I have solved my own issue, here is how I did it (using the Proxmox firewall within the web GUI):
- Log into the Proxmox web GUI
- With the view in the top right set to "Server View", select the "Datacenter" folder right below it
- Select the "Firewall" tab to the right to configure the firewall
Since I enabled the firewall, I had to set some rules to allow traffic to the web GUI (TCP 8006) and SSH (TCP 22)
- On the "Firewall" tab, go to "Add" and add the following rules:
Direction: in | Action: ACCEPT | Protocol: tcp | Dest. port: 8006
Direction: in | Action: ACCEPT | Protocol: tcp | Dest. port: 22
Leave all of the other fields blank except the ones described above
- While on the "Firewall" tab, look on the bottom of the page for another tab titled "Options" and select it
- Edit the option "Enable Firewall" to "Yes"
- Next, Select the node in which the guest KVM machine is that you want to assign an IP too and select the "Firewall" tab again
- Select the "Options" tab at the bottom again and make sure that the option "Enable Firewall" is set to "Yes"
- Select the KVM guest now on the server view tree to the left which you want to assign an IP to
- Under the hardware tab, select the network device you are using (net0 in my case) and make sure that the "Firewall" box is checked.
Note: when you do this, it should append firewall=1 to the string of options
Since I enabled the firewall for the guest KVM machine, I had to add a rule to accept traffic (by default, I don't think there are any traffic rules)
- Select the "Firewall" tab and click "Add" to add the following rules:
Direction: in | Action: ACCEPT
Leave all of the other fields blank except the ones described above, this rule should allow all traffic to pass to the VM, you could theoretically add more rules here if you only wanted to let certain traffic pass
The above guide is for enabling the firewall, the next part is how I was able to assign an IP that the KVM guest was allowed to use
Note: At this point I restarted the node, I am not sure if you have to do this for the firewall to take affect, but it might not hurt
To assign an IP, I had to set up and "ipfilter" to prevent IP spoofing
- With the VM you want to assign an IP selected, select the "Firewall" tab and select the "IPSet" tab at the bottom of the page
The page that comes up should be split into two parts. To the left, you should see a list of "IPSet" configurations and to the left, you should see a list of "IP/CIDR" configurations.
- Select "Create" on the left "IPSet" side and create a new "IPSet" with the name "ipfilter-net0" where the "-net0" portion is the network device that you are using on the VM, comment is optional
- Select the new rule you made on the "IPSet" side and then click the "Add" button on the left "IP/CIDR" side
- For the "IP/CIDR" field, type in the IP address you want to allot to the VM, for example. This IP has to be a valid one that is on the interface (net0) attached to the VM
- Make sure that "nomatch" is unchecked, comment is optional
And that's it!
The IP that you put in will be the only IP that will work on the KVM guest. Within the guest, set the IP to the one that was typed in.
This configuration can also be done by editing files on the Proxmox server itself via ssh, you can follow the guides
here. (look for the "Standard IP set 'ipfilter' section)
I am interested in seeing if there are any other ways to do this, or if this way is even valid (I'm not sure if I have caused any hidden issues by doing it this way).
Any feedback would be appreciated.
