firewall on or off?

[ml1941]

If I look at Firewall -> Options on the Datacenter, Firewall is "No". This is consistent with the docs at https://pve.proxmox.com/pve-docs/chapter-pve-firewall.html#pve_firewall_cluster_wide_setup If I look at each node individually, Firewall is "Yes". I see no /etc/pve/firewall/cluster.fw and no host.fw in any of the /etc/pve/nodes directories. So what does this actually mean (datacenter firewall == No and Node firewall == Yes) in terms of the state of the firewall? If the firewall is on at each node, which rules are active if there are no per-node host.fw files?

If I edit "Firewall" in "Firewall -> Options" on the node level, I do see "Warning: Firewall still disabled at the datacenter level!" but I don't know what this actually means in terms of what the firewall is doing.

Both nodes are: pve-manager/7.2-7/d0dd0e85 (running kernel: 5.15.39-1-pve)

 

[spirit]

datacenter firewall need to be enabled, to enable the push of the rules everywhere. (host + vm).

if you don't need firewall on a specific host (not vm), you can't disable firewall on this host.


if you define rules at datacenter level + host level, they are merged together for the rules of this host (not vms)

- first the rules on the host
- then rules of the datacenter