Protect the routing boundary before opening services: inventory firewall ownership, apply a deliberately scoped IPv4 forwarding and NAT lab, test negative paths, and keep a verified rollback.
Build the host before the routers: choose a storage layout, preserve provider WAN connectivity, prepare isolated bridges, and prove emergency recovery.
Route only required workload subnets and keep host recovery outside the tunnel.
Before deploying routers and VMs, define trust boundaries, IP ownership, management recovery, and a testable rollout plan.
A staged, console-first tutorial for a Hetzner Proxmox host with two routed CHR transit networks and a separate NATed private VM LAN.