List of aliases and where they are applied to.

[r7Y2]

Hello Forum,

I'm currently experimenting with a host/cluster running nftables as firewall. It seems that Proxmox generates some aliases in the background (e.g., “local_network”) and applies them to IP sets (namely “management” in the case mentioned above).

Could someone point me to a comprehensive list of aliases, the data they get populated with and which IPSet they get applied to? So far, I haven’t been able to find anything regarding a list, let alone an explanation of what the aliases get populated with.

Thanks in advance!

 

[shanreich]

You can find the descriptions here in the documentation [1]. There are also auto-generated IPSets for SDN, if you're using that [2]

[1] https://pve.proxmox.com/pve-docs/pve-admin-guide.html#pve_firewall_ip_aliases
[2] https://pve.proxmox.com/pve-docs/pve-admin-guide.html#pvesdn_firewall_integration

 

[r7Y2]

Thanks for the reply @shanreich !

However, that doesn’t really answer my original question about a comprehensive list and how it is populated. For example, the documentation mentions “cluster_network” and states that it is added to the management IP set, but it doesn’t clarify where the data comes from. Is this the network defined by the same variable in ceph.conf? With “local_network,” it’s the other way round, the documentation specifies where the IP address comes from, but not where it’s used. Also, so far I’ve read about “local_network” and “cluster_network”, are there any others?

The reason I’m bringing this up is that the management IP block opens up a whole range of ports, and I’m not particularly thrilled that something in the background seems to be happily adding IP ranges without me being able to prevent it or at least track where the IPs are coming from.

 

[shanreich]

You can check via:

pve-firewall localnet

It resolves the hostname and then checks which interface the IP belongs to, then uses the subnet configured there.

Also, so far I’ve read about “local_network” and “cluster_network”, are there any others?

The ipfilter-net* and SDN networks - otherwise, on the host layer no.

The reason I’m bringing this up is that the management IP block opens up a whole range of ports, and I’m not particularly thrilled that something in the background seems to be happily adding IP ranges without me being able to prevent it or at least track where the IPs are coming from.

You can always manually override both the alias and the IPSey by creating them explicitly.

 

[r7Y2]

Thanks!

You can always manually override both the alias and the IPSey by creating them explicitly.

That is what I initially did, to no avail. I just looked up the source code for the chain compiler and indeed the manually defined IP set does not override the alias, instead the alias gets appended to the manually defined list: https://github.com/proxmox/proxmox-...roxmox-firewall/src/firewall.rs#L193C1-L229C6

My solution is to manually set the alias to an unused address and then add it to the management-nomatch set. That Isn't pretty, because there's an IP in the management set that shouldn't be there, but as long as the nomatch mechanism doesn't change its logic of superseding it shouldn't be a problem.