[PVE-User] Single host with public access to VM only

[jon at whiteheat.org.uk]

Hi,

  I have single box Proxmox setup, with 1 public IP on the host, and
several VMs with private IPs, using Shorewall on the host to port-forward.

What I'd like is 1 VM, with 2 interfaces running pfsense, with public and
private IPs.  Thus, being able to disable public access directly to the
host, and instead giving it a private IP.

So, what's the best way to do this?

Regards,
Jon