Good to know the video was helpful It's a very useful firewall to have as you can protect your VMs from other devices in the same network as the main firewall can't do anything about that type of traffic And you don't need to install additional software either :)

Thanks for the feedback and good to know the video was helpful I like to keep learning more about IT, and I'm happy to share what I find

Good to know the video was useful

@@TechTutorialsDavidMcKone Very useful Thank you!, Youve cleared up so many things for me personally.

Early on, some firewalls didn't even have an implicit block rule Then we got some firewalls that log implicit rules and some that don't Then we got a global setting to enable/disable that logging So at some point it just became a common practice to create your own rule at the end as at least you can be sure

Thanks for the feedback Good to know the video was helpful

Good to know the video was helpful It think it's a very useful security tool and it doesn't need additional software installing

Good to know you're finding these videos to be helpful

I think it's a really useful firewall Granted this is all part of Linux, but Proxmox have made it so convenient to centralise your firewall rules

@@TechTutorialsDavidMcKone I installed few months ago Opensense on separated box, then PVE on another machine. I thought the outer firewall would be enough but now I see the second stage: the firewall on PVE. If I understood correctly: the outer firewall does NOT see traffic between VMs because it does not go through it, right? So in this case ONLY PVE firewall can do the job - of course: also firewall on the OS of the VM but that is even deeper and as you said: if the OS is compromised then someone can do bad things, while if the firewall is on PVE then someone shall get access to PVE itself. Am I even going right direction? thank you

@@zyghom That's basically it It's all about layers and to me this firewall, fills a really important gap and it's all open source 😁

Thank you very much

Thanks for the comment and good to know the video was helpful

Thanks for the feedback Good to know the video was useful

Currently OVS has a very low priority for me It is on my project list but at the moment Proxmox doesn't really do anything with it that the Linux Bridge already does There is a Software Defined Network project that's been ongoing for a while for Proxmox but it's still in an experimental phase and I've yet to look into it For now my focus is on automation, management and monitoring

@@TechTutorialsDavidMcKone Thanks for the reply... cheers!

Good to know the video was helpful

Based on observation I found that you can only firewall VMs when you assign rules to the VM itself Any rules you apply to a host just get ignored by the VM Defining security groups at a Data Center level and applying those to a VM certainly helps reduce the admin work And with a bit of automation it could be made easier I suppose It does seem odd to me, but in the grand scheme of things I think it makes security so much easier For me, this firewall is there to restrict VM to VM traffic when it's in the same network, similar to what a software firewall would do on a computer because a dedicated firewall would never see that traffic But I still use a dedicated firewall to restrict traffic between networks

I'm not planning to cover Ceph for some time unfortunately Hard Drives are not cheap these days but my servers will also need a controller and cables So for now I'm just using NFS on TrueNAS The first time someone told me I looked like Mr Mitchel, I was actually in the London area doing work I had no idea who they meant so I had to look it up I can see the resemblance 😀

@@TechTutorialsDavidMcKone cant say I watch Eastenders anymore 😀 thanks again for the videos, really enjoying them

Yes there will be a drop rule lurking in the background Although there are other rules going on that you don't see either I add an explicit rule out of habit as I'm used to firewalls which show a hit counter against every rule you create and that's very useful when you're troubleshooting or just setting up a firewall These ones don't but I like to have a quick way to see if traffic is being dropped so I just do this on all firewalls regardless I also find it easier if I want to alter the logging of dropped traffic According to the documentation, logging of dropped traffic is disabled by default But with user rules it's at your own discretion In some companies, everything is logged and sent off for analysis In others, it's only turned on when troubleshooting, etc So it's another reason I add a drop rule out of habit

An interesting speed, but as long as the video is helpful

@@TechTutorialsDavidMcKone i think it mostly has to do with knowing 90% of what is going to be said i'm looking for that 10% i don't know in most videos. the slow deliberate cadence makes my brain explode waiting on the next word, with playback at 1.5 its much more steady flow on information. i know a lot of guys in the field like this.

Great tutorial as always, can’t help it but think that it would be easier to deploy a robust firewall like pfsense/opnsense on an interface other than mgmt interface and control all access, including management interface through it 🤓

When computers are in the same subnet they talk directly to each other, so a typical firewall appliance would never see that conversation and so can't control it Transparent or Layer 2 firewalls are rarely used because they lack important features So typically Layer 3/4 firewalls like pfSense are deployed to restrict remote computers from accessing the hypervisor and the VMs it runs But it needs either personal firewalls on each VM or a firewall feature like this to restrict traffic between the VMs for instance It's an important security goal to try and restrict hackers who'll try to traverse from one computer to another when a computer is compromised It also can be used to try and stop someone plugging a computer into a local network to try and gain access to the hypervisor or a VM which is extremely useful for areas that can't be physically secured So as shown, I used this firewall to stop a computer accessing a web server in its local network, but allowed the remote computer to still use it as intended The alternative would have been to install UFW in this case but I have VMs that don't have personal firewall software which makes this firewall option extremely useful

Adding the Open vSwitch will certainly help as it brings VXLAN and OpenFlow to the mix