Re: [RFC firewall/manager/proxmox{,-firewall} 00/13] fix #5759: keep firewall rules up across boot and shutdown

["Thomas Ellmenreich" <t.ellmenreich@proxmox.com>]

The approach seems reasonable to me, especially since it was discussed aready
on the bugzilla: [1].

I tested the patches by first disallowing ICMP on the firewall and then
simply rebooting the node while pinging it at the same time. Without the
patches this lead to short periods during shutdown and startup where the
pings got through. With the patches on the other hand, no single ping
was able to reach the node.

On Tue Jul 21, 2026 at 3:53 PM CEST, Arthur Bied-Charreton wrote:

[snip]

> 1. Boot-time firewall config overrides:
>
> I'm honestly not sure if the .override hack is the right design.
> host.fw.override may drift away from the config after network interface
> pinning changes. This can/will be fixed if we decide to go with this
> approach, but I am not sure how I feel about overwriting a config file
> manually edited by users.

I agree that the configs going out of sync will be an annoying issue for users.
But would creating a UI for this be so much work? Technically, a simple
checkbox indicating which file is being written to would be enough. (Not that
that would be great UX, but it would work). Although, as Arthur mentioned off
list, this would require changing all endpoints.

All of that said I was still questioning whether this feature is even
necessary, but after going through this [1] Bugzilla thread it seems that the
conclusion is that it is necessary.

[snip]

[1]: https://bugzilla.proxmox.com/show_bug.cgi?id=5759

Reviewed-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
Tested-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>