Firewall Rules
~~~~~~~~~~~~~~
-Any firewall rule consists of a direction (`IN` or `OUT`) and an
-action (`ACCEPT`, `DENY`, `REJECT`). Additional options can be used to
-refine rule matches. Here are some examples:
+Firewall rules consists of a direction (`IN` or `OUT`) and an
+action (`ACCEPT`, `DENY`, `REJECT`). You can also specify a macro
+name. Macros contain predifined sets of rules and options. Rules can be disabled by prefixing them with '|'.
+.Firewall rules syntax
----
[RULES]
-#TYPE ACTION [OPTIONS]
-#TYPE MACRO(ACTION) [OPTIONS]
+DIRECTION ACTION [OPTIONS]
+|DIRECTION ACTION [OPTIONS] # disabled rule
-# -i <INTERFACE>
-# -source <SOURCE>
-# -dest <DEST>
-# -p <PROTOCOL>
-# -dport <DESTINATION_PORT>
-# -sport <SOURCE_PORT>
+DIRECTION MACRO(ACTION) [OPTIONS] # use predefined macro
+----
+
+The following options can be used to refine rule matches.
+
+include::pve-firewall-rules-opts.adoc[]
+Here are some examples:
+
+----
+[RULES]
IN SSH(ACCEPT) -i net0
IN SSH(ACCEPT) -i net0 # a comment
-IN SSH(ACCEPT) -i net0 -source 192.168.2.192 # only allow SSH from 192.168.2.192
+IN SSH(ACCEPT) -i net0 -source 192.168.2.192 # only allow SSH from 192.168.2.192
IN SSH(ACCEPT) -i net0 -source 10.0.0.1-10.0.0.10 # accept SSH for ip range
IN SSH(ACCEPT) -i net0 -source 10.0.0.1,10.0.0.2,10.0.0.3 #accept ssh for ip list
-IN SSH(ACCEPT) -i net0 -source +mynetgroup # accept ssh for ipset mynetgroup
-IN SSH(ACCEPT) -i net0 -source myserveralias #accept ssh for alias myserveralias
+IN SSH(ACCEPT) -i net0 -source +mynetgroup # accept ssh for ipset mynetgroup
+IN SSH(ACCEPT) -i net0 -source myserveralias #accept ssh for alias myserveralias
|IN SSH(ACCEPT) -i net0 # disabled rule
+
+IN DROP # drop all incoming packages
+OUT ACCEPT # accept all outgoing packages
----
Security Groups
213.87.123.0/24
----
+[[ipfilter-section]]
Standard IP set 'ipfilter-net*'
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
NFQUEUE=0
----
+Notes on IPv6
+^^^^^^^^^^^^^
+
+The firewall contains a few IPv6 specific options. One thing to note is that
+IPv6 does not use the ARP protocol anymore, and instead uses NDP (Neighbor
+Discovery Protocol) which works on IP level and thus needs IP addresses to
+succeed. For this purpose link-local addresses derived from the interface's MAC
+address are used. By default the 'NDP' option is enabled on both host and VM
+level to allow neighbor discovery (NDP) packets to be sent and received.
+
+Beside neighbor discovery NDP is also used for a couple of other things, like
+autoconfiguration and advertising routers.
+
+By default VMs are allowed to send out router solicitation messages (to query
+for a router), and to receive router advetisement packets. This allows them to
+use stateless auto configuration. On the other hand VMs cannot advertise
+themselves as routers unless the 'Allow Router Advertisement' (`radv: 1`) option
+is set.
+
+As for the link local addresses required for NDP, there's also an 'IP Filter'
+(`ipfilter: 1`) option which can be enabled which has the same effect as adding
+an `ipfilter-net*` ipset for each of the VM's network interfaces containing the
+corresponding link local addresses. (See the
+<<ipfilter-section,Standard IP set 'ipfilter-net*'>> section for details.)
+
+Avoiding link-local addresses on tap and veth devices
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+With IPv6 enabled by default every interface gets a MAC-derived link local
+address. However, most devices on a typical {pve} setup are connected to a
+bridge and so the bridge is the only interface which really needs one.
+
+To disable a link local address on an interface you can set the interface's
+`disable_ipv6` sysconf variable. Despite the name, this does not prevent IPv6
+traffic from passing through the interface when routing or bridging, so the
+only noticeable effect will be the removal of the link local address.
+
+The easiest method of achieving this setting for all newly started VMs is to
+set it for the `default` interface configuration and enabling it explicitly on
+the interfaces which need it. This is also the case for other settings such as
+`forwarding`, `accept_ra` or `autoconf`.
+
+Here's a possible setup:
+----
+# /etc/sysconf.d/90-ipv6.conf
+
+net.ipv6.conf.default.forwarding = 0
+net.ipv6.conf.default.proxy_ndp = 0
+net.ipv6.conf.default.autoconf = 0
+net.ipv6.conf.default.disable_ipv6 = 1
+net.ipv6.conf.default.accept_ra = 0
+
+net.ipv6.conf.lo.disable_ipv6 = 0
+----
+
+----
+# /etc/network/interfaces
+(...)
+iface vmbr0 inet6 static
+ address fc00::31
+ netmask 16
+ gateway fc00::1
+ accept_ra 0
+ pre-up echo 0 > /proc/sys/net/ipv6/conf/$IFACE/disable_ipv6
+(...)
+----
+
ifdef::manvolnum[]
-include::copyright.adoc[]
-endif::manvolnum[]
+Macro Definitions
+-----------------
+
+include::pve-firewall-macros.adoc[]
+
+
+include::pve-copyright.adoc[]
+
+endif::manvolnum[]
projects / pve-docs.git / blobdiff