Restrict lxc access only to assigned ip

[ferdl9999]

Hello,

how is it possible to configure via the internal proxmox firewall, that every lxc container can use only the ip address which is assigned to it?
For example i assign ip 10.0.0.5 to vm100, then vm100 can use e.g. ip 10.0.0.6 through editing the /etc/network/interfaces file.

Currently i have no firewall hardware / mac filtering switch.

I hope you can help me. Thanks for your answer!


This is my /etc/network/interfaces file on the host (i am using a PA assigned /24 subnet):

auto lo
iface lo inet loopback

auto eno1
iface eno1 inet manual
iface eno2 inet manual

auto vmbr0
iface vmbr0 inet static
        address   45.xxx.xxx.2
        netmask   255.255.255.0
        gateway   45.xxx.xxx.1
        bridge-ports eno1
        bridge-stp off
        bridge-fd 0

 

[lhorace]

There's no way that I know off to restrict IP's to interfaces, interfaces can assign themselves arbitrary valid IP addresses, unless it's possible to deny them through AppArmor or similar. Alternatively, PVE-FIREWALL might help here.

 

[Chris]

Hi,
as pointed out it is not possible to restrict the IP address the CT/VM can assign to it's interfaces.
But what you can do is only allow incomming traffic with the resticted IP (e.g. 10.0.0.5) as destination and outgoing traffic with the restricted IP as source and dropping all the rest.
You can easily define such rules for the CT via the GUI.

 

[ferdl9999]

Thanks for your answers!

Is it possible to make a system-wide firewall rule for that, so i don't need to make firewall rules for each vm?

 

[lhorace]

Yes, at the node level, perhaps IP+Mac filtering.

 

[ferdl9999]

Yes, at the node level, perhaps IP+Mac filtering.

How can i realize this exactly?