Hello @all,
I am trying now to understand the firewall configuration for a while but do not really get it working like I want. Maybe someone has a hint for me because I am getting a bit frustrated, not finding a solution for a long time.
So first here is my network config that I am using at Hetzner. I have one "main" and two "additional" IPs from them. The additional IPs are routed through the main IP. I use vmbr0 for them.
Now I have two Windows VMs running on that host that has the additional IPs 130.x.x.184 and 130.x.y.189 assigned. I have access to the Internet and everything seems to work great.
Now lets go to my Firewall config cluster.fw :
and the config vm.fw :
As I understand with this setup the VM should be accessable through RDP. But this is not the case.
Then I though, ok maybe it is because of the Hetzner network config, because everything is routed through the main IP (host IP).
So I also have tried to change the vm.fw to following:
With this config the RDP connection worked well.
But something is weered: In cluster.fw I did not allowed no access to RDP. Only on vm.fw I said that the host can access RDP. Why do I now have access via RDP to that VM even if I am not in one of the specified "ACCEPT" IP addresses? (public IP form a different provider)
It seems that with this config public has access to that VM via RDP.
Now the questino is why ?
And what would be the correct way to go for that project.
Thx very very much for any help.
Regards
Andy
I am trying now to understand the firewall configuration for a while but do not really get it working like I want. Maybe someone has a hint for me because I am getting a bit frustrated, not finding a solution for a long time.
So first here is my network config that I am using at Hetzner. I have one "main" and two "additional" IPs from them. The additional IPs are routed through the main IP. I use vmbr0 for them.
Code:
auto lo
iface lo inet loopback
#iface lo inet6 loopback
# device: eth0
auto eth0
iface eth0 inet static
address 130.x.y.145
netmask 255.255.255.255
gateway 130.x.y.129
pointopoint 130.x.y.129
# default route to access subnet
#up route add -net 130.x.y.128 netmask 255.255.255.192 gw 130.x.y.129 eth0
auto vmbr0
iface vmbr0 inet static
address 130.x.y.145
netmask 255.255.255.255
bridge_ports none
bridge_stp off
bridge_fd 0
# Public subnet block
up ip route add 130.x.y.184/32 dev vmbr0
up ip route add 130.x.y.189/32 dev vmbr0
# Internal Network
auto vmbr1
iface vmbr1 inet static
address 10.0.0.1/23
bridge_ports dummy0
bridge_stp off
bridge_fd 0Now I have two Windows VMs running on that host that has the additional IPs 130.x.x.184 and 130.x.y.189 assigned. I have access to the Internet and everything seems to work great.
Now lets go to my Firewall config cluster.fw :
Code:
[OPTIONS]
enable: 1
policy_in: DROP
[IPSET external_access]
x.y.z.17 # server1
x.y.z.18 # server2
x.y.z.68 # server3
x.x.0.0/15 # myprovidersubnet
[IPSET proxmox_nodes]
130.x.y.145 # host1
130.x.y.148 # host2
130.x.y.132 # host3
130.x.y.195 # host4
[RULES]
IN ACCEPT -i vmbr1
IN ACCEPT -i eth0 -source +proxmox_nodes -p udp -dport 655 # Allow all nodes to establish VPN connection
IN ACCEPT -i eth0 -source +proxmox_nodes -p tcp -dport 655 # Allow all nodes to establish VPN connection
IN ACCEPT -i eth0 -source +external_access -p tcp -dport 8006 # Allow certain IPs to Proxmox Webinterface on eth0
IN ACCEPT -i eth0 -p tcp -dport 22 # Allow all IPs to SSH on eth0
[group windowsservers]and the config vm.fw :
Code:
[OPTIONS]
enable: 1
[RULES]
IN RDP(ACCEPT) -source +external_accessAs I understand with this setup the VM should be accessable through RDP. But this is not the case.
Then I though, ok maybe it is because of the Hetzner network config, because everything is routed through the main IP (host IP).
So I also have tried to change the vm.fw to following:
Code:
[OPTIONS]
enable: 1
[RULES]
IN RDP(ACCEPT) -source +proxmox_nodesWith this config the RDP connection worked well.
But something is weered: In cluster.fw I did not allowed no access to RDP. Only on vm.fw I said that the host can access RDP. Why do I now have access via RDP to that VM even if I am not in one of the specified "ACCEPT" IP addresses? (public IP form a different provider)
It seems that with this config public has access to that VM via RDP.
Now the questino is why ?
And what would be the correct way to go for that project.
Thx very very much for any help.
Regards
Andy
