This is a fantastic channel! Pure, useful info! I was just wandering around the forums trying to figure this out for myself (e.g. don't want VMs to be able to just reach out to the proxmox nodes' web interfaces themselves!), so I'm so glad I stumbled upon this!
I set output policy to drop everywhere, then defined 1st rule accept with destination gateway, 2nd rule drop with destination ALL local IPV4 addresses, third accept out anywhere else
This is a great video. I am a very big fan of IPTABLES. Behind the scene it is the IPtables at work. This gives a very eassy way to write the rules. It would be good to see if we write the Iptables rules in the proxmos shell, will it refelect in the proxmos gui. Proxmos is really good. I remember in the late 90s we have this Webadmin for linux which is gui based configuration and now I see proxmox like that tool with hypervisor capability. Thanks again MRP. This is a great video.
Hi MRP We are running 4 node ceph cluster with PBS on another bare metal. We have configured simple zone in SDN as well. You explained the FW well. Thank you for your efforts. please shoot some videos on FW security groups and SDN with simple and vlan zones.
I don't get why out rules towards the internet are needed when the default policy for output was already ACCEPT under Datacenter, and also the individual LXC. Shouldn't it be turned to DROP for output rules to become necessary, otherwise everything out is accepted?
Hello Sir! May I ask you a question? Which rule do I have to add to the firewall to reject all traffic and connections to ipv6 adresses? When I activate the "Localnet" profile it blocks all IPV4 only.
Great video, thank you very much. However, what I don't understand is that when I run the command 'nmap -sn' in the 'vm', it can still see the other devices on my local network. Does anyone know why?
Yes, extra firewall config required. For example, you can setup that firewall will accept access in from outside network to that VM but will block access from that VM to rest of local network, one exception being is Gateway (to access internet) + DNS server to resolve web queries.
hi there you lxc container pihole, I installed it using simple SDN. I can update, ping etc.. but when I place the NAT ip address in the web browser with the /admin, I get nothing. If I switch it to vmbr0 it works. any suggestions?
LXC or VM inside SDN network can access your local network, but you can't access VM or LXC from your local network back into SDN. To access VM or LXC inside SDN network from your local network, you need to assign additional network adapter to that VM/LXC. This way your VM/LXC will have two "local" ip addresses: 1: 100.100.100.x (SDN) and 2: 192.x.x.x (Local)
@@MRPtech first off thx for getting back with me. So do I add vmbr0 ip with gateway or create a vmbr1 with a new ip and gateway? what do I leave the gateway on the SDN ip address or remove it? also which ip do I use in the web browser to access pihole with the /admin?
If you setup SDN IP as static, leave as it is, you need to add main network "card" as 2nd network connection device. example: prnt.sc/l49BjpLbZAJJ net0 - SDN - i have SDN ip of 192.168.100.100 and gateway 192.168.100.1 net1 - vmbr0 - 192.168.178.123 and gateway 192.168.178.1 If i want to access this VM from my local network - i use 192.168.178.123 ip address. 192.168.100.100 is my SDN ip address which can be used to communicate with other VMs inside the same SDN network.
![Lil Uzi Vert - Chill Bae [Official Music Video]](http://i.ytimg.com/vi/D7F42F_JM3U/mqdefault.jpg)
This is a fantastic channel! Pure, useful info! I was just wandering around the forums trying to figure this out for myself (e.g. don't want VMs to be able to just reach out to the proxmox nodes' web interfaces themselves!), so I'm so glad I stumbled upon this!
This is actually so useful. Just discovered your channel. You are a beast
Thanks for sharing. A nice and clean video with a lot of useful information to me
I set output policy to drop everywhere, then defined 1st rule accept with destination gateway, 2nd rule drop with destination ALL local IPV4 addresses, third accept out anywhere else
This is actually so useful. Thanks!
Very cool. I was wondering about this. I had them turned off, but you showed how to implement correctly. Thanks!
Love your videos.
Thank you for sharing your knowledge :)
Hugs from Portugal!
Your Welcome. I hope video was helpful for you.
Thank you. Great video and tutorial.
This is a great video. I am a very big fan of IPTABLES. Behind the scene it is the IPtables at work. This gives a very eassy way to write the rules. It would be good to see if we write the Iptables rules in the proxmos shell, will it refelect in the proxmos gui. Proxmos is really good. I remember in the late 90s we have this Webadmin for linux which is gui based configuration and now I see proxmox like that tool with hypervisor capability.
Thanks again MRP. This is a great video.
Hi MRP
We are running 4 node ceph cluster with PBS on another bare metal. We have configured simple zone in SDN as well.
You explained the FW well. Thank you for your efforts.
please shoot some videos on FW security groups and SDN with simple and vlan zones.
It's a good idea to block all traffic except that directed to gateway
I don't get why out rules towards the internet are needed when the default policy for output was already ACCEPT under Datacenter, and also the individual LXC. Shouldn't it be turned to DROP for output rules to become necessary, otherwise everything out is accepted?
Hello Sir! May I ask you a question? Which rule do I have to add to the firewall to reject all traffic and connections to ipv6 adresses? When I activate the "Localnet" profile it blocks all IPV4 only.
Great video, thanks
Great video, thank you very much. However, what I don't understand is that when I run the command 'nmap -sn' in the 'vm', it can still see the other devices on my local network. Does anyone know why?
Great video!! As a complement to this one can you please make one for setting up vlan? Thanks
What would be the best way to run a firewall? Local router -> Proxmox -> PFsense ( manage all interfaces from Promox ) or PFSense -> Proxmox ?
Can this be used for public facing server VMs to prevent access to the rest of the network in the event the server is compromised?
Yes, extra firewall config required.
For example, you can setup that firewall will accept access in from outside network to that VM but will block access from that VM to rest of local network, one exception being is Gateway (to access internet) + DNS server to resolve web queries.
hi there
you lxc container pihole, I installed it using simple SDN. I can update, ping etc.. but when I place the NAT ip address in the web browser with the /admin, I get nothing. If I switch it to vmbr0 it works. any suggestions?
LXC or VM inside SDN network can access your local network, but you can't access VM or LXC from your local network back into SDN.
To access VM or LXC inside SDN network from your local network, you need to assign additional network adapter to that VM/LXC. This way your VM/LXC will have two "local" ip addresses: 1: 100.100.100.x (SDN) and 2: 192.x.x.x (Local)
@@MRPtech first off thx for getting back with me. So do I add vmbr0 ip with gateway or create a vmbr1 with a new ip and gateway? what do I leave the gateway on the SDN ip address or remove it? also which ip do I use in the web browser to access pihole with the /admin?
If you setup SDN IP as static, leave as it is, you need to add main network "card" as 2nd network connection device.
example:
prnt.sc/l49BjpLbZAJJ
net0 - SDN - i have SDN ip of 192.168.100.100 and gateway 192.168.100.1
net1 - vmbr0 - 192.168.178.123 and gateway 192.168.178.1
If i want to access this VM from my local network - i use 192.168.178.123 ip address. 192.168.100.100 is my SDN ip address which can be used to communicate with other VMs inside the same SDN network.
@@MRPtech ok, if I use the SDN ip 10.0.100.1/admin it won't work but if I use vmbr0 ip 10.0.40.4/admin it works. am I good to go?
@@MRPtech so any lxc or vm that I create on the SDN will have to be setup the same way with a different ip address on vmbr0
Thanks.
thx
np