Proxmox Firewall - Input Policy DROP useless?

[mscd]

Hello together,

I am new to Proxmox VE. At the moment I am playing around with a Proxmox VE installation hosted on a Hetzner dedicated server. For security reasons I enabled the PVE firewall at database and node level. At database level the default Input Policy is „DROP“.

At node level I checked iptables (compare image below) ... and at the moment, I am not able to understand the meaning of the first line in the PVEFW-HOST-IN chain. Why is there an “accept all“ target at the beginning of the chain ... this seems to be counterintuitive for me, considering the default Input Policy „DROP“?

Best regards,
mscd

 

[Alwin Antreich]

These are different chains. You should see these chains added to the input table. A packet is running through the table and passes through the chains. iptables -nvL should show this.

 

[mscd]

Hello,

thank you for your reply ... i think the argument „different chains“ is not the solution to my question.
Lets have another look to „iptables -nvL“ (on the pve node):

1.) A packet traversing the chain INPUT first goes to PVEFW-INPUT ... from there directly to PVEFW-HOST-IN.

2.) The solution to my inital question seems (for me), that the first „accept all“ line in PVEFW-HOST-IN only matches to „in = lo“ ... therefore only incomming packets to the local interface are getting allways accepted. I didn‘t see that by using „iptables -L“ (above).

Is this correct?

Best regards,
mscd

 

[Stoiko Ivanov]

2.) The solution to my inital question seems (for me), that the first „accept all“ line in PVEFW-HOST-IN only matches to „in = lo“ ... therefore only incomming packets to the local interface are getting allways accepted. I didn‘t see that by using „iptables -L“ (above).

sounds right

In general it's always helpful to inspect iptables output via iptables -nvL - or even iptables-save - only there you get the complete picture...

Apart from that it's also a good idea to check if the rules work - by using tcpdump and sending packets which should get dropped (and ones that should get accepted)

I hope this helps!