[pve-devel] [RFC firewall/manager/network/proxmox{-ve-rs, -firewall} 00/15] add forward chain firewalling for hosts and bridges

[Stefan Hanreich <s.hanreich@proxmox.com>]

## Introduction

This patch series introduces a new direction for firewall rules: forward.
Additionally this patch series introduces defining firewall rules on a vnet
level.

## Use Cases

For hosts:
* hosts utilizing NAT can define firewall rules for NATed traffic
* hosts utilizing EVPN zones can define rules for exit node traffic
* hosts acting as gateway can firewall the traffic that passes through them

For vnets:
* can create firewall rules globally without having to attach/update security
  groups to every newly created VM

This patch series is particularly useful when combined with my other current RFC
'autogenerate ipsets for sdn objects'. It enables users to quickly define rules
like:

on the host level:
* only SNAT HTTP traffic from hosts in this vnet to a specific host
* restricting traffic routed from hosts in one vnet to another vnet

on the vnet level:
* only allow DHCP/DNS traffic inside a bridge to the gateway

Not only does this streamline creating firewall rules, it also enables users to
create firewall rules that haven't been possible before and needed to rely on
external firewall appliances.

Since forwarded traffic goes *both* ways, you generally have to create two rules
in case of bi-directional traffic. It might make sense to simplify this in the
future by adding an additional option to the firewall config scheme that
specifies that rules in the other direction should also get automatically
generated.

## Usage

For creating forward rules on the cluster/host level, you simply create a new
rule with the new 'forward' direction. It uses the existing configuration files.

For creating them on a vnet level, there are new firewall configuration files
located under '/etc/pve/sdn/firewall/<vnet>.fw'. It utilizes the same
configuration format as the existing firewall configuration files. You can only
define rules with direction 'forward' on a vnet-level.

proxmox-ve-rs:

Stefan Hanreich (4):
  cargo: bump dependencies
  firewall: add forward direction
  firewall: add bridge firewall config parser
  host: add struct representing bridge names

 proxmox-ve-config/Cargo.toml                 |  5 +-
 proxmox-ve-config/src/firewall/bridge.rs     | 59 ++++++++++++++++++++
 proxmox-ve-config/src/firewall/cluster.rs    | 10 ++++
 proxmox-ve-config/src/firewall/guest.rs      | 15 +++++
 proxmox-ve-config/src/firewall/host.rs       |  4 ++
 proxmox-ve-config/src/firewall/mod.rs        |  1 +
 proxmox-ve-config/src/firewall/types/rule.rs | 10 +++-
 proxmox-ve-config/src/host/mod.rs            |  1 +
 proxmox-ve-config/src/host/types.rs          | 46 +++++++++++++++
 9 files changed, 147 insertions(+), 4 deletions(-)
 create mode 100644 proxmox-ve-config/src/firewall/bridge.rs
 create mode 100644 proxmox-ve-config/src/host/types.rs


proxmox-firewall:

Stefan Hanreich (4):
  sdn: add support for loading vnet-level firewall config
  sdn: create forward firewall rules
  use std::mem::take over drain()
  cargo: bump dependencies

 Cargo.toml                                    |  3 +
 proxmox-firewall/Cargo.toml                   |  2 +-
 .../resources/proxmox-firewall.nft            | 54 +++++++++++
 proxmox-firewall/src/config.rs                | 88 ++++++++++++++++-
 proxmox-firewall/src/firewall.rs              | 97 ++++++++++++++++++-
 proxmox-firewall/src/rule.rs                  |  7 +-
 proxmox-firewall/tests/integration_tests.rs   | 12 +++
 .../integration_tests__firewall.snap          | 86 ++++++++++++++++
 proxmox-nftables/Cargo.toml                   |  2 +-
 proxmox-nftables/src/expression.rs            |  8 ++
 proxmox-nftables/src/types.rs                 |  6 ++
 11 files changed, 355 insertions(+), 10 deletions(-)


pve-firewall:

Stefan Hanreich (2):
  sdn: add vnet firewall configuration
  api: add vnet endpoints

 src/PVE/API2/Firewall/Makefile |   1 +
 src/PVE/API2/Firewall/Rules.pm |  71 ++++++++++++++
 src/PVE/API2/Firewall/Vnet.pm  | 166 +++++++++++++++++++++++++++++++++
 src/PVE/Firewall.pm            | 124 +++++++++++++++++++++++-
 src/PVE/Firewall/Helpers.pm    |  12 +++
 5 files changed, 369 insertions(+), 5 deletions(-)
 create mode 100644 src/PVE/API2/Firewall/Vnet.pm


pve-manager:

Stefan Hanreich (4):
  firewall: add forward direction to rule panel
  firewall: add vnet to firewall options component
  firewall: make base_url dynamically configurable in options component
  sdn: add firewall panel

 www/manager6/Makefile                |  2 +
 www/manager6/dc/Config.js            |  9 ++++
 www/manager6/dc/SecurityGroups.js    |  1 +
 www/manager6/grid/FirewallOptions.js | 72 +++++++++++++++++++++-----
 www/manager6/grid/FirewallRules.js   | 32 ++++++++++--
 www/manager6/lxc/Config.js           |  1 +
 www/manager6/node/Config.js          |  1 +
 www/manager6/qemu/Config.js          |  1 +
 www/manager6/sdn/FirewallPanel.js    | 48 +++++++++++++++++
 www/manager6/sdn/FirewallVnetView.js | 77 ++++++++++++++++++++++++++++
 10 files changed, 226 insertions(+), 18 deletions(-)
 create mode 100644 www/manager6/sdn/FirewallPanel.js
 create mode 100644 www/manager6/sdn/FirewallVnetView.js


pve-network:

Stefan Hanreich (1):
  firewall: add endpoints for vnet-level firewall

 src/PVE/API2/Network/SDN/Vnets.pm | 6 ++++++
 1 file changed, 6 insertions(+)


Summary over all repositories:
  36 files changed, 1103 insertions(+), 37 deletions(-)

-- 
Generated by git-murpp 0.6.0

_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel