[SOLVED] How to drop SSH port 22 traffic from external networks

[proxale]

Using Proxmox 6.2.4

For added security, I'm trying to add a firewall rule to DROP all connections to port 22 from external networks.
I already have SSH working on an alternative port.

Under "Datacenter" -> my_node1 -> Firewall, adding a rule IN DROP SSH (macro name) or IN DROP tcp 22 has no effect whatsoever.
I'm still able to connect via port 22.

The rules are visible in /etc/pve/nodes/my_node1/host.fw

[RULES]
IN ACCEPT -p tcp -dport 321 -log nolog
IN SSH(DROP) -log nolog

And this is in /etc/pve/firewall/cluster.fw
[RULES]
IN SSH(DROP) -log nolog

pve-firewall was restarted in case it was necessary.

Please advise what am I missing?

Edit: Sorry, dumb mistake. Overlooked that the firewall is disabled by default at cluster level. Works after enabling it but also needed to add rules for port 8006 and custom ssh port.

 

[Stoiko Ivanov]

Glad you found the cause of your issue!

Please mark the thread as 'SOLVED' - this helps other users to see where they can possibly find solutions.

Thanks!