Prerouting and Postrouting with new Proxmox Firewall

[kamzata]

My host have 1 public IP address bind on vmbr0. To allow access from/to my CT to/from internet I used to use prerouting and postroutin rule. Now I'm trying to use new build-in proxmox firewall to get the same result but I don't know how since NAT isn't present (or is it? Where???) and wiki doesn't mention about it.

How can I do this?

 

[spirit]

Hi,

proxmox firewall don't manage prerouting and postrouting yet. So you need to do it manually like before.

Also note than when firewall is enabled, you need extra iptables rules to get PREROUTING|POSTROUTING work.


iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1

iptables -t raw -I POSTROUTING -i fwbr+ -j CT --zone 1


and kernel 3.10

 

[kamzata]

Hi,

proxmox firewall don't manage prerouting and postrouting yet. So you need to do it manually like before.

Also note than when firewall is enabled, you need extra iptables rules to get PREROUTING|POSTROUTING work.


iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1

iptables -t raw -I POSTROUTING -i fwbr+ -j CT --zone 1


and kernel 3.10

ok, thank you

 

[dietmar]

I thought this still works as described in:

https://pve.proxmox.com/wiki/Network_Model

What do I miss?

 

[kamzata]

I thought this still works as described in:

https://pve.proxmox.com/wiki/Network_Model

What do I miss?

Nothing. It works like a charm. I asked this question just because I started to set firewall through new visual interface and I wondered how it works and if I could set all my rules through it.

 

[Dura]

You miss this in the wiki Dietmar:

iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
iptables -t raw -I POSTROUTING -i fwbr+ -j CT --zone 1