NOTE: If you enable the firewall, all traffic is blocked by default,
except WebGUI(8006) and ssh(22) from your local network.
+The firewall has full support for IPv4 and IPv6. IPv6 support is fully
+transparent, and we filter traffic for both protocols by default. So
+there is no need to maintain a different set of rules for IPv6.
+
Zones
-----
outgoing traffic.
-Ports used by Proxmox VE
-------------------------
-
-* Web interface: 8006
-* VNC Web console: 5900-5999
-* SPICE proxy: 3128
-* sshd (used for cluster actions): 22
-* rpcbind: 111
-* corosync multicast (if you run a cluster): 5404, 5405 UDP
-
-
Configuration
-------------
Firewall Rules
~~~~~~~~~~~~~~
-Any firewall rule consists of a direction (`IN` or `OUT`) and an
-action (`ACCEPT`, `DENY`, `REJECT`). Additional options can be used to
-refine rule matches. Here are some examples:
+Firewall rules consists of a direction (`IN` or `OUT`) and an
+action (`ACCEPT`, `DENY`, `REJECT`). You can also specify a macro
+name. Macros contain predifined sets of rules and options. Rules can be disabled by prefixing them with '|'.
+.Firewall rules syntax
----
[RULES]
-#TYPE ACTION [OPTIONS]
-#TYPE MACRO(ACTION) [OPTIONS]
+DIRECTION ACTION [OPTIONS]
+|DIRECTION ACTION [OPTIONS] # disabled rule
+
+DIRECTION MACRO(ACTION) [OPTIONS] # use predefined macro
+----
-# -i <INTERFACE>
-# -source <SOURCE>
-# -dest <DEST>
-# -p <PROTOCOL>
-# -dport <DESTINATION_PORT>
-# -sport <SOURCE_PORT>
+The following options can be used to refine rule matches.
+include::pve-firewall-rules-opts.adoc[]
+
+Here are some examples:
+
+----
+[RULES]
IN SSH(ACCEPT) -i net0
IN SSH(ACCEPT) -i net0 # a comment
-IN SSH(ACCEPT) -i net0 -source 192.168.2.192 # only allow SSH from 192.168.2.192
+IN SSH(ACCEPT) -i net0 -source 192.168.2.192 # only allow SSH from 192.168.2.192
IN SSH(ACCEPT) -i net0 -source 10.0.0.1-10.0.0.10 # accept SSH for ip range
IN SSH(ACCEPT) -i net0 -source 10.0.0.1,10.0.0.2,10.0.0.3 #accept ssh for ip list
-IN SSH(ACCEPT) -i net0 -source +mynetgroup # accept ssh for ipset mynetgroup
-IN SSH(ACCEPT) -i net0 -source myserveralias #accept ssh for alias myserveralias
+IN SSH(ACCEPT) -i net0 -source +mynetgroup # accept ssh for ipset mynetgroup
+IN SSH(ACCEPT) -i net0 -source myserveralias #accept ssh for alias myserveralias
|IN SSH(ACCEPT) -i net0 # disabled rule
+
+IN DROP # drop all incoming packages
+OUT ACCEPT # accept all outgoing packages
----
Security Groups
NFQUEUE=0
----
-
-ifdef::manvolnum[]
-include::copyright.adoc[]
-endif::manvolnum[]
-
Notes on IPv6
^^^^^^^^^^^^^
an `ipfilter-net*` ipset for each of the VM's network interfaces containing the
corresponding link local addresses. (See the
<<ipfilter-section,Standard IP set 'ipfilter-net*'>> section for details.)
+
+Avoiding link-local addresses on tap and veth devices
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+With IPv6 enabled by default every interface gets a MAC-derived link local
+address. However, most devices on a typical {pve} setup are connected to a
+bridge and so the bridge is the only interface which really needs one.
+
+To disable a link local address on an interface you can set the interface's
+`disable_ipv6` sysconf variable. Despite the name, this does not prevent IPv6
+traffic from passing through the interface when routing or bridging, so the
+only noticeable effect will be the removal of the link local address.
+
+The easiest method of achieving this setting for all newly started VMs is to
+set it for the `default` interface configuration and enabling it explicitly on
+the interfaces which need it. This is also the case for other settings such as
+`forwarding`, `accept_ra` or `autoconf`.
+
+Here's a possible setup:
+----
+# /etc/sysconf.d/90-ipv6.conf
+
+net.ipv6.conf.default.forwarding = 0
+net.ipv6.conf.default.proxy_ndp = 0
+net.ipv6.conf.default.autoconf = 0
+net.ipv6.conf.default.disable_ipv6 = 1
+net.ipv6.conf.default.accept_ra = 0
+
+net.ipv6.conf.lo.disable_ipv6 = 0
+----
+
+----
+# /etc/network/interfaces
+(...)
+iface vmbr0 inet6 static
+ address fc00::31
+ netmask 16
+ gateway fc00::1
+ accept_ra 0
+ pre-up echo 0 > /proc/sys/net/ipv6/conf/$IFACE/disable_ipv6
+(...)
+----
+
+Ports used by Proxmox VE
+------------------------
+
+* Web interface: 8006
+* VNC Web console: 5900-5999
+* SPICE proxy: 3128
+* sshd (used for cluster actions): 22
+* rpcbind: 111
+* corosync multicast (if you run a cluster): 5404, 5405 UDP
+
+
+ifdef::manvolnum[]
+
+Macro Definitions
+-----------------
+
+include::pve-firewall-macros.adoc[]
+
+
+include::pve-copyright.adoc[]
+
+endif::manvolnum[]
projects / pve-docs.git / blobdiff