firewall question & help

[vesuvienne]

hi team!
some question and observation about firewall:

* if i need to allow "any source" do i need to let the "source" blank in the firewall GUI

* do the Datacenter firewall work only if you are in a cluster?

* i have some strange behavior about the order of the rules with the firewall of VM (i don't know if it is normal)
- if i put some rule at the end (exemple ssh) i can't ssh into the vm
- if i change the order and put it at first it work
so i think order have a effect no? if someone can give me some advice
thx!

 

[shanreich]

* if i need to allow "any source" do i need to let the "source" blank in the firewall GUI

Yes

* do the Datacenter firewall work only if you are in a cluster?

No, it should also work if you have a singular node, when you add additional nodes they also get the same rules applied

so i think order have a effect no? if someone can give me some advice

Yes, rules are evaluated in order (from top to bottom), the first matching rule 'wins'

 

[vesuvienne]

Yes, rules are evaluated in order (from top to bottom), the first matching rule 'wins'

thx, so DROP should always be at the bottom?

No, it should also work if you have a singular node, when you add additional nodes they also get the same rules applied

so i have a single node, without cluster
i add this rules under datacenter -> firewall

but it locked me out, can not access my GUI or SSH into my node

* if i put this rules directly on my PVE node it work, any clue ?
thx

 

[shanreich]

thx, so DROP should always be at the bottom?

You can set the default policy in the datacenter settings, so it is not necessary to explicitly add it as a rule at the bototm

but it locked me out, can not access mt GUI or SSH into my node

do you have any rules in the host firewall? host rules come before datacenter rules

 

[vesuvienne]

You can set the default policy in the datacenter settings, so it is not necessary to explicitly add it as a rule at the bototm

If i remember, the default datacenter firewall policy DROP everything & ACCEPT by default SSH(22) and GUI(8006)

do you have any rules in the host firewall? host rules come before datacenter rules

oh!!! Thx i understand now, Yeah i put DROP on my PVE node
So i need to choose between using PVE firewall or Datacenter firewall

 

[shanreich]

So i need to choose between using PVE firewall or Datacenter firewall

You can use both at the same time. Datacenter is for creating rules on EVERY node, host firewall is for creating or overriding rules on a specific node. Just don't add a blanket drop statement in any ruleset - you can do that via setting the default in/out policy.

 

[vesuvienne]

Merci !! that clarifies everythings