mirror of
git://git.proxmox.com/git/pve-docs.git
synced 2025-02-12 21:57:31 +03:00
import firewall docs
This commit is contained in:
Dietmar Maurer
parent
ac1e389617
commit
c7eda5e6f5
358
pve-firewall.adoc
Normal file
358
pve-firewall.adoc
Normal file
@ -0,0 +1,358 @@
|
||||
include::attributes.txt[]
|
||||
ifdef::manvolnum[]
|
||||
PVE({manvolnum})
|
||||
================
|
||||
|
||||
NAME
|
||||
----
|
||||
|
||||
pve-firewall - The PVE Firewall Daemon
|
||||
|
||||
|
||||
SYNOPSYS
|
||||
--------
|
||||
|
||||
include::pve-firewall.1-synopsis.adoc[]
|
||||
|
||||
|
||||
DESCRIPTION
|
||||
-----------
|
||||
endif::manvolnum[]
|
||||
|
||||
ifndef::manvolnum[]
|
||||
{pve} Firewall
|
||||
==============
|
||||
endif::manvolnum[]
|
||||
|
||||
// Copied from pve wiki: Revision as of 08:45, 9 November 2015
|
||||
|
||||
Proxmox VE Firewall provides an easy way to protect your IT
|
||||
infrastructure. You can easily setup firewall rules for all hosts
|
||||
inside a cluster, or define rules for virtual machines and
|
||||
containers. Features like firewall macros, security groups, IP sets
|
||||
and aliases help making that task easier.
|
||||
|
||||
While all configuration is stored on the cluster file system, the
|
||||
iptables based firewall runs on each cluster node, and thus provides
|
||||
full isolation between virtual machines. The distributed nature of
|
||||
this system also provides much higher bandwidth than a central
|
||||
firewall solution.
|
||||
|
||||
NOTE: If you enable the firewall, all traffic is blocked by default,
|
||||
except WebGUI(8006) and ssh(22) from your local network.
|
||||
|
||||
|
||||
Zones
|
||||
-----
|
||||
|
||||
The Proxmox VE firewall groups the network into the following logical zones:
|
||||
|
||||
Host::
|
||||
|
||||
Traffic from/to a cluster node
|
||||
|
||||
VM::
|
||||
|
||||
Traffic from/to a specific VM
|
||||
|
||||
For each zone, you can define firewall rules for incoming and/or
|
||||
outgoing traffic.
|
||||
|
||||
|
||||
Ports used by Proxmox VE
|
||||
------------------------
|
||||
|
||||
* Web interface: 8006
|
||||
* VNC Web console: 5900-5999
|
||||
* SPICE proxy: 3128
|
||||
* sshd (used for cluster actions): 22
|
||||
* rpcbind: 111
|
||||
* corosync multicast (if you run a cluster): 5404, 5405 UDP
|
||||
|
||||
|
||||
Configuration
|
||||
-------------
|
||||
|
||||
All firewall related configuration is stored on the proxmox cluster
|
||||
file system. So those files are automatically distributed to all
|
||||
cluster nodes, and the 'pve-firewall' service updates the underlying
|
||||
iptables rules automatically on any change. Any configuration can be
|
||||
done using the GUI (i.e. Datacenter -> Firewall -> Options tab (tabs
|
||||
at the bottom of the page), or on a Node -> Firewall), so the
|
||||
following configuration file snippets are just for completeness.
|
||||
|
||||
Cluster wide configuration is stored at:
|
||||
|
||||
/etc/pve/firewall/cluster.fw
|
||||
|
||||
The firewall is completely disabled by default, so you need to set the
|
||||
enable option here:
|
||||
|
||||
----
|
||||
[OPTIONS]
|
||||
# enable firewall (cluster wide setting, default is disabled)
|
||||
enable: 1
|
||||
----
|
||||
|
||||
The cluster wide configuration can contain the following data:
|
||||
|
||||
* IP set definitions
|
||||
* Alias definitions
|
||||
* Security group definitions
|
||||
* Cluster wide firewall rules for all nodes
|
||||
|
||||
VM firewall configuration is read from:
|
||||
|
||||
/etc/pve/firewall/<VMID>.fw
|
||||
|
||||
and contains the following data:
|
||||
|
||||
* IP set definitions
|
||||
* Alias definitions
|
||||
* Firewall rules for this VM
|
||||
* VM specific options
|
||||
|
||||
And finally, any host related configuration is read from:
|
||||
|
||||
/etc/pve/nodes/<nodename>/host.fw
|
||||
|
||||
This is useful if you want to overwrite rules from 'cluster.fw'
|
||||
config. You can also increase log verbosity, and set netfilter related
|
||||
options.
