Firewall working too well

[badspellersuntie]

I'm pretty much a noob with ProxMox but if I'm reading these forums correctly, this shouldn't be happening.
When I enable the firewall on the data center, I lose the web interface completely (SSH still works so I can disable the FW again).
So what gives? I want to use the firewall feature so I don't have to turn them on the VMs.

 

[utuntu]

Add rule that allows access to port 8006 (web management interface) either from your current IP (if your IP is static), some IP range or everywhere.

From terminal that would be:

# allow 1 IP address sudo iptables -A INPUT -p tcp -s x.y.z.q/32 --dport 8006 -j ACCEPT # allow 255 IP addresses sudo iptables -A INPUT -p tcp -s x.y.z.q/24 --dport 8006 -j ACCEPT # allow all sudo iptables -A INPUT -p tcp --dport 8006 -j ACCEPT

In GUI you can guess for yourself what needs to be where, INPUT is "in", ACCEPT is ACCEPT, and so on.

 

[ph0x]

Please note: the firewall on datacenter level filters traffic from and to the nodes. In order to protect the VMs you have to enable the firewall there as well!

 

[spirit]

you can create an ipset "management" at datacenter level, and add your admin ips

https://pve.proxmox.com/pve-docs/ch..._ip_set_span_class_monospaced_management_span

This will open predefined port (ssh,8006,;..) for your admin ips

 

[badspellersuntie]

# allow all
sudo iptables -A INPUT -p tcp --dport 8006 -j ACCEPT[/ICODE]

In GUI you can guess for yourself what needs to be where, INPUT is "in", ACCEPT is ACCEPT, and so on.

This command worked for me but it didn't stick through a reboot.
I've added this rule to the /etc/pve/firewall/cluster.fw

[RULES]

IN ACCEPT -p tcp -dport 8006 -sport 8006 -log nolog

However the webUI still times-out when I try to refresh it. What am I missing?

 

[ph0x]

Don't set the sPort, then. That's usually an ephemeral which is why the rule doesn't trigger.