Proxmox Firewall + MAC Filtering / Broadcast Traffic

[Ashley]

Hello,

I have the Proxmox firewall enabled cluster / server wide:

1/ I am looking at enabling some form of baisc MAC address spoof protection, I have had a look at what other solutions use (which is ebtables), is this the best method to use with Proxmox or is there a way I can make use of the Promox Firewall?

2/ I have noticed alot of broadcast / multicast traffic between VM's coming from the shared bridge, again seems other solutions are making use of ebtables, again is their a better way to do this within Proxmox Firewall or should I stick to ebtables?

An example of another solutions method:

Bridge chain: kvm248.0, entries: 6, policy: DROP
-p IPv4 --ip-proto udp --ip-sport 67:68 -j ACCEPT
-p IPv4 --ip-proto udp --ip-dport 67:68 -j ACCEPT
-p ARP --arp-op Request -j ACCEPT
-p IPv4 --ip-src ***.***.***.25 -j ACCEPT
-p IPv4 --ip-dst ***.***.***.25 -j ACCEPT
-p ARP --arp-op Reply --arp-ip-src ***.***.***.25 -j ACCEPT

 

[guletz]

Hi Ashley ,

1. One of the best spoof protection is to use something like pppoe(point to point over ethernet). You can find decent (cheap) hardware switches who can offering a pppoe server.
Another option could be to setup static arp's in your network.

 

[Ashley]

Hi Ashley ,

1. One of the best spoof protection is to use something like pppoe(point to point over ethernet). You can find decent (cheap) hardware switches who can offering a pppoe server.
Another option could be to setup static arp's in your network.

I already have protection at the switch level, I guess I mainly mean at the Proxmox KVM Bridge level, which is where ebtables comes in to restrict at the bridge level the traffic, I have noticed the MAC Filter option within the Proxmox VM Firewall, but not sure exactly what it is doing, as I know it is not touching ebtables.

 

[guletz]

Anything with MAC protection is nothing. Anybody can put any mac on any interface. For this problem pppoe is the king And for this reason any good ISP use pppoe!