protocol "all" in proxmox firewall rule ?

[RolandK]

hello ,

i want to add a rule which specifically allows one port/protocol and a second rule which denies all other ports/protocols.

for the destination port, i can choose "any", but in "protocol" input box, i can ony choose one specific protocoll, but not "all".

iptables manpage is telling:

[!] -p, --protocol protocol
The protocol of the rule or of the packet to check. The specified protocol can be one of tcp, udp, udplite, icmp, icmpv6,esp, ah, sctp, mh or the special keyword "all", or it can be a numeric value, representing one of these protocols or a different one. A protocol name from /etc/protocols is also allowed. A "!" argument before the protocol inverts the test. The number zero is equiv‐alent to all. "all" will match with all protocols and is taken as default when this option is omitted. Note that, in ip6tables, IPv6 extension headers except esp are not allowed. esp and ipv6-nonext can be used with Kernel version 2.6.11 or later. The number zero is equivalent to all, which means that you cannot test the protocol field for the value 0 directly. To match on a HBH header, even if it were the last, you cannot use -p 0, but always need -m hbh.

shouldn't "all" be an option there ?

would a RFE be accepted for this?

 

[floh8]

https://pve.proxmox.com/pve-docs/pve-admin-guide.html#pve_firewall_default_rules

 

[RolandK]

what exactly do you want to tell?

i don't see any information there on "-p all"

 

[floh8]

--> default blocking rules

 

[RolandK]

i don't like invisible blocking rules.

i'm used to add my own blocking rules to make sure they really apply