[PVE-Firewall] Allow traffic to internet but not other hosts in subnet

hac3ru

Member
Mar 6, 2021
45
1
13
33
Hello,

As the subject states, I'm trying to create a firewall rule that would allow the traffic to flow from a VM to the "outside world", but nothing else. This is what I've done so far (and it didn't work):
1. Set the firewall online
2. Set the VM Firewall Options to drop, for both INPUT and OUTPUT
3. Create an IPSet with the following content:
Code:
[IPSET test]

!10.0.0.0/8
!172.16.0.0/12
!192.168.0.0/16
4. Create the following rule:
Code:
OUT ACCEPT -dest +guest/test -p icmp -log nolog

P.S. I know that the above rule is only allowing ICMP, that's used for testing. I am trying to ping 8.8.8.8 which fails :(

My reasoning was: I am going to accept all OUTGOING traffic with the destination != private IP addresses. Still, this is not going well, for whatever reason, and I fail to understand why. Can anyone shed some light on this?

Thank you.
 
Last edited:

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!