Unable to block 22 and 8006 traffic

[proxirid]

I'm following Jay's proxmox tutorial (https://www.youtube.com/watch?v=DNsLLrCgK0U&list=PLT98CRl2KxKHnlbYhtABg6cF50bYa8Ulo&index=12) and using exactly the same steps I receive different results: after turning on firewall both on datacenter and host level, I am not blocked. Both 8006 and 22 works from local devices.

Going through documentation I found this comment:

If you enable the firewall, traffic to all hosts is blocked by default. Only exceptions is WebGUI(8006) and ssh(22) from your local network.

Is it something new? Seems weird to me to allow anything by default without any highlight in GUI and /etc/pve/firewall/cluster.fw, but my real question is: how to change it if I actually want to block local access? I tried something like this, but nothing has changed.

[OPTIONS]

enable: 1

[RULES]

IN DROP -i vmbr0 -source 0.0.0.0/0 -p tcp -sport 8006 -log nolog
IN ACCEPT -i vmbr0 -source 192.168.45.89/32 -p tcp -sport 22 -log nolog
IN ACCEPT -i vmbr0 -source 192.168.45.89/32 -p tcp -sport 8006 -log nolog

 

[Chris]

I'm following Jay's proxmox tutorial (https://www.youtube.com/watch?v=DNsLLrCgK0U&list=PLT98CRl2KxKHnlbYhtABg6cF50bYa8Ulo&index=12) and using exactly the same steps I receive different results: after turning on firewall both on datacenter and host level, I am not blocked. Both 8006 and 22 works from local devices.

Going through documentation I found this comment:


Is it something new? Seems weird to me to allow anything by default without any highlight in GUI and /etc/pve/firewall/cluster.fw, but my real question is: how to change it if I actually want to block local access? I tried something like this, but nothing has changed.

[OPTIONS]

enable: 1

[RULES]

IN DROP -i vmbr0 -source 0.0.0.0/0 -p tcp -sport 8006 -log nolog
IN ACCEPT -i vmbr0 -source 192.168.45.89/32 -p tcp -sport 22 -log nolog
IN ACCEPT -i vmbr0 -source 192.168.45.89/32 -p tcp -sport 8006 -log nolog

Hi,
in order to block traffic to port 8006 and/or 22 you will have to setup rules with destination port dport, not source port sport.

 

[Dunuin]

There are hidden anti lockout rules in place. See here: https://pve.proxmox.com/wiki/Firewall#pve_firewall_default_rules

 

[Chris]

There are hidden anti lockout rules in place. See here: https://pve.proxmox.com/wiki/Firewall#pve_firewall_default_rules

Yes, nevertheless he should be able to overrule those by explicit rules.

 

[Dunuin]

Yes, nevertheless he should be able to overrule those by explicit rules.

Jup, creating rules explicitly blocking those ports overwrites the default anti lockout rules.

As far as I underatand priorities are:
custom node rules > custom datacenter rules > anti lockout rules > default incoming/outgoing/forward policies