Firewall LXC question.

[SpaceCowBoy]

Hello. I have several web servers running in LXC.

I have setup a group for them in the firewall settings.
out DNS accept
out web accept
in web accept
out drop
in drop

This blocks the LXC from using ssh to connect to other machines on my lan. They are only able to serve web over http/https and also lookup dns for updating (apt-get) reasons.

So here is my question. It all works as expected example:
log into lxc 10.0.1.225ping google.com
fail
ping another lxc machine 10.0.1.226
fail
looking good so far

ping the proxmox host 10.0.1.100
success!

ssh 10.0.1.100
success!

so why are my rules working for everyone but not working for when i try to get at the host?

thanks so much for your time and help. Great software!

 

[dietmar]

Please can you report a bug at bugzilla.proxmox.com?

 

[SpaceCowBoy]

Please can you report a bug at bugzilla.proxmox.com?

Yes I can. Is this not expected behavior? Sorry a bit confused. Thanks!

 

[dietmar]

Yes I can. Is this not expected behavior?

I think not. But we need all configs to verify that, so it is best to file all required information at bugzilla.proxmox.com.

 

[SpaceCowBoy]

Will do! Thanks for the response.

EDIT: Just filed the bug. Sorry it took me a bit. Had a lot of homework. Thanks again for the help