firewall: link-local addresses and sysctls

[pve-docs.git] / pve-firewall.adoc

diff --git a/pve-firewall.adoc b/pve-firewall.adoc
index 36a4f3c4bb24e5cb4beb27e3a66789e7c0142681..aa921cb8dcfc248b250e88ebba9d83bbbde684b9 100644 (file)
--- a/pve-firewall.adoc
+++ b/pve-firewall.adoc
@@ -263,10 +263,22 @@ Traffic from these ips is dropped by every host's and VM's firewall.
 213.87.123.0/24
 ----
 
-Standard IP set 'ipfilter'
-^^^^^^^^^^^^^^^^^^^^^^^^^^
+[[ipfilter-section]]
+Standard IP set 'ipfilter-net*'
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-This ipset is used to prevent ip spoofing
+These filters belong to a VM's network interface and are mainly used to prevent
+IP spoofing. If such a set exists for an interface then any outgoing traffic
+with a source IP not matching its interface's corresponding ipfilter set will
+be dropped.
+
+For containers with configured IP addresses these sets, if they exist (or are
+activated via the general `IP Filter` option in the VM's firewall's 'options'
+tab), implicitly contain the associated IP addresses.
+
+For both virtual machines and containers they also implicitly contain the
+standard MAC-derived IPv6 link-local address in order to allow the neighbor
+discovery protocol to work.
 
 ----
 /etc/pve/firewall/<VMID>.fw
@@ -358,3 +370,69 @@ ifdef::manvolnum[]
 include::copyright.adoc[]
 endif::manvolnum[]
 
+Notes on IPv6
+^^^^^^^^^^^^^
+
+The firewall contains a few IPv6 specific options. One thing to note is that
+IPv6 does not use the ARP protocol anymore, and instead uses NDP (Neighbor
+Discovery Protocol) which works on IP level and thus needs IP addresses to
+succeed. For this purpose link-local addresses derived from the interface's MAC
+address are used. By default the 'NDP' option is enabled on both host and VM
+level to allow neighbor discovery (NDP) packets to be sent and received.
+
+Beside neighbor discovery NDP is also used for a couple of other things, like
+autoconfiguration and advertising routers.
+
+By default VMs are allowed to send out router solicitation messages (to query
+for a router), and to receive router advetisement packets. This allows them to
+use stateless auto configuration. On the other hand VMs cannot advertise
+themselves as routers unless the 'Allow Router Advertisement' (`radv: 1`) option
+is set.
+
+As for the link local addresses required for NDP, there's also an 'IP Filter'
+(`ipfilter: 1`) option which can be enabled which has the same effect as adding
+an `ipfilter-net*` ipset for each of the VM's network interfaces containing the
+corresponding link local addresses.  (See the
+<<ipfilter-section,Standard IP set 'ipfilter-net*'>> section for details.)
+
+Avoiding link-local addresses on tap and veth devices
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+With IPv6 enabled by default every interface gets a MAC-derived link local
+address. However, most devices on a typical {pve} setup are connected to a
+bridge and so the bridge is the only interface which really needs one.
+
+To disable a link local address on an interface you can set the interface's
+`disable_ipv6` sysconf variable. Despite the name, this does not prevent IPv6
+traffic from passing through the interface when routing or bridging, so the
+only noticeable effect will be the removal of the link local address.
+
+The easiest method of achieving this setting for all newly started VMs is to
+set it for the `default` interface configuration and enabling it explicitly on
+the interfaces which need it. This is also the case for other settings such as
+`forwarding`, `accept_ra` or `autoconf`.
+
+Here's a possible setup:
+----
+# /etc/sysconf.d/90-ipv6.conf
+
+net.ipv6.conf.default.forwarding = 0
+net.ipv6.conf.default.proxy_ndp = 0
+net.ipv6.conf.default.autoconf = 0
+net.ipv6.conf.default.disable_ipv6 = 1
+net.ipv6.conf.default.accept_ra = 0
+
+net.ipv6.conf.lo.disable_ipv6 = 0
+----
+
+----
+# /etc/network/interfaces
+(...)
+iface vmbr0 inet6 static
+    address fc00::31
+    netmask 16
+    gateway fc00::1
+    accept_ra 0
+    pre-up echo 0 > /proc/sys/net/ipv6/conf/$IFACE/disable_ipv6
+(...)
+----