|
||||
|
||||
Enabling Firewall for VMs and Containers
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
You need to enable the firewall on the virtual network interface configuration.
|
||||
|
||||
Firewall Rules
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
Any firewall rule consists of a direction (`IN` or `OUT`) and an
|
||||
action (`ACCEPT`, `DENY`, `REJECT`). Additional options can be used to
|
||||
refine rule matches. Here are some examples:
|
||||
|
||||
----
|
||||
[RULES]
|
||||
|
||||
#TYPE ACTION [OPTIONS]
|
||||
#TYPE MACRO(ACTION) [OPTIONS]
|
||||
|
||||
# -i <INTERFACE>
|
||||
# -source <SOURCE>
|
||||
# -dest <DEST>
|
||||
# -p <PROTOCOL>
|
||||
# -dport <DESTINATION_PORT>
|
||||
# -sport <SOURCE_PORT>
|
||||
|
||||
IN SSH(ACCEPT) -i net0
|
||||
IN SSH(ACCEPT) -i net0 # a comment
|
||||
IN SSH(ACCEPT) -i net0 -source 192.168.2.192 # only allow SSH from 192.168.2.192
|
||||
IN SSH(ACCEPT) -i net0 -source 10.0.0.1-10.0.0.10 # accept SSH for ip range
|
||||
IN SSH(ACCEPT) -i net0 -source 10.0.0.1,10.0.0.2,10.0.0.3 #accept ssh for ip list
|
||||
IN SSH(ACCEPT) -i net0 -source +mynetgroup # accept ssh for ipset mynetgroup
|
||||
IN SSH(ACCEPT) -i net0 -source myserveralias #accept ssh for alias myserveralias
|
||||
|
||||
|IN SSH(ACCEPT) -i net0 # disabled rule
|
||||
----
|
||||
|
||||
Security Groups
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
A security group is a group a rules, defined at cluster level, which
|
||||
can be used in all VMs rules. For example you can define a group named
|
||||
`webserver` with rules to open http and https ports.
|
||||
|
||||
----
|
||||
# /etc/pve/firewall/cluster.fw
|
||||
|
||||
[group webserver]
|
||||
IN ACCEPT -p tcp -dport 80
|
||||
IN ACCEPT -p tcp -dport 443
|
||||
----
|
||||
|
||||
Then, you can add this group in a vm firewall
|
||||
|
||||
----
|
||||
# /etc/pve/firewall/<VMID>.fw
|
||||
|
||||
[RULES]
|
||||
GROUP webserver
|
||||
----
|
||||
|
||||
|
||||
IP Aliases
|
||||
~~~~~~~~~~
|
||||
|
||||
IP Aliases allows you to associate IP addresses of Networks with a
|
||||
name. You can then refer to those names:
|
||||
|
||||
* inside IP set definitions
|
||||
* in `source` and `dest` properties of firewall rules
|
||||
|
||||
Standard IP alias `local_network`
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
This alias is automatically defined. Please use the following command
|
||||
to see assigned values:
|
||||
|
||||
----
|
||||
# pve-firewall localnet
|
||||
local hostname: example
|
||||
local IP address: 192.168.2.100
|
||||
network auto detect: 192.168.0.0/20
|
||||
using detected local_network: 192.168.0.0/20
|
||||
----
|
||||
|
||||
The firewall automatically sets up rules to allow everything needed
|
||||
for cluster communication (corosync, API, SSH).
|
||||
|
||||
The user can overwrite these values in the cluster.fw alias
|
||||
section. If you use a single host on a public network, it is better to
|
||||
explicitly assign the local IP address
|
||||
|
||||
----
|
||||
# /etc/pve/firewall/cluster.fw
|
||||
[ALIASES]
|
||||
local_network 1.2.3.4 # use the single ip address
|
||||
----
|
||||
|
||||
IP Sets
|
||||
~~~~~~~
|
||||
|
||||
IP sets can be used to define groups of networks and hosts. You can
|
||||
refer to them with `+name` in firewall rules `source` and `dest`
|
||||
properties.
