Firewall rules not loaded for lxc containers

lince

Member
Apr 10, 2015
78
3
8
Hello,

I enabled the firewall in datacenter, node and container and I can see quite a few iptables rules loaded and some new PVE chains. The problem is that I created a rulea for a container and I can not see that rule in iptables.

This is the rule:

upload_2016-10-8_11-39-44-png.4265


But I can not see that rule in the node:

pve1# iptables -nvL | grep 8888
pve1#

And iptables in the container is also empty (after trying pct stop & start):

root@101:~# iptables -nvL
Chain INPUT (policy ACCEPT 4 packets, 148 bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 7 packets, 316 bytes)
pkts bytes target prot opt in out source destination

The rules are shown in the config file:

# cat /etc/pve/firewall/101.fw
[OPTIONS]

enable: 1

[RULES]

IN DROP -p tcp -dport 8888
IN ACCEPT -p tcp -dport 22
IN DROP

Tried restarting the daemon several times with no luck:

service pve-firewall restart

I am using Virtual Environment 4.3-1
 
  • Like
Reactions: user843
I just ran across this issue, I was leveraging the Proxmox firewall as well as CSF (IPTables) and everything assumed to be working as expected. I had a client test a connection to a port I didn't expect to be open and he was able to connect, so I investigated further and found that the Proxmox Firewall wasn't doing anything at the VM level......... While investigating, I found this SF article which led me here. First I run into the bizarre High Availability logic and now this...... Why is there an option in the Firewall Options in the VM ENABLE THE FIREWALL IF IT DOESN'T ENABLE THE FIREWALL??????? I understand if the network interface has an option to override the firewall for something like an "internal" network, but why in the world would it not enable there automatically if the Firewall -> Options is enabled? I just don't understand the logic here. I am dumbfounded by this....

server fault /questions/801617/how-to-apply-proxmox-firewall-rules-to-vms
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!