Block unassigned IPs

[XN-Matt]

With KVM VMs at least, the IPs are on a sort of free-for-all.

We could create an inbound and outbound firewall route so they can only use their assigned IPs but that is quite labour intensive and still means they can at least add an IP alias and ARP will do nasty things.

Does Proxmox have any plans where an IP/or list of can be assigned to the VM in the interface and on the host node and ensure that only traffic to or from that/those addresses will flow.

Other software similar to Proxmox does this and it seems to work well.

It will prevent those clients adding IPs without being allocated them which can cause major issues for other customers.

 

[Alwin]

Check out the docs, section ipfilter-net.
https://pve.proxmox.com/pve-docs/pve-admin-guide.html#chapter_pve_firewall

 

[XN-Matt]

I'm already aware of that but my question is not addressed, really.

"Does Proxmox have any plans where an IP/or list of can be assigned to the VM in the interface and on the host node and ensure that only traffic to or from that/those addresses will flow."

Not in the existing fire-wall rules section because users could remove those and there isn't a way to create rules in the GUI that only administrators can set/change/delete.

Whilst containers are already catered for - we are solely using machines (KVM).

 

[Alwin]

"Does Proxmox have any plans where an IP/or list of can be assigned to the VM in the interface and on the host node and ensure that only traffic to or from that/those addresses will flow."

Not per se, but you could use the qemu-guest-agent to get the IP(s) inside the VM and iptables. Sure needs some scripting.

Not in the existing fire-wall rules section because users could remove those and there isn't a way to create rules in the GUI that only administrators can set/change/delete.

Your Users are PVEVMAdmins? Then they could even add a new interface and set any IP inside the VM.

 

[XN-Matt]

Not ideal, we don't want to do anything within the VM itself. Previous software set these rules on the host node.

No, they are not. As noted, the only way to do this in the GUI would be for admin to create a rule in and out but users could then alter their own specific VM rules. There is no way to set a rule to admin-only preventing users from changing on the specific VM. (We use the API so they can change their firewall rules but they cannot add interfaces)

 

[Alwin]

Not ideal, we don't want to do anything within the VM itself.

Only the guest-agent needs to run inside the VM to get query the IP from the outside.

We use the API so they can change their firewall rules but they cannot add interfaces

You could limit or force ipfilter rules in your application, then it would prevent user modifications upfront, wouldn't it?

 

[XN-Matt]

Interesting.

What if the user removes/stops the agent? What would then happen?

 

[Alwin]

Well, that depends upon your policy, as you have everything in your hands to allow or block traffic all together.