zfs: special device: update maximum for special_small_blocks

[pve-docs.git] / pve-firewall.adoc

diff --git a/pve-firewall.adoc b/pve-firewall.adoc
index 0bf108f68aa6eecf3c9b7f32ce9f62628edd9506..f59c30286f73ddf0290d3e953b8fe4a34f05ebc5 100644 (file)
--- a/pve-firewall.adoc
+++ b/pve-firewall.adoc
@@ -84,7 +84,7 @@ name enclosed in `[` and `]`.
 Cluster Wide Setup
 ~~~~~~~~~~~~~~~~~~
 
 Cluster Wide Setup
 ~~~~~~~~~~~~~~~~~~
 

-The cluster wide firewall configuration is stored at:
+The cluster-wide firewall configuration is stored at:

  
  /etc/pve/firewall/cluster.fw
 
  
  /etc/pve/firewall/cluster.fw
 


@@ -92,13 +92,13 @@ The configuration can contain the following sections:
 
 `[OPTIONS]`::
 
 
 `[OPTIONS]`::
 

-This is used to set cluster wide firewall options.
+This is used to set cluster-wide firewall options.

 
 include::pve-firewall-cluster-opts.adoc[]
 
 `[RULES]`::
 
 
 include::pve-firewall-cluster-opts.adoc[]
 
 `[RULES]`::
 

-This sections contains cluster wide firewall rules for all nodes.
+This sections contains cluster-wide firewall rules for all nodes.

 
 `[IPSET <name>]`::
 
 
 `[IPSET <name>]`::
 


@@ -121,7 +121,7 @@ set the enable option here:
 
 ----
 [OPTIONS]
 
 ----
 [OPTIONS]

-# enable firewall (cluster wide setting, default is disabled)
+# enable firewall (cluster-wide setting, default is disabled)

 enable: 1
 ----
 
 enable: 1
 ----
 


@@ -475,7 +475,7 @@ Logging of firewall rules
 -------------------------
 
 By default, all logging of traffic filtered by the firewall rules is disabled.
 -------------------------
 
 By default, all logging of traffic filtered by the firewall rules is disabled.

-To enable logging, the `loglevel` for incommig and/or outgoing traffic has to be
+To enable logging, the `loglevel` for incoming and/or outgoing traffic has to be

 set in *Firewall* -> *Options*. This can be done for the host as well as for the
 VM/CT firewall individually. By this, logging of {PVE}'s standard firewall rules
 is enabled and the output can be observed in *Firewall* -> *Log*.
 set in *Firewall* -> *Options*. This can be done for the host as well as for the
 VM/CT firewall individually. By this, logging of {PVE}'s standard firewall rules
 is enabled and the output can be observed in *Firewall* -> *Log*.


@@ -562,7 +562,7 @@ and add `ip_conntrack_ftp` to `/etc/modules` (so that it works after a reboot).
 Suricata IPS integration
 ~~~~~~~~~~~~~~~~~~~~~~~~
 
 Suricata IPS integration
 ~~~~~~~~~~~~~~~~~~~~~~~~
 

-If you want to use the http://suricata-ids.org/[Suricata IPS]
+If you want to use the https://suricata-ids.org/[Suricata IPS]

 (Intrusion Prevention System), it's possible.
 
 Packets will be forwarded to the IPS only after the firewall ACCEPTed
 (Intrusion Prevention System), it's possible.
 
 Packets will be forwarded to the IPS only after the firewall ACCEPTed


@@ -628,13 +628,14 @@ corresponding link local addresses.  (See the
 Ports used by {pve}
 -------------------
 
 Ports used by {pve}
 -------------------
 

-* Web interface: 8006
-* VNC Web console: 5900-5999
-* SPICE proxy: 3128
-* sshd (used for cluster actions): 22
-* rpcbind: 111
-* corosync multicast (if you run a cluster): 5404, 5405 UDP
-
+* Web interface: 8006 (TCP, HTTP/1.1 over TLS)
+* VNC Web console: 5900-5999 (TCP, WebSocket)
+* SPICE proxy: 3128 (TCP)
+* sshd (used for cluster actions): 22 (TCP)
+* rpcbind: 111 (UDP)
+* sendmail: 25 (TCP, outgoing)
+* corosync cluster traffic: 5404, 5405 UDP
+* live migration (VM memory and local-disk data): 60000-60050 (TCP)

 
 ifdef::manvolnum[]
 
 
 ifdef::manvolnum[]