I see the Firewall is for Proxmox Nodes and VMs. Could we get away without using an main entry point Firewall? Or do we still need to have that in between Cluster and the Internet?
New packages in pvetest! Firewall, Html5 Console, Two-factor authentication
- Thread starter martin
- Start date
Hi,
the new console is very good!
One question - what's about drbd8-utils for the 3.10-kernel (8.4.3)?
Is an selfcompiling necessary? Or do you provide the package in the near future?
Udo
Spirit,
I just tried your mentioned method, but it is not working quite well.
I setup allowed IP in <vmid>.conf file , restarted machine and then, i changed IP address in VM (centos 6.5) and i wasn't able to ping "the internet" but this VM was pingable from outside world.
Basically, outgoing connection is not allowed (filtered) , but incoming connection is still working , even, if the IP is not allowed.
I just tried your mentioned method, but it is not working quite well.
I setup allowed IP in <vmid>.conf file , restarted machine and then, i changed IP address in VM (centos 6.5) and i wasn't able to ping "the internet" but this VM was pingable from outside world.
Basically, outgoing connection is not allowed (filtered) , but incoming connection is still working , even, if the IP is not allowed.
Last edited:
Most of us already know this. But just a gentle reminder to all, DO NOT upgrade your kernel or run test packages on production environment. As it already has been pointed out few times, new kernel does not support OpenVZ. If you have production OpenVZs in your cluster, they wont work any more!
I don't really want to increase the time span for security reasons - tokens should be in sync. Isn't it possible to resync those tokens?
Thank for that interesting link. You can currently configure one token type per realm.
I'm trying to undertand firewall concepts following http://pve.proxmox.com/wiki/Proxmox_VE_Firewall#Security_Groups
what is <VMID> here ?
========================
Then, you can add this group in a vm firewall
/etc/pve/firewall/<VMID>.fw
[RULES]
GROUP webserver
========================
Marco
what is <VMID> here ?
========================
Then, you can add this group in a vm firewall
/etc/pve/firewall/<VMID>.fw
[RULES]
GROUP webserver
========================
Marco
m.ardito,
Each VM in proxmox has unique ID number. Usually it starts with number 100.
If you have already created few VM, those VMID can be found in the VM list.
For example, in new proxmox installation, if you create a new VM, it will be auto assign with VMID: 100
Next VM will be 101, 102, etc.
Just take a look to your existing VM, you will find these numbers.
Each VM in proxmox has unique ID number. Usually it starts with number 100.
If you have already created few VM, those VMID can be found in the VM list.
For example, in new proxmox installation, if you create a new VM, it will be auto assign with VMID: 100
Next VM will be 101, 102, etc.
Just take a look to your existing VM, you will find these numbers.
yes, look my post count... I know that...what I wasmissing is that the wiki section is talking about setting up GROUPS
and I thought there was a .fw config for GROUPS, or something, and VMID made no sense to me.
Now I read again and see that the group has to be defined in the VM .fw, that's why a VMID is required...
I'm just confused trying to understand the overall setup.
but thanks for pointing me to re-read the sentence...
Marco
1) 5 node cluster dies with new kernel.
Tested a bit packages built from git sources before they appeared in pvetest... (also with kernel from pvetest, and built from sources with different nic's driver versions - all the same)
After updating 5 node cluster kernels to 3.10.0-3 got cluster split to 5 no quorum clusters with following spam in logs:
As soon as I update kernel on more then 1 server cluster breaks and splits...
2.6.32 kernel works perfectly, no errors at all.
2) Server with new packages does not work with old ver.3.2 servers: migration not working (different qemu versions?), html5 client from new not working on old servers (different auth type?)..
3) What about making possible to manage all vm's firewalls from datacenter? Would be nice to see in one place a list of all 'firewalled' vm's.
4) Pleeeease make some kind of custom editable folders in 'view' left side to group vm's... Its about impossible to administrate >100 vm's in cluster without manual grouping and sorting...
Right now to sort vm's as I wish and not by vm ids I use this hack:
- special sortable vm names (win-server-01, win-server-02, vdi-win7-01, vdi-win7-02, test-centos7-201407 ..etc..)
- added one more 'view' type 'by name':
in pvemanagerlib.js after
Tested a bit packages built from git sources before they appeared in pvetest... (also with kernel from pvetest, and built from sources with different nic's driver versions - all the same)
After updating 5 node cluster kernels to 3.10.0-3 got cluster split to 5 no quorum clusters with following spam in logs:
If I install new kernel only on 1 of servers, I get error flood in logs but cluster works.
As soon as I update kernel on more then 1 server cluster breaks and splits...
2.6.32 kernel works perfectly, no errors at all.
2) Server with new packages does not work with old ver.3.2 servers: migration not working (different qemu versions?), html5 client from new not working on old servers (different auth type?)..
3) What about making possible to manage all vm's firewalls from datacenter? Would be nice to see in one place a list of all 'firewalled' vm's.
4) Pleeeease make some kind of custom editable folders in 'view' left side to group vm's... Its about impossible to administrate >100 vm's in cluster without manual grouping and sorting...
Right now to sort vm's as I wish and not by vm ids I use this hack:
- special sortable vm names (win-server-01, win-server-02, vdi-win7-01, vdi-win7-02, test-centos7-201407 ..etc..)
- added one more 'view' type 'by name':
in pvemanagerlib.js after
added this:
Stup1d hack, but the only possibility for me to sort vm's by type (in name).
Last edited:
To isolate groups of VMs from each other i have been using virtualized firewall with bridges. Is it safe to say with this PVE Firewall i no longer need to install virtual firewall in between VMs and internet?
I'm doing the same in many cases. It gives me a lot more flexibility, more functions when I can install my favourite firewall appliance if I want (sometimes I do). I'll keep it that way. Firewall on the PVE host IMO is useful for smaller installations, or for beginners, or when a possibly expensive external firewall is not feasible. But I don't really see the point of reinventing the wheel - good, well maintained iptables-based firewall packages already exist and PVE could just add a wrapper or maybe an easy to use web interface around one of them.
OTOH, the new features look really great. I haven't had the time to check them out but surely will. The noVNC integration is especially interesting and useful. PVE is just getting better with every release. I hope they can keep up, since they're using their own, specific, albeit open sourced solution for every aspect of the VM stacks.
Security groups are 'defined' in the cluster.fw file. But you can 'use' them inside a VM firewall configuration.