Just started experimenting with what the firewall PVE provides, but before even getting to anything netfilter related...
I get several pings through during bootup of a machine at 2 different points.
A quick look at
A look at
What it does declare is
So this firewall does NOT RUN at boot for the host itself because it needs ... network to load its rules?
So during e.g. auto-reboots on node fencing, it is invariably exposed receiving all the traffic unfiltered.
And if the pve-cluster.service does not come up, the firewall never loads its rules with neatly logged Failed to start Proxmox VE firewall. But the networking is up.
How is this useful?
I get several pings through during bootup of a machine at 2 different points.
A quick look at
network-pre.target does NOT declare After=pve-firewall.service.A look at
pve-firewall.service does NOT declare Before=network-pre.target, only pve-guests.service.What it does declare is
After=pve-cluster.service (amongst others, such as network.target).So this firewall does NOT RUN at boot for the host itself because it needs ... network to load its rules?
So during e.g. auto-reboots on node fencing, it is invariably exposed receiving all the traffic unfiltered.
And if the pve-cluster.service does not come up, the firewall never loads its rules with neatly logged Failed to start Proxmox VE firewall. But the networking is up.
How is this useful?
Last edited: