How to DROP all by firewall for Ubuntu Guest

[Eugene Piatenko]

People, please help.
1. Installed latest Proxmox
2. Firewall works fine for Host
3. Installed Guest Ubuntu Server 16.04
4. For my Guest I enabled Firewall and specified rules:
in DROP
out DROP

but they do not work,
when I login to Guest I can for example > curl google.com
and it works...

I really stuck how to disable ALL in firewall for Guest...

Also my Host /etc/network/interfaces:

auto eth0
iface eth0 inet dhcp

auto vmbr200
iface vmbr200 inet static
    address  10.0.200.1
    netmask  255.255.255.0
    bridge_ports none
    bridge_stp off
    bridge_fd 0

    post-up echo 1 > /proc/sys/net/ipv4/ip_forward
    post-up   iptables -t nat -A POSTROUTING -s '10.0.200.0/24' -o eth0 -j MASQUERADE
    post-down iptables -t nat -D POSTROUTING -s '10.0.200.0/24' -o eth0 -j MASQUERADE

Is it possible that Firewall works only for non-Nat cases?

If someone can help - I will create a clean install and let you enter there to check.

Thanks a lot for help!

 

[dcsapak]

did you enable the firewall checkbox on the vm nic?

 

[Hephas]

It don't works with the enabled checkbox on the vm nic.

 

[sb-jw]

What exactly are your expectations? If you activate the checkbox, potentially nothing will happen at first. You then have to configure the rules for the VM accordingly. So please post your configurations here.

 

[Hephas]

Of course, the firewall cannot run without further configuration.
I have configured the firewall to deny outgoing connections to the destination 192.168.178.0/24.
However, regardless of whether the checkbox mentioned by dscapak is set or not, the firewall does not work.

Is this possibly due to the nat rule configured in /etc/network/interfaces?
It probably is. We need help with exactly this problem.
Please answer politely.

 

[sb-jw]

We need help with exactly this problem.

So please post your configurations here.

 

[Hephas]

Also my Host /etc/network/interfaces:

auto eth0
iface eth0 inet dhcp

auto vmbr200
iface vmbr200 inet static
    address  10.0.200.1
    netmask  255.255.255.0
    bridge_ports none
    bridge_stp off
    bridge_fd 0

    post-up echo 1 > /proc/sys/net/ipv4/ip_forward
    post-up   iptables -t nat -A POSTROUTING -s '10.0.200.0/24' -o eth0 -j MASQUERADE
    post-down iptables -t nat -D POSTROUTING -s '10.0.200.0/24' -o eth0 -j MASQUERADE

Is it possible that Firewall works only for non-Nat cases?

 

[sb-jw]

The interface file is not of interest at first. How is the VM configured and what rules have you set where?

 

[Hephas]

This is the configuration of the network device.


This is the configuration of the firewall configured in the vm view.

 

[sb-jw]

Okay, what exactly isn't working and how did you verify it?

Where exactly did you define the firewall rule? In the VM or in the host?

 

[Hephas]

The firewall rule ist configured in the vm.
I verified with ping 192.168.178.1 that the connection to the subnet 178 is open.