store manpage section inside .adoc file

[pve-docs.git] / pve-firewall.adoc

diff --git a/pve-firewall.adoc b/pve-firewall.adoc
index fc74a92e5c110cd36b0027ae430f7810d0e9cbc3..6019f95c0295d940ba59fbdc604b8203d63ebabf 100644 (file)
--- a/pve-firewall.adoc
+++ b/pve-firewall.adoc
@@ -1,15 +1,17 @@
 ifdef::manvolnum[]
-PVE({manvolnum})
-================
+PVE(8)
+======
 include::attributes.txt[]
 
+:pve-toplevel:
+
 NAME
 ----
 
 pve-firewall - PVE Firewall Daemon
 
 
-SYNOPSYS
+SYNOPSIS
 --------
 
 include::pve-firewall.8-synopsis.adoc[]
@@ -25,7 +27,12 @@ ifndef::manvolnum[]
 include::attributes.txt[]
 endif::manvolnum[]
 
-Proxmox VE Firewall provides an easy way to protect your IT
+ifdef::wiki[]
+:pve-toplevel:
+:title: Firewall
+endif::wiki[]
+
+{pve} Firewall provides an easy way to protect your IT
 infrastructure. You can setup firewall rules for all hosts
 inside a cluster, or define rules for virtual machines and
 containers. Features like firewall macros, security groups, IP sets
@@ -458,69 +465,6 @@ NFQUEUE=0
 ----
 
 
-Avoiding `link-local` Addresses on `tap` and `veth` Devices
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-With IPv6 enabled by default every interface gets a MAC-derived link local
-address. However, most devices on a typical {pve} setup are connected to a
-bridge and so the bridge is the only interface which really needs one.
-
-To disable a link local address on an interface you can set the interface's
-`disable_ipv6` sysconf variable. Despite the name, this does not prevent IPv6
-traffic from passing through the interface when routing or bridging, so the
-only noticeable effect will be the removal of the link local address.
-
-The easiest method of achieving this setting for all newly started VMs is to
-set it for the `default` interface configuration and enabling it explicitly on
-the interfaces which need it. This is also the case for other settings such as
-`forwarding`, `accept_ra` or `autoconf`.
-
-
-Here's a possible setup:
-
-.File `/etc/sysconf.d/90-ipv6.conf`
-----
-net.ipv6.conf.default.forwarding = 0
-net.ipv6.conf.default.proxy_ndp = 0
-net.ipv6.conf.default.autoconf = 0
-net.ipv6.conf.default.disable_ipv6 = 1
-net.ipv6.conf.default.accept_ra = 0
-
-net.ipv6.conf.lo.disable_ipv6 = 0
-----
-
-.File `/etc/network/interfaces`
-----
-(...)
-# Dual stack:
-iface vmbr0 inet static
-    address 1.2.3.4
-    netmask 255.255.255.128
-    gateway 1.2.3.5
-iface vmbr0 inet6 static
-    address fc00::31
-    netmask 16
-    gateway fc00::1
-    accept_ra 0
-    pre-up echo 0 > /proc/sys/net/ipv6/conf/$IFACE/disable_ipv6
-
-# With IPv6-only 'pre-up' is too early and 'up' is too late.
-# Work around this by creating the bridge manually
-iface vmbr1 inet manual
-    pre-up ip link add $IFACE type bridge
-    up echo 0 > /proc/sys/net/ipv6/conf/$IFACE/disable_ipv6
-iface vmbr1 inet6 static
-    address fc00:b:3::1
-    netmask 96
-    bridge_ports none
-    bridge_stp off
-    bridge_fd 0
-    bridge_vlan_aware yes
-    accept_ra 0
-(...)
-----
-
-
 Notes on IPv6
 -------------
 
@@ -547,8 +491,8 @@ corresponding link local addresses.  (See the
 <<ipfilter-section,Standard IP set `ipfilter-net*`>> section for details.)
 
 
-Ports used by Proxmox VE
-------------------------
+Ports used by {pve}
+-------------------
 
 * Web interface: 8006
 * VNC Web console: 5900-5999