+TIP: Please open a SSH connection to one of your {PVE} hosts before
+enabling the firewall. That way you still have access to the host if
+something goes wrong .
+
+To simplify that task, you can instead create an IPSet called
+``management'', and add all remote IPs there. This creates all required
+firewall rules to access the GUI from remote.
+
+
+[[pve_firewall_host_specific_configuration]]
+Host Specific Configuration
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Host related configuration is read from:
+
+ /etc/pve/nodes/<nodename>/host.fw
+
+This is useful if you want to overwrite rules from `cluster.fw`
+config. You can also increase log verbosity, and set netfilter related
+options. The configuration can contain the following sections:
+
+`[OPTIONS]`::
+
+This is used to set host related firewall options.
+
+include::pve-firewall-host-opts.adoc[]
+
+`[RULES]`::
+
+This sections contains host specific firewall rules.
+
+[[pve_firewall_vm_container_configuration]]
+VM/Container Configuration
+~~~~~~~~~~~~~~~~~~~~~~~~~~