Custom iptables script and Proxmox VE

[kionez]

Hi all, I just installed Proxmox VE on a remote debian system, hosted at hetzner.de, following the "manual" guide (adding sources to apt).

I would like to use my custom bash firewall script to control\protect my VMs, so i need some confirms

I read in http://pve.proxmox.com/wiki/Network_Model that we should use masquerading, but i want to use SNAT\DNAT.

I would like to give vmbr0 a private IPs (i.e.:10.0.0.1) and give to my VMs a IP of 10.0.0.0/24 network.
On host system, I give to eth0 (and eth0:1, eth0:2 and so on) all my public IP.

Then via iptables on host system I will DNAT ports to local VMs (ie eth0:1 port 80 --> VM1 port 80) and SNAT ips, for example to let VM1 exit with eth0:1 ip.

Everything should be started with a custom firewall script, started via /etc/init.d/.

Could this configuration give me problems? Does ProxmoxVE support it?

I'm not a newbee in networking, but I never use a virtual environment in production system.

Thanks in advance

k.

 

[tom]

Hi all, I just installed Proxmox VE on a remote debian system, hosted at hetzner.de, following the "manual" guide (adding sources to apt).

I would like to use my custom bash firewall script to control\protect my VMs, so i need some confirms

I read in http://pve.proxmox.com/wiki/Network_Model that we should use masquerading, but i want to use SNAT\DNAT.

I would like to give vmbr0 a private IPs (i.e.:10.0.0.1) and give to my VMs a IP of 10.0.0.0/24 network.
On host system, I give to eth0 (and eth0:1, eth0:2 and so on) all my public IP.

Then via iptables on host system I will DNAT ports to local VMs (ie eth0:1 port 80 --> VM1 port 80) and SNAT ips, for example to let VM1 exit with eth0:1 ip.

Everything should be started with a custom firewall script, started via /etc/init.d/.

Could this configuration give me problems? Does ProxmoxVE support it?

I'm not a newbee in networking, but I never use a virtual environment in production system.

Thanks in advance

k.

We at Proxmox does not included a firewall yet as there are several different approaches, just query the forum, a short link to Shorewall and Proxmox VE, posted from a long term Proxmox VE user: http://www.montanalinux.org/proxmox-ve-with-shorewall.html

 

[kionez]

Thanks tom!
I googled a bit before posting this thread, but I never found montanalinux's article..
Well, it's possible to use a non-bridged vmbr0.. so it's time to play with iptables now

Many thanks for your work and your quickly answers here on the forum!

k.