[SOLVED] Firewall not blocking on vm level

[crazywolf13]

Hi I just wanted to set up firewalls like showcased in many of the youtube videos.

Added the following datacenter rules:

Enabled firewall on datacenter, node and vm.


When experimenting on datacenter level traffic to the nodes can be controlled and for example ssh is currently off, this can be tested and verified.

However I can still ping my vms, lxcs access them via ssh and connect to their webserver -> But I expect the default drop all incoming to disabled this.

Nontheless I created a block all incoming directly on the container:


I can still ping and access the vm normally, without any problems.


What do I need to do to get this firewall to block traffic on vm/lxc level??

 

[_gabriel]

don't forget to enable firewall on the virtual nic of the vm/lxc too.

 

[crazywolf13]

don't forget to enable firewall on the virtual nic of the vm/lxc too.

No way....

This really solved my issue, huuuge thanks!!

Can't understand why not a single tutorial is talking about this :/

 

[um3r]

Hello everyone,
I have a similar question regarding my firewall (FW) configuration. I have enabled the FW, and it seems to be working, but not as expected.
Here's the situation:

• I have disabled outgoing ICMP.
• I start a ping (ping 1) to 8.8.8.8.
• I enable the FW.
• Ping 1 continues to work.
• I start a new ping (ping 2) to 8.8.8.8, but it gets dropped/rejected.
• I disable the FW.
• Ping 1 was already working.
• Ping 2 starts working as well.

Is this the typical behavior of FW rules, or am I doing something wrong?
I have two malware analysis machines and want to stop all network traffic from a host when I enable the FW rule, then allow traffic once the FW rule is disabled.
Additionally, can I set up a separate SD?
Thank you for your help!

 

[_gabriel]

Is this the typical behavior of FW rules

yes it's typical, because "current" / ETABLISHED connections are not blocked. only new connections.

 

[shanreich]

This is most likely due to conntrack. Since you established the connection beforehand there is a conntrack table entry that allows the first connection. You could flush the conntrack table, but be aware that this affects ALL established connections on the host / guest.

 

[meyergru]

In order to have firewall at all, you need to have or simulate "state" (via connection tracking).

Say, you have a general "drop-all" rule. This would block all traffic from outside, even if you had a rule allowing outbound traffic, UNLESS you can discriminate between packets that are new versus packets that are just the answer to allowed outside traffic. The latter are in an "established state".

In your example, you had an established connection (ping 1), thus all answer packets still got through.

 

[sidnakvee]

Hello Everyone new to Proxmox and opnsense world! However I successfully installed proxmox and opnsense but zenarmour not blocking applications selected in policy . Using the attched network settgins for opnsense in proxmox any guidance and help appreciated .
Can access opnsense interface from machine outside VM enviroment as see traffic sessions in zenarmour as well. But its not blocking anything

 

[meyergru]

That is obviously an OpnSense topic, more specifically with the Zenarmor component. I would suggest to address this here:

https://forum.opnsense.org/index.php?board=38.0