Firewall for managment network

[ednt]

Hi,

our VMs always have a managment network interface.
Now we had the problem that a person from outside needed root access via ssh to do some work.
We thought it is possible to block everything from the VM to our managment net, but still allow ssh from the managment net to the VM.
But... we failed.
I think it's not possible, because I can not tell Proxmox to allow outgoing traffic only for established connections.

Or is there a solution?

In text:
INPUT ACCEPT for all (no problem)
OUTPUT ACCEPT for established states ( ??? )
OUTPUT DROP for everything else (no problem)

Best regards

Btw. we are 'subscribers' how can this be enabled ?

 

[tom]

...
Btw. we are 'subscribers' how can this be enabled ?

See https://forum.proxmox.com/threads/new-forum-software.25170/

 

[ednt]

Ok,

an ugly work around:

INPUT ACCEPT
OUTPUT ACCEPT

Build an 'Security group' in the datacenter which OUTPUT DROP all essential destination ports like
20,21,22,23,80,161,443,3306,5432,8006 ...

Then add this group in the firewall of the VM.

 

[ednt]

Hi Tom,

as you can see, I found it (Subscriber)
But it was not easy to find.

Thank you.