NAME
pve-firewall - PVE Firewall Daemon
SYNOPSYS
pve-firewall <COMMAND> [ARGS] [OPTIONS]
pve-firewall compile
Compile and print firewall rules. This is useful for testing.
pve-firewall help [<cmd>]
[OPTIONS]
Get help about specified command.
-
<cmd>
string
-
Command name
-
-verbose
boolean
-
Verbose output format.
pve-firewall localnet
Print information about local network.
pve-firewall restart
Restart the Proxmox VE firewall service.
pve-firewall simulate [OPTIONS]
Simulate firewall rules. This does not simulate kernel routing table. Instead, this simply assumes that routing from source zone to destination zone is possible.
-
-dest
string
-
Destination IP address.
-
-dport
integer
-
Destination port.
-
-from
(host|outside|vm\d+|ct\d+|vmbr\d+/\S+)
(default=outside
) -
Source zone.
-
-protocol
(tcp|udp)
(default=tcp
) -
Protocol.
-
-source
string
-
Source IP address.
-
-sport
integer
-
Source port.
-
-to
(host|outside|vm\d+|ct\d+|vmbr\d+/\S+)
(default=host
) -
Destination zone.
-
-verbose
boolean
(default=0
) -
Verbose output.
pve-firewall start [OPTIONS]
Start the Proxmox VE firewall service.
-
-debug
boolean
(default=0
) -
Debug mode - stay in foreground
pve-firewall status
Get firewall status.
pve-firewall stop
Stop firewall. This removes all Proxmox VE related iptable rules. The host is unprotected afterwards.
DESCRIPTION
Proxmox VE Firewall provides an easy way to protect your IT infrastructure. You can setup firewall rules for all hosts inside a cluster, or define rules for virtual machines and containers. Features like firewall macros, security groups, IP sets and aliases helps to make that task easier.
While all configuration is stored on the cluster file system, the iptables based firewall runs on each cluster node, and thus provides full isolation between virtual machines. The distributed nature of this system also provides much higher bandwidth than a central firewall solution.
The firewall has full support for IPv4 and IPv6. IPv6 support is fully transparent, and we filter traffic for both protocols by default. So there is no need to maintain a different set of rules for IPv6.
Zones
The Proxmox VE firewall groups the network into the following logical zones:
- Host
-
Traffic from/to a cluster node
- VM
-
Traffic from/to a specific VM
For each zone, you can define firewall rules for incoming and/or outgoing traffic.
Configuration Files
All firewall related configuration is stored on the proxmox cluster file system. So those files are automatically distributed to all cluster nodes, and the pve-firewall service updates the underlying iptables rules automatically on changes.
You can configure anything using the GUI (i.e. Datacenter → Firewall, or on a Node → Firewall), or you can edit the configuration files directly using your preferred editor.
Firewall configuration files contains sections of key-value pairs. Lines beginning with a # and blank lines are considered comments. Sections starts with a header line containing the section name enclosed in [ and ].
Cluster Wide Setup
The cluster wide firewall configuration is stored at:
/etc/pve/firewall/cluster.fw
The configuration can contain the following sections:
- [OPTIONS]
-
This is used to set cluster wide firewall options.
-
enable
:integer (0 - N)
-
Enable or disable the firewall cluster wide.
-
policy_in
:(ACCEPT | DROP | REJECT)
-
Input policy.
-
policy_out
:(ACCEPT | DROP | REJECT)
-
Output policy.
- [RULES]
-
This sections contains cluster wide firewall rules for all nodes.
- [IPSET <name>]
-
Cluster wide IP set definitions.
- [GROUP <name>]
-
Cluster wide security group definitions.
- [ALIASES]
-
Cluster wide Alias definitions.
Enabling the Firewall
The firewall is completely disabled by default, so you need to set the enable option here:
[OPTIONS]
# enable firewall (cluster wide setting, default is disabled)
enable: 1
|
If you enable the firewall, traffic to all hosts is blocked by default. Only exceptions is WebGUI(8006) and ssh(22) from your local network. |
If you want to administrate your Proxmox VE hosts from remote, you need to create rules to allow traffic from those remote IPs to the web GUI (port 8006). You may also want to allow ssh (port 22), and maybe SPICE (port 3128).
|
Please open a SSH connection to one of your Proxmox VE hosts before enabling the firewall. That way you still have access to the host if something goes wrong . |
To simplify that task, you can instead create an IPSet called management, and add all remote IPs there. This creates all required firewall rules to access the GUI from remote.
Host specific Configuration
Host related configuration is read from:
/etc/pve/nodes/<nodename>/host.fw
This is useful if you want to overwrite rules from cluster.fw config. You can also increase log verbosity, and set netfilter related options. The configuration can contain the following sections:
- [OPTIONS]
-
This is used to set host related firewall options.
-
enable
:boolean
-
Enable host firewall rules.
