Setup PVE Firewall on Masquerading config to open ports for my VM. I loose VM internet connection

[getmekd]

Hi all,

thanks in advance for anyone who helps me.
I've set up a proxmox server with one node and 1 VM.
Set up the config for the network access with one vmbr0 who briges the nic and then another vmbr1 to whom i connected my vm.
Internet access works fine but i realized i have no firewall enabled. Tried to enable it the first time and lost connection to the dashboard.
Managed to stop it from the console and set the port that proxmox uses for the dashboard in the firewall rules and i got back on it.
The problem is, whenever i enable the firewall i loose connection to internet from the VM.
Could someone please help me with this?

Thanks

 

[shanreich]

Can you post your network configuration as well as your firewall configuration?

ip a
cat /etc/network/interfaces

cat /etc/pve/firewall/*
cat /etc/pve/local/host.fw

iptables-save -c
iptables-save -t nat -c
pve-firewall localnet

How are you trying to access your VM? From the outside?

 

[getmekd]

Yes, i'm trying to access the vm from outside because i configured a git service and i need to access from outside.
Do i need to do these commands in the proxmox console?

 

[shanreich]

What IP are you using to access the VM, the one on vmbr0? Do you have DNAT enabled for the VM or set up a public IP for the VM on vmbr0?

Yes, you need to use the console.

 

[getmekd]

Yes i have one public ip set up on the vmbr0. The one that i use to access the proxmox gui too via the 8006 port
Going forward, the question really is, do i need the pve firewall?

 

[shanreich]

If you want to access the VM then you either need to setup DNAT or get a second public IP with which the VM is reachable.

 

[getmekd]

Can you help me with DNAT? i'll post the configs

 

[getmekd]

Hi @shanreich i've managed to get to the service on the public ip with this rule:

ipables -t nat -A PREROUTING -p tcp -d MYPUBLICIP --dport 3000 -i vmbr0 -j DNAT --to-destination VMIP:3000

Is it good like that or i need to set up anything else?

 

[shanreich]

Hi @shanreich i've managed to get to the service on the public ip with this rule:

ipables -t nat -A PREROUTING -p tcp -d MYPUBLICIP --dport 3000 -i vmbr0 -j DNAT --to-destination VMIP:3000

Is it good like that or i need to set up anything else?

Just wanted to post it! You should be fine using this rule.