proxmox-mirrors/proxmox-firewall
1
0
Fork 0
mirror of https://git.proxmox.com/git/proxmox-firewall synced 2025-10-04 14:51:33 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

conntrack: arp: move handling to guest chains

Browse Source 
In order to make sure we are only affecting VM traffic and no host
interfaces that are bridged, move the rules into a chain that gets
executed inside the guest chain, rather than setting the rules
globally.

Since ether type matches on the respective Ethernet header, it
doesn't work for packets with VLAN header. Matching via meta protocol
ensures that VLAN encapsulated ARP packets are matched as well.
Otherwise ARP traffic inside VLANs gets dropped, due to them having
conntrack state invalid.

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Stefan Hanreich 2024-07-03 11:17:11 +02:00 committed by Thomas Lamprecht
parent 293a19c213
commit de75183366
3 changed files with 87 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
proxmox-firewall/resources/proxmox-firewall.nft
View File

@ -35,7 +35,9 @@ add chain bridge proxmox-firewall-guests allow-ra-out
add chain bridge proxmox-firewall-guests block-ra-out
add chain bridge proxmox-firewall-guests allow-icmp
add chain bridge proxmox-firewall-guests do-reject
add chain bridge proxmox-firewall-guests pre-vm-out
add chain bridge proxmox-firewall-guests vm-out {type filter hook prerouting priority 0; policy accept;}
add chain bridge proxmox-firewall-guests pre-vm-in
add chain bridge proxmox-firewall-guests vm-in {type filter hook postrouting priority 0; policy accept;}
flush chain inet proxmox-firewall do-reject
@ -68,7 +70,9 @@ flush chain bridge proxmox-firewall-guests allow-ra-out
flush chain bridge proxmox-firewall-guests block-ra-out
flush chain bridge proxmox-firewall-guests allow-icmp
flush chain bridge proxmox-firewall-guests do-reject
flush chain bridge proxmox-firewall-guests pre-vm-out
flush chain bridge proxmox-firewall-guests vm-out
flush chain bridge proxmox-firewall-guests pre-vm-in
flush chain bridge proxmox-firewall-guests vm-in
table inet proxmox-firewall {
@ -311,18 +315,24 @@ table bridge proxmox-firewall-guests {
drop
}
chain pre-vm-out {
meta protocol != arp ct state vmap { established : accept, related : accept, invalid : drop }
}
chain vm-out {
type filter hook prerouting priority 0; policy accept;
jump allow-icmp
ether type != arp ct state vmap { established : accept, related : accept, invalid : drop }
iifname vmap @vm-map-out
}
chain pre-vm-in {
meta protocol != arp ct state vmap { established : accept, related : accept, invalid : drop }
meta protocol arp accept
}
chain vm-in {
type filter hook postrouting priority 0; policy accept;
jump allow-icmp
ether type != arp ct state vmap { established : accept, related : accept, invalid : drop }
ether type arp accept
oifname vmap @vm-map-in
}
}

11
proxmox-firewall/src/firewall.rs
View File

@ -758,7 +758,16 @@ impl Firewall {
let chain = Self::guest_chain(direction, vmid);
commands.append(&mut vec![Add::chain(chain.clone()), Flush::chain(chain)]);
let pre_chain = match direction {
Direction::In => "pre-vm-in",
Direction::Out => "pre-vm-out",
};
commands.append(&mut vec![
Add::chain(chain.clone()),
Flush::chain(chain.clone()),
Add::rule(AddRule::from_statement(chain, Statement::jump(pre_chain))),
]);
Ok(())
}

64
proxmox-firewall/tests/snapshots/integration_tests__firewall.snap
View File

@ -2543,6 +2543,22 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")"
}
}
},
{
"add": {
"rule": {
"family": "bridge",
"table": "proxmox-firewall-guests",
"chain": "guest-100-in",
"expr": [
{
"jump": {
"target": "pre-vm-in"
}
}
]
}
}
},
{
"add": {
"chain": {
@ -2561,6 +2577,22 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")"
}
}
},
{
"add": {
"rule": {
"family": "bridge",
"table": "proxmox-firewall-guests",
"chain": "guest-100-out",
"expr": [
{
"jump": {
"target": "pre-vm-out"
}
}
]
}
}
},
{
"add": {
"set": {
@ -3362,6 +3394,22 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")"
}
}
},
{
"add": {
"rule": {
"family": "bridge",
"table": "proxmox-firewall-guests",
"chain": "guest-101-in",
"expr": [
{
"jump": {
"target": "pre-vm-in"
}
}
]
}
}
},
{
"add": {
"chain": {
@ -3380,6 +3428,22 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")"
}
}
},
{
"add": {
"rule": {
"family": "bridge",
"table": "proxmox-firewall-guests",
"chain": "guest-101-out",
"expr": [
{
"jump": {
"target": "pre-vm-out"
}
}
]
}
}
},
{
"add": {
"set": {