pve-firewall.adoc: move info about pve ports to the end

[pve-docs.git] / pve-firewall.adoc

diff --git a/pve-firewall.adoc b/pve-firewall.adoc
index aa921cb8dcfc248b250e88ebba9d83bbbde684b9..4e551a79105b4e45b336a7459a204ce316dcabe9 100644 (file)
--- a/pve-firewall.adoc
+++ b/pve-firewall.adoc
@@ -42,6 +42,10 @@ firewall solution.
 NOTE: If you enable the firewall, all traffic is blocked by default,
 except WebGUI(8006) and ssh(22) from your local network.
 
+The firewall has full support for IPv4 and IPv6. IPv6 support is fully
+transparent, and we filter traffic for both protocols by default. So
+there is no need to maintain a different set of rules for IPv6.
+
 
 Zones
 -----
@@ -60,17 +64,6 @@ For each zone, you can define firewall rules for incoming and/or
 outgoing traffic.
 
 
-Ports used by Proxmox VE
-------------------------
-
-* Web interface: 8006
-* VNC Web console: 5900-5999
-* SPICE proxy: 3128
-* sshd (used for cluster actions): 22
-* rpcbind: 111
-*  corosync multicast (if you run a cluster): 5404, 5405 UDP
-
-
 Configuration
 -------------
 
@@ -130,32 +123,40 @@ in addition to the general 'Enable Firewall' option in the 'Options' tab.
 Firewall Rules
 ~~~~~~~~~~~~~~
 
-Any firewall rule consists of a direction (`IN` or `OUT`) and an
-action (`ACCEPT`, `DENY`, `REJECT`). Additional options can be used to
-refine rule matches. Here are some examples:
+Firewall rules consists of a direction (`IN` or `OUT`) and an
+action (`ACCEPT`, `DENY`, `REJECT`). You can also specify a macro
+name. Macros contain predifined sets of rules and options. Rules can be disabled by prefixing them with '|'.
 
+.Firewall rules syntax
 ----
 [RULES]
 
-#TYPE ACTION [OPTIONS]
-#TYPE MACRO(ACTION) [OPTIONS]
+DIRECTION ACTION [OPTIONS]
+|DIRECTION ACTION [OPTIONS] # disabled rule
+
+DIRECTION MACRO(ACTION) [OPTIONS] # use predefined macro
+----
+
+The following options can be used to refine rule matches. 
+
+include::pve-firewall-rules-opts.adoc[]
 
-# -i      <INTERFACE>
-# -source <SOURCE>
-# -dest   <DEST>
-# -p      <PROTOCOL>
-# -dport  <DESTINATION_PORT>
-# -sport  <SOURCE_PORT>
+Here are some examples:
 
+----
+[RULES]
 IN SSH(ACCEPT) -i net0
 IN SSH(ACCEPT) -i net0 # a comment
-IN SSH(ACCEPT) -i net0 -source 192.168.2.192  # only allow SSH from 192.168.2.192
+IN SSH(ACCEPT) -i net0 -source 192.168.2.192 # only allow SSH from 192.168.2.192
 IN SSH(ACCEPT) -i net0 -source 10.0.0.1-10.0.0.10 # accept SSH for ip range
 IN SSH(ACCEPT) -i net0 -source 10.0.0.1,10.0.0.2,10.0.0.3 #accept ssh for ip list
-IN SSH(ACCEPT) -i net0 -source +mynetgroup   # accept ssh for ipset mynetgroup
-IN SSH(ACCEPT) -i net0 -source myserveralias   #accept ssh for alias myserveralias
+IN SSH(ACCEPT) -i net0 -source +mynetgroup # accept ssh for ipset mynetgroup
+IN SSH(ACCEPT) -i net0 -source myserveralias #accept ssh for alias myserveralias
 
 |IN SSH(ACCEPT) -i net0 # disabled rule
+
+IN  DROP # drop all incoming packages
+OUT ACCEPT # accept all outgoing packages
 ----
 
 Security Groups
@@ -365,11 +366,6 @@ Available queues are defined in
 NFQUEUE=0
 ----
 
-
-ifdef::manvolnum[]
-include::copyright.adoc[]
-endif::manvolnum[]
-
 Notes on IPv6
 ^^^^^^^^^^^^^
 
@@ -436,3 +432,26 @@ iface vmbr0 inet6 static
     pre-up echo 0 > /proc/sys/net/ipv6/conf/$IFACE/disable_ipv6
 (...)
 ----
+
+Ports used by Proxmox VE
+------------------------
+
+* Web interface: 8006
+* VNC Web console: 5900-5999
+* SPICE proxy: 3128
+* sshd (used for cluster actions): 22
+* rpcbind: 111
+*  corosync multicast (if you run a cluster): 5404, 5405 UDP
+
+
+ifdef::manvolnum[]
+
+Macro Definitions
+-----------------
+
+include::pve-firewall-macros.adoc[]
+
+
+include::pve-copyright.adoc[]
+
+endif::manvolnum[]