Hi all,
Unfortunately, not yet upgraded, currently on a pve 6.4.1 tyring to setup the firewall.
We've defined a cluster.fw (no other firewall rules files under /etc/pve/firewall) containing :
- a bunch of ALIASES (names in uppercase),
my_subnet 10.10.10.0/24 # subnet CIDR notation
my_XYZ_host 10.10.10.10 #specific IP
- IPSETS (refering the aliases in lowercase)
- rules containing 3 groups
- each rule group containing entries like
IN ACCEPT -source my_xyz -dest my_subnet -p tcp -port 8006 log info
IN SSH(ACCEPT) -source my_xyz -dest my_subnet -log info
When pve-firewall compile all is good.
When pve-firewall simulate --from 10.10.10.10 --dest 10.10.10.221
we get :
test packet:
from : outside
to: host
source : 10.10.10.10
dest 10.10.10.221
no such chain 'PVEFW-INT' at /usr/share/perl5/PVE/FirewallSimulator.pm line 286
anyone encountered this issue?
Prior to setup firewall with default input policy to DROP, i'd rather have the policies not to cut end user out of the admin access to the pveproxy admin UI or SSH at bare minimum.
The simulator showing simulator error des not entice to confidence
looking forward some suggestions
best regards
Unfortunately, not yet upgraded, currently on a pve 6.4.1 tyring to setup the firewall.
We've defined a cluster.fw (no other firewall rules files under /etc/pve/firewall) containing :
- a bunch of ALIASES (names in uppercase),
my_subnet 10.10.10.0/24 # subnet CIDR notation
my_XYZ_host 10.10.10.10 #specific IP
- IPSETS (refering the aliases in lowercase)
- rules containing 3 groups
- each rule group containing entries like
IN ACCEPT -source my_xyz -dest my_subnet -p tcp -port 8006 log info
IN SSH(ACCEPT) -source my_xyz -dest my_subnet -log info
When pve-firewall compile all is good.
When pve-firewall simulate --from 10.10.10.10 --dest 10.10.10.221
we get :
test packet:
from : outside
to: host
source : 10.10.10.10
dest 10.10.10.221
no such chain 'PVEFW-INT' at /usr/share/perl5/PVE/FirewallSimulator.pm line 286
anyone encountered this issue?
Prior to setup firewall with default input policy to DROP, i'd rather have the policies not to cut end user out of the admin access to the pveproxy admin UI or SSH at bare minimum.
The simulator showing simulator error des not entice to confidence
looking forward some suggestions
best regards