From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 825B51FF166 for ; Wed, 11 Sep 2024 11:32:25 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 54EA1A253; Wed, 11 Sep 2024 11:31:53 +0200 (CEST) From: Stefan Hanreich To: pve-devel@lists.proxmox.com Date: Wed, 11 Sep 2024 11:31:01 +0200 Message-Id: <20240911093116.112960-1-s.hanreich@proxmox.com> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.271 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [rules.pm, types.rs, firewall.pm, expression.rs, helpers.pm, rule.rs, bridge.rs, host.rs, cluster.rs, firewall.rs, vnets.pm, mod.rs, config.rs, guest.rs, vnet.pm] Subject: [pve-devel] [RFC firewall/manager/network/proxmox{-ve-rs, -firewall} 00/15] add forward chain firewalling for hosts and bridges X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" ## Introduction This patch series introduces a new direction for firewall rules: forward. Additionally this patch series introduces defining firewall rules on a vnet level. ## Use Cases For hosts: * hosts utilizing NAT can define firewall rules for NATed traffic * hosts utilizing EVPN zones can define rules for exit node traffic * hosts acting as gateway can firewall the traffic that passes through them For vnets: * can create firewall rules globally without having to attach/update security groups to every newly created VM This patch series is particularly useful when combined with my other current RFC 'autogenerate ipsets for sdn objects'. It enables users to quickly define rules like: on the host level: * only SNAT HTTP traffic from hosts in this vnet to a specific host * restricting traffic routed from hosts in one vnet to another vnet on the vnet level: * only allow DHCP/DNS traffic inside a bridge to the gateway Not only does this streamline creating firewall rules, it also enables users to create firewall rules that haven't been possible before and needed to rely on external firewall appliances. Since forwarded traffic goes *both* ways, you generally have to create two rules in case of bi-directional traffic. It might make sense to simplify this in the future by adding an additional option to the firewall config scheme that specifies that rules in the other direction should also get automatically generated. ## Usage For creating forward rules on the cluster/host level, you simply create a new rule with the new 'forward' direction. It uses the existing configuration files. For creating them on a vnet level, there are new firewall configuration files located under '/etc/pve/sdn/firewall/.fw'. It utilizes the same configuration format as the existing firewall configuration files. You can only define rules with direction 'forward' on a vnet-level. proxmox-ve-rs: Stefan Hanreich (4): cargo: bump dependencies firewall: add forward direction firewall: add bridge firewall config parser host: add struct representing bridge names proxmox-ve-config/Cargo.toml | 5 +- proxmox-ve-config/src/firewall/bridge.rs | 59 ++++++++++++++++++++ proxmox-ve-config/src/firewall/cluster.rs | 10 ++++ proxmox-ve-config/src/firewall/guest.rs | 15 +++++ proxmox-ve-config/src/firewall/host.rs | 4 ++ proxmox-ve-config/src/firewall/mod.rs | 1 + proxmox-ve-config/src/firewall/types/rule.rs | 10 +++- proxmox-ve-config/src/host/mod.rs | 1 + proxmox-ve-config/src/host/types.rs | 46 +++++++++++++++ 9 files changed, 147 insertions(+), 4 deletions(-) create mode 100644 proxmox-ve-config/src/firewall/bridge.rs create mode 100644 proxmox-ve-config/src/host/types.rs proxmox-firewall: Stefan Hanreich (4): sdn: add support for loading vnet-level firewall config sdn: create forward firewall rules use std::mem::take over drain() cargo: bump dependencies Cargo.toml | 3 + proxmox-firewall/Cargo.toml | 2 +- .../resources/proxmox-firewall.nft | 54 +++++++++++ proxmox-firewall/src/config.rs | 88 ++++++++++++++++- proxmox-firewall/src/firewall.rs | 97 ++++++++++++++++++- proxmox-firewall/src/rule.rs | 7 +- proxmox-firewall/tests/integration_tests.rs | 12 +++ .../integration_tests__firewall.snap | 86 ++++++++++++++++ proxmox-nftables/Cargo.toml | 2 +- proxmox-nftables/src/expression.rs | 8 ++ proxmox-nftables/src/types.rs | 6 ++ 11 files changed, 355 insertions(+), 10 deletions(-) pve-firewall: Stefan Hanreich (2): sdn: add vnet firewall configuration api: add vnet endpoints src/PVE/API2/Firewall/Makefile | 1 + src/PVE/API2/Firewall/Rules.pm | 71 ++++++++++++++ src/PVE/API2/Firewall/Vnet.pm | 166 +++++++++++++++++++++++++++++++++ src/PVE/Firewall.pm | 124 +++++++++++++++++++++++- src/PVE/Firewall/Helpers.pm | 12 +++ 5 files changed, 369 insertions(+), 5 deletions(-) create mode 100644 src/PVE/API2/Firewall/Vnet.pm pve-manager: Stefan Hanreich (4): firewall: add forward direction to rule panel firewall: add vnet to firewall options component firewall: make base_url dynamically configurable in options component sdn: add firewall panel www/manager6/Makefile | 2 + www/manager6/dc/Config.js | 9 ++++ www/manager6/dc/SecurityGroups.js | 1 + www/manager6/grid/FirewallOptions.js | 72 +++++++++++++++++++++----- www/manager6/grid/FirewallRules.js | 32 ++++++++++-- www/manager6/lxc/Config.js | 1 + www/manager6/node/Config.js | 1 + www/manager6/qemu/Config.js | 1 + www/manager6/sdn/FirewallPanel.js | 48 +++++++++++++++++ www/manager6/sdn/FirewallVnetView.js | 77 ++++++++++++++++++++++++++++ 10 files changed, 226 insertions(+), 18 deletions(-) create mode 100644 www/manager6/sdn/FirewallPanel.js create mode 100644 www/manager6/sdn/FirewallVnetView.js pve-network: Stefan Hanreich (1): firewall: add endpoints for vnet-level firewall src/PVE/API2/Network/SDN/Vnets.pm | 6 ++++++ 1 file changed, 6 insertions(+) Summary over all repositories: 36 files changed, 1103 insertions(+), 37 deletions(-) -- Generated by git-murpp 0.6.0 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel