Firewall protection on Proxmox 3.0

[2creatives]

Hello,

I am looking for a good way to install a firewall on my new Proxmox 3.0 server.
I found a lot of links with howto's to install Shorewall, pfsense and other forewall scripts, but all of these howto's are based on Proxmox 2.x and do not provide me a good step-by-step installation example to to the trick.

Is there anyone how can give me a good step-by-step installation guide to get my Proxmox 3.0 server secured and ready to bring to the datacenter.

With kind regards,

Bas

 

[JimBeam]

Proxmox is Debian. You can adapt Debian info, including that on shorewall, to proxmox.

 

[2creatives]

I just have successfully installed and configures UFW (Uncomplicated Firewall) on my proxmox server.
Is seems that i am able to get my server secured, but there is just one more thing. I can create a KVM and it is able to bring up its own NIC in the virtual machine so that is great.

The problem is that OpenVZ containers don't have their own NIC so traffic is blocked by the firewall rules i set for the Proxmox node.
Does anyone know how to fix this? If i can get this to work i have the perfect solution for me.

 

[kotakomputer]

Why not use IP based?

 

[2creatives]

Why not use IP based?

Can you explain what you mean? I don't understand you.

 

[kotakomputer]

Just assign IP for every VM then create ufw rule based on that IP.

 

[2creatives]

Just assign IP for every VM then create ufw rule based on that IP.

Hmmm, sound good. I will try that.
Can you give me an example of how that rule should look like?

 

[kotakomputer]

# ufw deny from 192.168.0.100
# ufw allow from 192.168.0.101

 

[2creatives]

# ufw deny from 192.168.0.100
# ufw allow from 192.168.0.101

My Proxmox server ip is 192.168.1.80

I created a OpenVZ container and assigner IP 192.168.1.55 to it via the interface.
Then i added the following rule:

# ufw allow from 192.168.1.55

Now, when i enable the firewall i can not ping the OpenVZ container on its ip ( 192.168.1.55) from my laptop in the same subnet.
When i disable the firewall i can ping and access the container.

This exactly my problem :-(

 

[mir]

But can you access the container?
I expect ufw by default drops all ping ICMP requests but that does not automatically imply the container is down.

 

[2creatives]

When i have enabled the firewall i can not access the container at all. if i disable the firewall it all works :-(

I only have this problem with OpenVZ containers. KVM's are working well.

 

[Shazan]

I use APF (http://www.rfxn.com/projects/advanced-policy-firewall/) and it works great.

 

[2creatives]

I use APF (http://www.rfxn.com/projects/advanced-policy-firewall/) and it works great.

Can you give me an example how to configure it the right way on my proxmox server?

( i get messages like: Aug 18 13:17:37 vps apf(7421): {glob} could not verify that interface eth0 is routed to a network, ab
orting. )

So, i think that there is a special way to configure.

 

[kotakomputer]

# ufw allow from 192.168.1.80

put above line at the top of your rules

 

[Shazan]

( i get messages like: Aug 18 13:17:37 vps apf(7421): {glob} could not verify that interface eth0 is routed to a network, ab
orting. )

If you're using a bridged network configuration, then in your /etc/apf/conf.apf the interface should be like this:

IFACE_IN="vmbr0"
IFACE_OUT="vmbr0"

and not eth0.