16
What's up with my Proxmox firewall? (lemmy.ninja)
submitted 1 year ago by RotaryKeyboard@lemmy.ninja to c/selfhosted@lemmy.world
5 comments fedilink hide all child comments

cross-posted from: https://lemmy.ninja/post/46230 because the kbin.social proxmox community is still teeny tiny.

I've been wondering why traffic seems to get through to LXCs and VMs on ports in spite of the Datacenter firewall being active. It's my understanding that the Datacenter firewall has an implicit DROP rule (which I confirmed is set) and that once active, it drops all traffic for all nodes and VMs and LXCs under those nodes.

However, when I port-forward port 32400 from my router to a Plex LXC, traffic gets through. If I forward port 80 from my router to my reverse proxy LXC, traffic gets through on that port.

Right now I have the datacenter, node, and VM/LXC firewalls enabled. Only the Datacenter firewall has any rules at all, which are:

  • Allow traffic to port 8006 from all subnets in my local network
  • Allow ICMP traffic from all subnets in my local network.

I confirmed that the input policy is DROP on both the Datacenter and LXC firewalls.

(I'm using Proxmox 8.0.3.)

Why is traffic forwarded from my gateway router making it into my LXCs?

Thanks for any help on this.

top 5 comments
sorted by: hot top controversial new old
[-] fidde@lemm.ee 2 points 1 year ago

You mention dc, host and vm for the firewall. There is also a separate setting for the vm nic, have you checked that?

[-] RotaryKeyboard@lemmy.ninja 1 points 1 year ago

I’m not familiar with how firewalls for a network interface card work. Unless you mean the firewall in the virtualized operating system?

[-] fidde@lemm.ee 2 points 1 year ago

I'm talking about the option under "VM" -> Hardware -> Network device -> Firewall.

Image

[-] manitcor@lemmy.intai.tech 1 points 1 year ago

there is a similar issue when running docker on ubuntu with UFW, the containers bypass the firewall without updates to routing.

I expect the details here are different but it sounds like largely the same issue.

[-] anon@lemm.ee 1 points 1 year ago

I don't have experience with Proxmox specifically but usually the policy at play during forwarded traffic is not of the INPUT but of the FORWARD chain.

this post was submitted on 03 Jul 2023
16 points (94.4% liked)

Selfhosted

40198 readers
632 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz