PROXMOX VE FIREWALL
- Thread starter Michael_Strobel
- Start date
For security purposes this post has been removed.
The problem was completely dependent on IP configuration, and we have had numerous attacks on our server as of recent weeks. Basically to put it simply we were having issues getting VM's to connect once firewall was enabled on the VNIC, This is because our VM's are on a separate IP block to the main server, and the host is running all the traffic through a VPN. Once we added the rules at datacenter level to only allow in administration IP addresses, and ALLOW OUT the IP range for VM's. We now have a secure server which cannot even be pinged or port scanned by the guest OS's, yet all VM's maintain connectivity, and we now have the ability to route specific IP's at host level so that all VM's are only allowed one IP address that's been allocated and configured using the vm level iptables.... NOTE: Part of the issue we had was when we ENABLE IP filter at VM level, this needs to be disabled, all rules set to drop, then add the allow IN/OUT rules including the allocated IP address in the appropriate source/destination options, the other half of the problem was allowing the IP range traffic OUT... Like anything the configuration will be unique for most depending on what they have in mind. I'm all for sharing information, although it seems i've not often found answers here on the forum and the recent attacks on our systems leave us hesitant to share specifics. 
ALSO one thing to note. When doing port scans from a Guest OS, it used to show our server IP in TRACEROUTE.... NOW we are transparent to guest OS, and our only IP link is our VPN which also runs on a proxmox VPS which is set to start on boot with the host machine, and root login for ssh disabled.
Last edited: