LXC firewall rule - only internet access

[Duckdave]

Is it possible to configure the pve firewall that a lxc can only reach the internet and no other ip addresses in the same subnet?

i know it from pfsense where i can configure a rule that only counts on a specific gateway.

Regards

 

[Stefan_R]

You can create an IPSet containing all of your local networks (e.g. 192.168.0.0/16, 10.0.0.0/8, etc...) and then add the following rules:

Rule #1
Direction: out
Action: ACCEPT
Destination: <Your Gateway IP>

Rule #2
Direction: out
Action: DROP
Destination: <IPSet you created>

The first one should be optional, but improves reliability (allows ICMP messages for example).