Thx for the feedback, I don’t have multiple router no. If I had would it be still called VLAN? I thought the V was Virtual for achieving that LAN segmentation with one router. With one router, don’t you think the security added is the same level as configuring a firewall on each VM/LXC ?

Yes the idea is to make it easier to isolate/configure firewall rules and try to protect more sensitive data. (i.e. I don’t care much if people can access my ISOs ;) However, at the end of the day they are all on the same Proxmox host.

They are all defined as 192.168.x.y/24 Doesn’t this make them in different subnets?

Wow didn’t know it was gone:

https://blog.cloudflare.com/updated-tos/

But this implies the check happens on my server right ? Which probably makes sense for advanced users.