Proxmox FW dont blocks traffic to vm

[p27426541]

hey ich habe das problem das wenn ich z.b meine ip blocke für tcp ( https://i.imgur.com/3KHk6AR.png )der ssh port nicht mehr geht,

benutze ich jetzt aber hping3 mit tcp kommt das bei der maschiene an.

wenn ich aber jetzt komplett tcp drop ( https://i.imgur.com/NPCPCoA.png )kommt kein tcp mehr an


ist das bekannt bzw wo liegt mein problem ?







ENGLISH:



hey i have the problem that if i block my ip for tcp ( https://i.imgur.com/3KHk6AR.png )the ssh port does not work anymore,

but if I now use hping3 with tcp it arrives at the machine.


but if I now completely tcp drop ( https://i.imgur.com/NPCPCoA.png )no tcp arrives any more



is this known or where is my problem ?

 

[oguz]

hi,

hey i have the problem that if i block my ip for tcp ( https://i.imgur.com/3KHk6AR.png )the ssh port does not work anymore

which is normal if you block all TCP traffic from your IP address.

but if I now use hping3 with tcp it arrives at the machine.

how exactly do you run hping3 and where do you run it from?

but if I now completely tcp drop ( https://i.imgur.com/NPCPCoA.png )no tcp arrives any more

that's also normal...

is this known or where is my problem ?

not sure what's the question here?

are you editing the VM firewall rules?

 

[bobmc]

there's a very good basic guide to the proxmox firewall on you tube
https://youtu.be/DNsLLrCgK0U

 

[p27426541]

there's a very good basic guide to the proxmox firewall on you tube
https://youtu.be/DNsLLrCgK0U

thx but that dont helps me by my problem

 

[oguz]

thx but that dont helps me by my problem

if you answer the questions in my post above then we can help you debug the issue

 

[p27426541]

if you answer the questions in my post above then we can help you debug the issue

current problem is that when I set the FW of a VM to drop, ICMP is still answered even though I drop incoming and outgoing.

 

[p27426541]

current problem is that when I set the FW of a VM to drop, ICMP is still answered even though I drop incoming and outgoing.

https://i.imgur.com/Wgh2IiE.png

 

[oguz]

ICMP is still answered even though I drop incoming and outgoing.

please post the commands you're using to test this.

i've asked you some questions in my first post on this thread, please also answer those if you want help.

for debugging your firewall rules you can use iptables-save command to see the chains.

also check our documentation section about the firewall [0]

hope this helps

[0]: https://pve.proxmox.com/pve-docs/pve-admin-guide.html#pve_firewall_default_rules