From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id CE8161FF0B3 for ; Fri, 11 Sep 2026 14:26:11 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 4B08121405; Fri, 11 Sep 2026 14:26:08 +0200 (CEST) Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Fri, 11 Sep 2026 14:26:02 +0200 Message-Id: Subject: Re: [RFC firewall/manager/proxmox{,-firewall} 00/13] fix #5759: keep firewall rules up across boot and shutdown From: "Thomas Ellmenreich" To: "Arthur Bied-Charreton" , X-Mailer: aerc 0.20.0 References: <20260721135407.372150-1-a.bied-charreton@proxmox.com> In-Reply-To: <20260721135407.372150-1-a.bied-charreton@proxmox.com> X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1789129551964 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.609 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: O4MU4XX7ISZQE2UYSY3DB7HZWPCDK7CI X-Message-ID-Hash: O4MU4XX7ISZQE2UYSY3DB7HZWPCDK7CI X-MailFrom: t.ellmenreich@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The approach seems reasonable to me, especially since it was discussed area= dy on the bugzilla: [1]. I tested the patches by first disallowing ICMP on the firewall and then simply rebooting the node while pinging it at the same time. Without the patches this lead to short periods during shutdown and startup where the pings got through. With the patches on the other hand, no single ping was able to reach the node. On Tue Jul 21, 2026 at 3:53 PM CEST, Arthur Bied-Charreton wrote: [snip] > 1. Boot-time firewall config overrides: > > I'm honestly not sure if the .override hack is the right design. > host.fw.override may drift away from the config after network interface > pinning changes. This can/will be fixed if we decide to go with this > approach, but I am not sure how I feel about overwriting a config file > manually edited by users. I agree that the configs going out of sync will be an annoying issue for us= ers. But would creating a UI for this be so much work? Technically, a simple checkbox indicating which file is being written to would be enough. (Not th= at that would be great UX, but it would work). Although, as Arthur mentioned o= ff list, this would require changing all endpoints. All of that said I was still questioning whether this feature is even necessary, but after going through this [1] Bugzilla thread it seems that t= he conclusion is that it is necessary. [snip] [1]: https://bugzilla.proxmox.com/show_bug.cgi?id=3D5759 Reviewed-by: Thomas Ellmenreich Tested-by: Thomas Ellmenreich