These filters belong to a VM’s network interface and are mainly used to prevent IP spoofing. If such a set exists for an interface then any outgoing traffic with a source IP not matching its interface’s corresponding ipfilter set will be dropped.
For containers with configured IP addresses these sets, if they exist (or are activated via the general IP Filter option in the VM’s firewall’s options tab), implicitly contain the associated IP addresses.
For both virtual machines and containers they also implicitly contain the standard MAC-derived IPv6 link-local address in order to allow the neighbor discovery protocol to work.
Code:/etc/pve/firewall/<VMID>.fw [IPSET ipfilter-net0] # only allow specified IPs on net0 192.168.2.10
Let's suppose that we have 3 VMs. First uses `192.168.1.10`, second uses `192.168.1.11`, third one uses `192.168.1.12`. All of them are on the same node and on the same subnet. I would like to keep 192.168.1.14 free/reserved for another VM. In our current setup, users on the same subnet are able to freely assign any IP from their subnet.What exactly do you mean by that?
And what if the user controls his own Proxmox Firewall rules? Can this be superseeded somehow by a "higher level software firewall"?You can use the Firewall: https://pve.proxmox.com/wiki/Firewall#pve_firewall_ip_sets
Standard IP set ipfilter-net*
I added an additional FW Rule which only accept Traffic to the Target IP which are configured in IPset.
AFAIK not. But if you offer your Customer a Webinterface, then its about you. Otherwise you should use an own Router and create a VLAN for every Customer you have, there you can bind some IPs - bit this is a heavy overhead.And what if the user controls his own Proxmox Firewall rules? Can this be superseeded somehow by a "higher level software firewall"?
Supposing that I won't give them access to the Proxmox interface, but still allow him access to the firewall (via API -> third-party control panel), will this allow him to remove limits imposed in `/etc/pve/firewall/ID.fw`?AFAIK not. But if you offer your Customer a Webinterface, then its about you. Otherwise you should use an own Router and create a VLAN for every Customer you have, there you can bind some IPs - bit this is a heavy overhead.
Sure, if you do not prevent it. But this is completely your part, you can define some prefix and only these rules are visible to the customer.(via API -> third-party control panel), will this allow him to remove limits imposed in `/etc/pve/firewall/ID.fw`?
