What is the best firewall for proxmox??

[raid]

Searching for "PROXMOX FIREWALL" I found this page http://sourceforge.net/project/screenshots.php?group_id=149949 .
Does anyone know what is this project?
looks like an old project

 

[whinpo]

done by the Proxmox team..
look at the

posted by martinmaurer 1742 days ago

 

[raid]

So, it is a stopped project:
http://forum.proxmox.com/threads/3454-Proxmox-firewall-AKA-proxwall-question?highlight=proxwall
the screenshots looked pretty good.

 

[raid]

Where is better install shorewall into the HN or into a dedicated VM?
thanks again

 

[rootkid]

I will install it on the proxmox host itself, because i want it to be secured, too. Seems better than having it unsecured and being forced to install it on every single guest...

 

[yatesco]

I will install it on the proxmox host itself, because i want it to be secured, too. Seems better than having it unsecured and being forced to install it on every single guest...

If you install it on a dedicated VM the idea is that every other VM hides behind it and the dedicated firewall VM does NAT/port forwarding to the 'internal' VMs. You certainly don't need to install it on every VM

 

[raid]

If you install it on a dedicated VM the idea is that every other VM hides behind it and the dedicated firewall VM does NAT/port forwarding to the 'internal' VMs. You certainly don't need to install it on every VM

This also applies if you install the firewall on the HN hiding every other VM behind it?

 

[twocell]

http://montanalinux.org/proxmox-ve-with-shorewall.html
http://www.montanalinux.org/proxmox-ve-with-shorewall-part2.html

Good info, thanks!

 

[raid]

I applied the http://www.montanalinux.org/proxmox-...all-part2.html suggested configurations.
shorewall check return OK but when start the firewall using shorewall try /etc/shorewall 60, it's all blocked, I have no ssh access, no http access, no https access, no lan access, no internet access looks like it's all closed.

Did I miss anything?
thx

 

[yatesco]

This also applies if you install the firewall on the HN hiding every other VM behind it?

Yep, *but* be careful - I did this originally (using shorewall) but every time I wanted to add a new public IP I had to restart the machine. This is less painful when it is a VM but very painful when it is the physical machine.

 

[raid]

Yep, *but* be careful - I did this originally (using shorewall) but every time I wanted to add a new public IP I had to restart the machine. This is less painful when it is a VM but very painful when it is the physical machine.

This is a very helpfull and important "statement"!
Thank you!

 

[rootkid]

shouldn't it be ok just to trigger the shorewall script and restart iptables?
AFAIK, shorewall is just a bunch of seperate config files that are put together into iptables-rules by the shorewall-scripts...
If i'm forced to restart the whole Host i will of course put the firewall on a VM, too...

 

[firesoft]

is it secure to install in a VM a firewall like pfsense and use that as a gateway for the rest of the VM's

home Router --> ProxMox (10.0.0.0)--> pfsense vm with Wan 10.0.0.2 , Lan 192.168.1.1 --> dhcp 192.168.1.0 VM1
--> dhcp 192.168.1.0 VM2

 

[coffe]

We are running shorewall on our hosts that have external access.

 

[firesoft]

I mean all the VM's are on the same physical machine which has 2 NICs hardware-->proxmox-->pfsense-->VM's
Is it secure this way ?

 

[coffe]

in one of our clusters , that we have remote. we are running shorewall to protect the proxmox hosts. then a virtual firewall for that network. and its also are running shorewall.

 

[firesoft]

Thanks, i understand that
Say that i don't use a firewall on the the base proxmox is it secure against attacks ? I will only use NAT on the router/adsl before proxmox... as i posted
before

 

[coffe]

it then depends on how you forward ports.

 

[marotori]

Personally.... There are two I recommends.

1. Vyatta
2. PfSense

Both are free - and can also run in a vm guest if required. Both are very different and suit different types of users!

Rob


Sent from my iPhone using Tapatalk

 

[JimBeam]

Agree with Rob that both are fine. pfsense is easy to set up using the web interface.
Vyatta offers a lot of options as well; the free version only has a CLI, no web interface.
Both work nicely in a dedicated VM. I initially chose Vyatta because it supports the virtio network card, now I just love it

coffe is right about NAT+port forwarding.

For added security, I made sure the Proxmox host doesn't use an IP address on the WAN side by setting the IP configuration to manual (not automatic/DHCP or static)
/etc/network/interfaces

iface eth0 inet manual

auto vmbr0
iface vmbr0 inet manual
        bridge_ports eth0
        bridge_stp off
        bridge_fd 0

The vmbr0 bridge is connected as the WAN interface in my Vyatta VM...