Apply common rules to all VM

[jmartinb]

Hi,

I'm trying to setup the new 3.3 firewall to get rid of our dedicated firewall box and get faster acces to all the CT's.
I would like to have a common set of rules that apply to all VM/CT, for example enable Ping and web access and limit ssh to a group of management IP addresses.
All our VM/CT are on separated subnets from the HW nodes, and I've tried to define these rules in Datacenter view, setting theses subnets as the destination address (via ipset).
However, after some trial and errors I've found that it's not possible to do that as the rules do not apply. Has anyone tried this setting?

Thanks a lot.

 

[spirit]

Hi,

datacenter rules apply only the proxmox hosts (INPUT|OUPUT iptables).

But, you can create a security group at datecenter level, with somes rules inside.

then add this security group on each vm firewall.

 

[jmartinb]

Thanks spirit.
That's what I suspected from the iptables rules generated by Proxmox firewall.
I will follow your advice about creating a new security group with a common set of rules.
Best regards.