[SOLVED] proxmox firewall - allow dhcp only on specific interface(s)?

[chr1s]

I'm trying to get familiar with the Proxmox Firewall. I'm having the following problem:

• I have a dhcp server running on the Proxmox host, listening on vmbr0 (on the host's IP configured on vmbr0)
• the Proxmox firewall is enabled on all levels (datacenter, host, vm) with default input: drop / default output: allow

In this state (without any ALLOW rules) DHCP on vmbr0 doesn't get through (that's good and expected). Now I'd like to allow DHCP only from hosts on vmbr0 on this interface.

The only way it could get DHCP on vmbr0 working is by adding a very broad firewall rule "source: ANY, destination: ENY, macro: forwarded DHCP = ALLOW". I'm concerned that this is too broad: If by accident a DHCP server starts to listen on any interface (including bridge devices) that DHCP traffic now gets through.

Is there an elegant way to only allow the DHCP traffic on vmbr0?

(Thanks for any feedback!)

 

[chr1s]

sorry for the noise, I think I found it myself ("interface" field in firewall rules). Missed it because I'm was using security groups and there it's not in the security group but in the "add" dialogue when you add it a security group to a firewall policy.