[SOLVED] Firewall rules inheritance?

[be_tnt]

Hello!

I read several times the documentation about the proxmox firewall trying to understand how this is working. But one point remains obscure for me : does the VM firewall inherit from the top level (Node then datacenter)?

Thx in advance!

 

[Faris Raouf]

Hello.

No, there is no inheritance - with two exceptions:

If you create an IPSet called "management" at the Cluster level, it is inherited by the Node firewalls (but not VMs)

If you create an IPSet called "blacklist" at the Cluster level, this is inherited by the Nodes and all VMs (note: The "firewall" option has to be enabled on the VMs in order for the firewall to have any effect at all)

 

[be_tnt]

Thx!

Another question: is the PVE firewall link to iptables running on each VM or it's completely separated?

 

[Faris Raouf]

Totally separate. The PVE firewall runs on the physical nodes and has no interaction with the firewalls within the VMs.

 

[be_tnt]

Thx! After playing around, I came to the same conclusion. But a confirmation is always good

I guess there will be no problem to have iptables / fail2ban running on a VM, right?

 

[fabian]

Thx! After playing around, I came to the same conclusion. But a confirmation is always good

I guess there will be no problem to have iptables / fail2ban running on a VM, right?

no. you can use either or both, depending on your use case.

 

[be_tnt]

Thx!