How to Isolate OpenClaw from Your LAN Using Proxmox + Tailscale
Running OpenClaw? Isolate It Before It Touches Your Network
Running experimental services, automation agents, or unfamiliar software in your homelab can introduce real risk — especially if those systems sit directly on your local network.
A safer approach is to isolate those workloads inside a private virtual network while still maintaining convenient remote access.
What This Setup Achieves
Here’s the goal:
✔ VM cannot see my home network
✔ home network cannot see the VM
✔ VM still has internet access
✔ I can securely access it remotely
✔ no router port forwarding
✔ no exposed services
Basically:
full isolation + full control
We’ll use:
- Proxmox internal NAT networking
- Tailscale secure overlay network
This pattern is ideal for running:
- AI automation systems
- web scraping agents
- testing environments
- self-hosted services you don’t fully trust yet
Quick Summary
Instead of putting the VM on my normal network bridge (vmbr0), I create a private virtual network inside Proxmox.
Then:
- Nothing touches my LAN directly
- Proxmox performs NAT routing for outbound internet
- Tailscale provides secure inbound access
Security model:
VM → private bridge → Proxmox NAT → internet
↑
Tailscale tunnel
Result:
- VM cannot see your LAN
- LAN cannot access VM
- Only authenticated Tailscale clients can connect
This is a clean zero-trust architecture for homelab experimentation.
Why Not Just Use a Bridged Network?
By default, most Proxmox VMs connect to vmbr0, which bridges directly to your physical network.
That means your VM behaves like any other device on your router.
Risks include:
- network scanning
- credential harvesting
- lateral movement if compromised
- unintended service exposure
For high-risk or experimental workloads, bridged networking is rarely ideal.
Step 1 — Create an Internal Network Bridge in Proxmox
First, I create a bridge that is not connected to any physical interface.
In Proxmox Web UI
Navigate to:
Datacenter → Node → System → Network → Create → Linux Bridge
Configure:
Name: vmbr1
Address: 10.10.10.1/24
Bridge ports: (leave empty)
Autostart: yesThis creates a private subnet. Nothing outside Proxmox can see it.
Step 2 — Enable NAT Routing on the Proxmox Host
Now I allow that private subnet to reach the internet — but only outward.
Edit:
/etc/network/interfaces
Add routing rules under the vmbr1 section:
auto vmbr1
iface vmbr1 inet static
address 10.10.10.1/24
bridge-ports none
bridge-stp off
bridge-fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o vmbr0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s 10.10.10.0/24 -o vmbr0 -j MASQUERADE
Reboot the Proxmox host.
Your private network can now reach the internet through NAT, but nothing can come in. Exactly what we want.
Step 3 — Attach the VM to the Private Bridge
When creating or editing your VM:
Hardware → Network Device → Bridge → vmbr1
The VM is now physically isolated from your LAN. (But, remember, the VM is getting internet.)
Step 4 — Configure Static Networking Inside the VM
Example configuration:
IP: 10.10.10.10
Subnet: 255.255.255.0
Gateway: 10.10.10.1
DNS: 1.1.1.1
Verify:
ping 10.10.10.1
ping 8.8.8.8
The VM should have internet but no LAN visibility.
Step 5 — Install Tailscale for Secure Remote Access
Now the fun part. Instead of opening ports or touching the router, I just join the VM to my Tailscale network.
Inside the VM:
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --ssh
Authenticate via browser.
Now you can connect from anywhere:
tailscale ssh user@vm-hostname
Encrypted. Authenticated. No port forwarding.
Step 6 — Restrict LAN Access Completely
Optional but highly recommended firewall rule inside the VM:
sudo iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
This prevents any accidental communication with your home network.
Why I Love This Setup
It gives me permission to experiment freely.
I can run:
- automation agents
- web crawlers
- new software
- public-facing services
- anything experimental
And I never worry about lateral movement into my home network. Isolation becomes the default, not the exception.
When Should You Use This Architecture?
Use this setup if you run:
- automation agents
- unknown containers
- public-facing services
- development stacks
- security testing environments
For trusted services like NAS or Home Assistant, bridging may still be appropriate.
Hardware Recommendations (Optional)
If you plan to run multiple isolated environments, consider:
- mini PC with 32GB RAM
- NVMe storage
- multi-core CPU
Common Troubleshooting
VM has no internet
Check:
- IP forwarding enabled
- NAT rule applied
- correct bridge interface
Cannot connect via Tailscale
Verify:
tailscale status
and confirm ACL permissions.
FAQ
Does this replace VLAN segmentation?
No. VLANs segment physical networks. This isolates virtual workloads.
Is double NAT a problem?
Not for typical homelab use. It’s standard practice for lab isolation.
Can multiple VMs share the same private network?
Yes. Assign unique IPs within the subnet.
Final Thoughts
Network isolation is one of the simplest ways to dramatically improve homelab security.
By combining Proxmox internal NAT with Tailscale, you get:
- strong containment
- simple remote access
- minimal complexity
It’s a practical foundation for running experimental or high-risk workloads safely.
Related Guides (coming soon…)
- Setting Up Tailscale for Remote Homelab Access
- Beginner’s Guide to Proxmox Networking
- How to Secure Self-Hosted Services with Reverse Proxies
Disclosure
Some links may be affiliate links. This helps support Meiso Lab at no additional cost to you.
