How Hub-and-Spoke Architecture Secures Self-Hosted Proxmox LXC Clusters

Running multiple self-hosted services on a single Proxmox node using a default flat network exposes the entire infrastructure to lateral movement if any one container is compromised. A hub-and-spoke model addresses this by routing all traffic through a central 'Hub' container acting as a router and reverse proxy, while 'Spoke' containers hosting applications are isolated on an internal network with no direct physical access. The setup involves creating an isolated Linux bridge (vmbr1), configuring the Hub with dual network interfaces, and using iptables NAT masquerading so Spokes can reach the internet for updates without being directly reachable from outside. HAProxy is deployed on the Hub to manage incoming web traffic, while CrowdSec and its HAProxy bouncer provide Layer 7 threat detection and automatic blocking of malicious IPs before they reach any Spoke. The result is a production-ready cluster where a compromised application container cannot scan the broader network, and security management is centralized at a single chokepoint.