[SOLVED] PVE Firewall ignores traffic from public IP

[Suertzz]

Hello,

I use the firewall built into Proxmox which is great.

On the private network (172.16.10.x ) the firewall works and blocks what is not explicitly opened (Input Policy: DROP, OUTPUT Policy: ACCEPT), but when I use a public IP, the firewall totally ignores the rules and all traffic on the pub-ip goes unrestricted (but the private IP is still filtered).

Here is my network configuration on the VM side :

admin@vm:~$ cat /etc/network/interfaces

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
        address 172.16.10.11/24
        dns-nameservers 172.16.10.25 1.1.1.1

auto eth0.100
iface eth0.100 inet static
        address 201.40.31.7/32
        gateway 201.40.31.28

For example, if I install a webserver and listen on both 201.40.31.7:80 and 172.16.10.11:80, If I dont allow HTTP traffic on the proxmox firewall, it will not work on private ip (wich is great!) but on the public ip, whatever the setting is, it will ignore the firewall and work in any case

PVE nodes does not have public IPs, only private IPs (172.16.10.x), every node use a gateway on the private network (172.16.10.25) to reach internet.
All VMs have a private IP (172.16.10.x), and some have a public IP.

Private IP is on the VLAN 50
Public IP are on the VLAN 100

The firewall is activated cluster-wide, on each host and on each VM (and on the network card of the vm ofc!)

pve-firewall status
Status: enabled/running

Spoiler: Network conf of the host:

Spoiler: Firewall conf on the VM:

Spoiler: Network DEVICE of the VM on PVE:

I also tried to put INPUT Policy: DROP and OUTPUT Policy: DROP, the trafic is dropped on the private network, but the public still ip pass through.

Did i forget something ?

I hope somebody can help me!

Regards

 

[aaron]

Where do you set the FW rules for the VM? Whatever is set on the Datacenter and node level should only affect the node (iptables INPUT) and what is configured on the guest should only affect the guest (iptables FORWARD)

 

[Suertzz]

Where do you set the FW rules for the VM? Whatever is set on the Datacenter and node level should only affect the node (iptables INPUT) and what is configured on the guest should only affect the guest (iptables FORWARD)

Thank you for your quick reply.

I put the rules at the VM level, here are the screenshot of my settings :

Spoiler: [VM] Firewall rules

Spoiler: [VM] Firewall options

The INPUT Policy does drop the INPUT trafic from the internal network (172.16.10.x), but the public IP I assigned inside the VM does not seem to be affected by the firewall.

Regards

 

[Suertzz]

Does anyone have an idea, I'm really stuck on this point

 

[TodorPetkov]

Hi,

in the VM you have you interfaces, eth0 and eth0.100, right? Can you try to create secondary interface in PVE for this VM, and pass the VLAN on it, so the VM will have eth0 and eth1, without vlans on it?

 

[Suertzz]

Hi,

in the VM you have you interfaces, eth0 and eth0.100, right? Can you try to create secondary interface in PVE for this VM, and pass the VLAN on it, so the VM will have eth0 and eth1, without vlans on it?

Thanks you for your answer, that solved my problem!

 

[hawat]

Hi,

I have the same problem. Why vlan interfaces do not fall under the firewall rules?

 

[TodorPetkov]

I guess it's because host sees the traffic as vlan tagged and netfilter can't filter it.

 

[TodorPetkov]

Here is more information on the topic:
https://stackoverflow.com/questions/40474073/filtering-out-vlan-tagged-packets-on-linux-bridge

 

[hawat]

Thank you so much!