Simple zone SDN

[UtilisateurCXS]

I need help because I can't isolate two VMs on two different VNets, in two different zones, each with their own subnet, and it still manages to ping. I've also enabled the data center firewall on the node and on the VNets. Here are some screenshots of my configuration:


Firewall datacenter with non rule :



Node firewall :





Zone :

 

[shanreich]

The traffic between those two zones gets routed by the host, so you'd need to create the forward rules on the host (where the routing happens), not inside the VNet firewall. Also, in order to use the forward rules you'd need to activate the nftables firewal (which is still in tech preview state!).

 

[UtilisateurCXS]

So what exactly is the purpose of the vnet firewall?

 

[UtilisateurCXS]

The traffic between those two zones gets routed by the host, so you'd need to create the forward rules on the host (where the routing happens), not inside the VNet firewall. Also, in order to use the forward rules you'd need to activate the nftables firewal (which is still in tech preview state!).

Thanks you

 

[shanreich]

So what exactly is the purpose of the vnet firewall?

it is for filtering traffic inside the vnet itself - you can check the documentation for more information [1]

[1] https://pve.proxmox.com/pve-docs/pve-admin-guide.html#_directions_amp_zones

 

[UtilisateurCXS]

Thanks you.