Restrict access to a VM (all ports) to a whitelist IP list only

[ATX]

Hi

I am try to achieve the following:

• Only a certain list of IP must be able to access the VM (80, 8080, but, in general all ports).
• IP that are not in the list will have their packets DROP/REJECT.

The goal is to only allow the access from two physical sites that do have a static IP address but not hardware to setup a VPN connection.

Could you please advice on how to do so ? I have been playing with firewall options through the web UI but without success.


Thanks & Regards

 

[Stefan_R]

You can take advantage of the fact that rules are processed top to bottom. For you use-case, two rules should be sufficient (note the order):

• in ACCEPT from IPSet 'whitelist' (which contains all IPs you want to whitelist)
• in DROP/REJECT (no further settings, drop everything not matched above)

Use drag and drop to re-order rules in the GUI.

 

[ATX]

@Stefan_R Thanks, this works

 

[Mo17]

For a similar problem, I did the same configuration, but I had a dns problem in the vm ...

 

[Pierre-Yves]

For a similar problem, I did the same configuration, but I had a dns problem in the vm ...

Ok, but can you tell a little more about your architecture ?

 

[Mo17]

So I have an ovh dedicated server , I installed proxmox, created the bridge network , for every vm inside proxmox I ordred an IP failover from ovh, at this step all is ok.
Then I wanted to restrict acces to the created promox vms only from the ovh server, so I activated the firewall, then problem started

I didn't add any special rule, just activated the firewall, now I can already access to promox vms only from the ovh server hosting proxmox.
From the proxmox vms, I can ping , but no dns :

 

[Pierre-Yves]

and the DNS config of your VMs and your proxmox are ?

 

[Mo17]

for both , I am using ovh dns 213.186.33.99

 

[Pierre-Yves]

and you can ping this IP from everywhere ?

 

[Mo17]

yes

 

[Pierre-Yves]

if you try to change DNS for the google one (8.8.8.8) ?

 

[Mo17]

I did , I used opendns also , but the problem persists

 

[Pierre-Yves]

ok, so it seems that UDP 53 resquests are stopped by something ...
like a firewall
sure there is no firewall rules activated ?

 

[Mo17]

Yes , I even added these rules in host and vm level , but nothing

 

[Pierre-Yves]

maybe your DNS resquests are sent thru your second NIC instead of your first one
have you setup DNS in the second NIC ?

 

[Mo17]

The only location where I have set the dns is , inside the proxmox windows vm a I shared before, and in ovh server level

 

[Pierre-Yves]

what's the result of

ipconfig /all

l

 

[Mo17]

 

[Pierre-Yves]

you set a submask 255.255.255.255 so you add static route to reach the gateway ?
did you try when Windows Firewall is stopped ?

 

[Mo17]

yes , same problem