|
||||
|
||||
The following example allows HTTP traffic from the `management` IP
|
||||
set.
|
||||
|
||||
IN HTTP(ACCEPT) -source +management
|
||||
|
||||
Standard IP set `management`
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
This IP set applies only to host firewalls (not VM firewalls). Those
|
||||
ips are allowed to do normal management tasks (PVE GUI, VNC, SPICE,
|
||||
SSH).
|
||||
|
||||
The local cluster network is automatically added to this IP set (alias
|
||||
`cluster_network`), to enable inter-host cluster
|
||||
communication. (multicast,ssh,...)
|
||||
|
||||
----
|
||||
# /etc/pve/firewall/cluster.fw
|
||||
|
||||
[IPSET management]
|
||||
192.168.2.10
|
||||
192.168.2.10/24
|
||||
----
|
||||
|
||||
Standard IP set 'blacklist'
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
Traffic from those ips is dropped in all hosts and VMs firewalls.
|
||||
|
||||
----
|
||||
# /etc/pve/firewall/cluster.fw
|
||||
|
||||
[IPSET blacklist]
|
||||
77.240.159.182
|
||||
213.87.123.0/24
|
||||
----
|
||||
|
||||
Standard IP set 'ipfilter'
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
This ipset is used to prevent ip spoofing
|
||||
|
||||
----
|
||||
/etc/pve/firewall/<VMID>.fw
|
||||
|
||||
[IPSET ipfilter-net0] # only allow specified IPs on net0
|
||||
192.168.2.10
|
||||
----
|
||||
|
||||
Services and Commands
|
||||
~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
The firewall runs two service daemons on each node:
|
||||
|
||||
* pvefw-logger: NFLOG daemon (ulogd replacement).
|
||||
* pve-firewall: updates iptables rules
|
||||
|
||||
There is also a CLI command named 'pve-firewall', which can be used to
|
||||
start and stop the firewall service:
|
||||
|
||||
# pve-firewall start
|
||||
# pve-firewall stop
|
||||
|
||||
To get the status use:
|
||||
|
||||
# pve-firewall status
|
||||
|
||||
The above command reads and compiles all firewall rules, so you will
|
||||
see warnings if your firewall configuration contains any errors.
|
||||
|
||||
If you want to see the generated iptables rules you can use:
|
||||
|
||||
# iptables-save
|
||||
|
||||
Tips and Tricks
|
||||
~~~~~~~~~~~~~~~
|
||||
|
||||
How to allow FTP
|
||||
^^^^^^^^^^^^^^^^
|
||||
|
||||
FTP is an old style protocol which uses port 21 and several other dynamic ports. So you
|
||||
need a rule to accept port 21. In addition, you need to load the 'ip_conntrack_ftp' module.
|
||||
So please run:
|
||||
|
||||
modprobe ip_conntrack_ftp
|
||||
|
||||
and add `ip_conntrack_ftp` to '/etc/modules' (so that it works after a reboot) .
|
||||
|
||||
Suricata IPS integration
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
If you want to use the http://suricata-ids.org/[Suricata IPS]
|
||||
(Intrusion Prevention System), it's possible.
|
||||
|
||||
Packets will be forwarded to the IPS only after the firewall ACCEPTed
|
||||
them.
|
||||
|
||||
Rejected/Dropped firewall packets don't go to the IPS.
|
||||
|
||||
Install suricata on proxmox host:
|
||||
|
||||
----
|
||||
# apt-get install suricata
|
||||
# modprobe nfnetlink_queue
|
||||
----
|
||||
|
||||
Don't forget to add `nfnetlink_queue` to '/etc/modules' for next reboot.
|
||||
|
||||
Then, enable IPS for a specific VM with:
|
||||
|
||||
----
|
||||
# /etc/pve/firewall/<VMID>.fw
|
||||
|
||||
[OPTIONS]
|
||||
ips: 1
|
||||
ips_queues: 0
|
||||
----
|
||||
|
||||
`ips_queues` will bind a specific cpu queue for this VM.
|
||||
|
||||
Available queues are defined in
|
||||
|
||||
----
|
||||
# /etc/default/suricata
|
||||
NFQUEUE=0
|
||||
----
|
||||
|
||||
|
||||
ifdef::manvolnum[]
|
||||
include::copyright.adoc[]
|
||||
endif::manvolnum[]
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user