How to let PVE firewall work?

[Jordan.zhang]

Recently, I tried to configure the PVE firewall service, but I found that enabling the firewall at the data center level causes the Ceph cluster to malfunction. This setting seems very unreasonable. Is there any way to resolve this issue?

The second problem is that I configured firewall policies based on virtual machines, but they never take effect. I'm not sure what the specific issue is.

In my tests, I want test01 to be unable to ping test02, but regardless of whether I set the firewall policy on test01 or test02, it does not take effect.

 

[Jordan.zhang]

The cause of the first problem is clear. It is necessary to enable the option of allowing incoming traffic in the data center. However, this design does have some problems, especially for users who are not familiar with the platform, which may cause misunderstanding and ambiguity. the second problem seem I must enable firware in the data center level. and then configure policy in VM level. any advise?