NAT Firewall rules

[Afox]

Hello,

I want to prevent all VMs connected to a masqueraded vmbr (https://pve.proxmox.com/wiki/Network_Model#Masquerading_.28NAT.29_with_iptables) from internet access with some exceptions like Windows Update and a licensing server needed for Software running on that VMs.

Is it possible to setup this outside of the VMs/within Proxmox or do I have to add the rules to the Firewall of the VM-OS?

Thanks in advance,

Afox

 

[Alwin]

Is it possible to setup this outside of the VMs/within Proxmox or do I have to add the rules to the Firewall of the VM-OS?

Yes, extend the iptables rules on the PVE host.

 

[Afox]

hello, could you please give me an example rule?

do you mean the node or the data center layer?

 

[Alwin]

Please go through the firewall docs, to understand the different layers (examples included). https://pve.proxmox.com/pve-docs/chapter-pve-firewall.html

 

[Afox]

I think I understand the differences between them but I asked what you meant. Also I´d love to see an example of a rule that matches my problem as I don´t get it working with my attempts.

I am already stuck at the point of blocking all outgoing traffic as the output policy is set to "accept".