FirewallSDN webserver isolation from rest of the services

[SialoS]

Hi guys,
I have various containers in my pve and i also want to host my website and an ngix reverse proxy.

I set up, through SDN a simple zone and a vnet and on that vnet i added the two containers, ngix and webserver for security reasons. In case my webserver gets hacked, my samba shares and other containers would be safe. Safer anw.

But, from my webserver i can ping my pve ip, and any other container, and i can also ping from other containers the webserver container in the vnet. So the containers within vnet can see out from the vnet and also the reverse is true. As i understand this is normal behaviour and i should use proxmox firewall to isolate the containers.

My question is, if i will be using the firewall to isolate the containers in the vnet, what benefits do i gain from using SDN to begin with? Why not just using only the firewall to isolate the two containers?

 

[shanreich]

SDN simple zone for instance makes using SNAT easier and should have additional benefits in the future. The behavior you are describing trips up quite a few users so we are thinking about how to change this / make it more intuitive in the future.