projects / pve-firewall.git / blame
| Commit | Line | Data |
|---|---|---|
| ec6b1100 | 1 | # Example VM firewall configuration |
| 41b6fef1 | 2 | |
| 7e8b8ae7 AD |
3 | # VM specific firewall options |
| 4 | [OPTIONS] | |
| 41b6fef1 DM |
5 | |
| 6 | # disable/enable the whole thing | |
| 7 | enable: 1 | |
| 8 | ||
| 9 | # disable/enable MAC address filter | |
| 10 | macfilter: 0 | |
| 11 | ||
| 12 | # default policy | |
| 72f63fde DM |
13 | policy_in: DROP |
| 14 | policy_out: REJECT | |
| 41b6fef1 | 15 | |
| 178a63be DM |
16 | # log dropped incoming connection |
| 17 | log_level_in: info | |
| 18 | ||
| 19 | # disable log for outgoing connections | |
| 20 | log_level_out: nolog | |
| 21 | ||
| 41b6fef1 DM |
22 | # enable DHCP |
| 23 | dhcp: 1 | |
| 24 | ||
| b47ecc88 AD |
25 | # enable ips |
| 26 | ips: 1 | |
| 27 | ||
| 28 | # specify nfqueue queues (optionnal) | |
| 29 | #ips_queues: 0 | |
| 30 | ips_queues: 0:3 | |
| 31 | ||
| ec6b1100 | 32 | |
| 92e976b3 | 33 | [RULES] |
| ec6b1100 | 34 | |
| 92e976b3 | 35 | #TYPE ACTION IFACE SOURCE DEST PROTO D-PORT S-PORT |
| 41b6fef1 | 36 | |
| 92e976b3 DM |
37 | IN SSH(ACCEPT) net0 |
| 38 | IN SSH(ACCEPT) net0 # a comment | |
| 39 | IN SSH(ACCEPT) net0 192.168.2.192 # only allow SSH from 192.168.2.192 | |
| ba791b1f AD |
40 | IN SSH(ACCEPT) net0 10.0.0.1-10.0.0.10 #accept SSH for ip in range 10.0.0.1 to 10.0.0.10 |
| 41 | IN SSH(ACCEPT) net0 10.0.0.1,10.0.0.2,10.0.0.3 #accept ssh for 10.0.0.1 or 10.0.0.2 or 10.0.0.3 | |
| 42 | IN SSH(ACCEPT) net0 +mynetgroup #accept ssh for netgroup mynetgroup | |
| 44be8ceb | 43 | IN SSH(ACCEPT) net0 myserveralias #accept ssh for alias myserveralias |
| ba791b1f | 44 | |
| 92e976b3 | 45 | |IN SSH(ACCEPT) net0 # disabled rule |
| ec6b1100 | 46 | |
| 92e976b3 DM |
47 | # add a security group |
| 48 | GROUP group1 net0 | |
| ec6b1100 | 49 | |
| 92e976b3 DM |
50 | OUT DNS(ACCEPT) net0 |
| 51 | OUT Ping(ACCEPT) net0 | |
| 52 | OUT SSH(ACCEPT) | |
| ec6b1100 DM |
53 | |
| 54 | ||
| 55 |