source, destination, and ports determines the action (ACCEPT or DROP). 3. If no rule matches, the default policy (Input Policy or Output Policy) is applied. ## Important Notes - The Firewall feature must be enabled in the product's Client Area Permissions by the administrator. - Anti-spoofing IPSet rules are automatically managed by the module to prevent IP address spoofing from the VM. - Rule changes take effect immediately on the Proxmox firewall. - Be cautious when changing the default Input Policy to DROP, as this will block all incoming traffic that is not explicitly allowed by a rule. Ensure you have an ACCEPT rule for your management access (e.g., SSH on port 22) before changing the policy.