[PVE-Firewall] Allow traffic to internet but not other hosts in subnet

hac3ru

Active Member
Mar 6, 2021
55
2
28
34
Hello,

As the subject states, I'm trying to create a firewall rule that would allow the traffic to flow from a VM to the "outside world", but nothing else. This is what I've done so far (and it didn't work):
1. Set the firewall online
2. Set the VM Firewall Options to drop, for both INPUT and OUTPUT
3. Create an IPSet with the following content:
Code:
[IPSET test]

!10.0.0.0/8
!172.16.0.0/12
!192.168.0.0/16
4. Create the following rule:
Code:
OUT ACCEPT -dest +guest/test -p icmp -log nolog

P.S. I know that the above rule is only allowing ICMP, that's used for testing. I am trying to ping 8.8.8.8 which fails :(

My reasoning was: I am going to accept all OUTGOING traffic with the destination != private IP addresses. Still, this is not going well, for whatever reason, and I fail to understand why. Can anyone shed some light on this?

Thank you.
 
Last edited: