Chapter 8. The Proxmox Firewall

The Proxmox VE firewall is a security feature that allows easy and effective protection of a virtual environment for both internal and external network traffic. By leveraging this firewall, we can protect VMs, host nodes, or the entire cluster by creating firewall rules. By creating rules at the virtual machine level, we can provide total isolation for VMs to VM network traffic, including VMs to external traffic. Prior to the Proxmox VE firewall, security and isolation was not possible at the hypervisor level. In this chapter, we will cover the following topics of the Proxmox VE firewall:

• Exploring the Proxmox VE firewall

• Configuring the cluster firewall rules

• Configuring the host firewall rules

• Configuring the VM firewall rules

• Integrating a Suricata IPS

• Enabling the IPv6 firewall

• Firewall CLI commands

Exploring the Proxmox VE firewall

The Proxmox VE firewall leverages iptables of each Proxmox node for protection. Iptables is an application that allows you to manage rules tables for the Linux kernel firewall. All firewall rules and configurations are stored in the Proxmox cluster filesystem, thus allowing a distributed firewall system in the Proxmox cluster. The pre-firewall service provided by Proxmox of each node reads the rules and configurations from the cluster filesystem and automatically adjusts the local iptables. Rules can be fully created and maintained by the Proxmox GUI or CLI. The Proxmox firewall can be used in place of a virtualized firewall in the cluster.

Note

Although the Proxmox firewall provides excellent protection, it is highly recommended that you have a physical firewall for the entire network. This firewall is also known as an edge firewall since it sits at the main entry point of the Internet. The Internet connection should not be directly connected to Proxmox nodes...

Configuring the Datacenter-specific firewall

As mentioned earlier, Datacenter-specific firewall rules affect all resources, such as cluster, nodes, and virtual machines. Any rules created in this zone are cascaded to both hosts and VMs. This zone is also used to fully lock down a cluster to drop all incoming traffic and then only open what is required. In a freshly installed Proxmox cluster, the Datacenter-wide firewall option is disabled.

Note

CAUTION! Attention must be given to this section to prevent full cluster lock out.

Configuring the Datacenter firewall through the GUI

The following screenshot shows the firewall option for the Datacenter zone through the Options tab by navigating to Datacenter | Firewall | Options:

As we can see, in the preceding screenshot, the Proxmox firewall for the Datacenter zone is disabled by default, with Input Policy set to Drop and Output Policy set to Accept. If we did enable this firewall option right now, then all inbound access would be denied. You would...

Configuring a host-specific firewall

Any rules created in the host zone only apply to the node itself where the rule is created and the VMs are in that host node. Rules for one node do not get replicated to the other nodes although the rule files are stored in the Proxmox cluster filesystem. There are no options to create IPSet or Security Groups in the host zone. We can only create firewall rules. The following screenshot shows the Firewall feature for the host node pm4-1 in our example cluster:

Creating host firewall rules

The process of creating new rules for the Host zone is identical to the rule creation process that we have already discussed in the Configuring a datacenter-specific firewall section earlier in this chapter. Besides creating rules from scratch, we can also assign predefined rules in the form of a Security Group to a node. We cannot create a new Security Group under the host firewall menu, but we can assign it some predefined rules. For example, earlier in this chapter...

Configuring a VM-specific firewall

Rules created for a VM only apply to that particular virtual machine. Even when the virtual machine is moved to a different node, the firewall follows the VM throughout the cluster. There are no rules cascading from this zone. Under the VM firewall feature, we can create Rules, Aliases, and IPSets, but we cannot create any security group. The firewall management is the same for both the KVM virtual machines and LXC containers. We can go to the firewall feature of a VM by navigating to the VM | Firewall tab menu. The following screenshot shows the firewall feature of our example VM #112:

Creating VM firewall rules

The process of creating new rules for a VM is identical to the rule creation process that we have already seen in the Configuring the Datacenter firewall through the CLI section earlier in this chapter. Besides creating rules from scratch, we can also assign predefined rules in the form of a Security Group to a VM. The preceding screenshot shows...

Integrating a Suricata IDS/IPS

The security protection of the Proxmox VE firewall can be further enhanced by configuring an intrusion detection and prevention system such as Suricata. It is a high-performing IDS/IPS engine that is able to protect a virtual machine by rejecting traffic that are possible intrusions. Currently, Snort and Suricata are two open source main stream IDS/IPS available among a few others. One of the primary advantages of Suricata is that it is multithreaded, whereas Snort is single-threaded. Suricata is under rapid deployment and gaining popularity fast in the security community.

By default, Suricata is not installed on a Proxmox node, it needs to be manually installed and configured. As for Proxmox VE 4.1, Suricata can only be used to protect a virtual machine, not any Proxmox host nodes.

Note

Do not try to manually download the Suricata package from any other source other than the Proxmox repository and install it on the Proxmox node. It may break the system. Always...

Summary

In this chapter, we learned about one of the most powerful features of Proxmox, the built-in firewall. We learned what it is and how to implement it to protect the entire cluster, Proxmox host nodes, and virtual machines. We learned how to manage the firewall rules and configuration using both the GUI and CLI. Proxmox adds security where it is needed the most. By leveraging a flexible and granular firewall protection at a hypervisor level, we are now able to have a better, secured cluster.

In the next chapter, we are going to learn about the Proxmox High Availability feature for VMs, which has been completely redesigned from the ground up. The new changes have brought higher stability while making management and configuration a much simpler task.