-
log_level_in
:(alert | crit | debug | emerg | err | info | nolog | notice | warning)
-
Log level for incoming traffic.
-
log_level_out
:(alert | crit | debug | emerg | err | info | nolog | notice | warning)
-
Log level for outgoing traffic.
-
ndp
:boolean
-
Enable NDP.
-
nf_conntrack_max
:integer (32768 - N)
-
Maximum number of tracked connections.
-
nf_conntrack_tcp_timeout_established
:integer (7875 - N)
-
Conntrack established timeout.
-
nosmurfs
:boolean
-
Enable SMURFS filter.
-
smurf_log_level
:(alert | crit | debug | emerg | err | info | nolog | notice | warning)
-
Log level for SMURFS filter.
-
tcp_flags_log_level
:(alert | crit | debug | emerg | err | info | nolog | notice | warning)
-
Log level for illegal tcp flags filter.
-
tcpflags
:boolean
-
Filter illegal combinations of TCP flags.
- [RULES]
-
This sections contains host specific firewall rules.
VM/Container configuration
VM firewall configuration is read from:
/etc/pve/firewall/<VMID>.fw
and contains the following data:
- [OPTIONS]
-
This is used to set VM/Container related firewall options.
-
dhcp
:boolean
-
Enable DHCP.
-
enable
:boolean
-
Enable/disable firewall rules.
-
ipfilter
:boolean
-
Enable default IP filters. This is equivalent to adding an empty ipfilter-net<id> ipset for every interface. Such ipsets implicitly contain sane default restrictions such as restricting IPv6 link local addresses to the one derived from the interface’s MAC address. For containers the configured IP addresses will be implicitly added.
-
log_level_in
:(alert | crit | debug | emerg | err | info | nolog | notice | warning)
-
Log level for incoming traffic.
-
log_level_out
:(alert | crit | debug | emerg | err | info | nolog | notice | warning)
-
Log level for outgoing traffic.
-
macfilter
:boolean
-
Enable/disable MAC address filter.
-
ndp
:boolean
-
Enable NDP.
-
policy_in
:(ACCEPT | DROP | REJECT)
-
Input policy.
-
policy_out
:(ACCEPT | DROP | REJECT)
-
Output policy.
-
radv
:boolean
-
Allow sending Router Advertisement.
- [RULES]
-
This sections contains VM/Container firewall rules.
- [IPSET <name>]
-
IP set definitions.
- [ALIASES]
-
IP Alias definitions.
Enabling the Firewall for VMs and Containers
Each virtual network device has its own firewall enable flag. So you can selectively enable the firewall for each interface. This is required in addition to the general firewall enable option.
The firewall requires a special network device setup, so you need to restart the VM/container after enabling the firewall on a network interface.
Firewall Rules
Firewall rules consists of a direction (IN
or OUT
) and an
action (ACCEPT
, DENY
, REJECT
). You can also specify a macro
name. Macros contain predifined sets of rules and options. Rules can be disabled by prefixing them with |.
[RULES]
DIRECTION ACTION [OPTIONS]
|DIRECTION ACTION [OPTIONS] # disabled rule
DIRECTION MACRO(ACTION) [OPTIONS] # use predefined macro
The following options can be used to refine rule matches.
-
-dest
string
-
Restrict packet destination address. This can refer to a single IP address, an IP set (+ipsetname) or an IP alias definition. You can also specify an address range like 20.34.101.207-201.3.9.99, or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists.
-
-dport
string
-
Restrict TCP/UDP destination port. You can use service names or simple numbers (0-65535), as defined in /etc/services. Port ranges can be specified with \d+:\d+, for example 80:85, and you can use comma separated list to match several ports or ranges.
-
-iface
string
-
Network interface name. You have to use network configuration key names for VMs and containers (net\d+). Host related rules can use arbitrary strings.
-
-proto
string
-
IP protocol. You can use protocol names (tcp/udp) or simple numbers, as defined in /etc/protocols.
-
-source
string
-
Restrict packet source address. This can refer to a single IP address, an IP set (+ipsetname) or an IP alias definition. You can also specify an address range like 20.34.101.207-201.3.9.99, or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists.
-
-sport
string
-
Restrict TCP/UDP source port. You can use service names or simple numbers (0-65535), as defined in /etc/services. Port ranges can be specified with \d+:\d+, for example 80:85, and you can use comma separated list to match several ports or ranges.
Here are some examples:
[RULES]
IN SSH(ACCEPT) -i net0
IN SSH(ACCEPT) -i net0 # a comment
IN SSH(ACCEPT) -i net0 -source 192.168.2.192 # only allow SSH from 192.168.2.192
IN SSH(ACCEPT) -i net0 -source 10.0.0.1-10.0.0.10 # accept SSH for ip range
IN SSH(ACCEPT) -i net0 -source 10.0.0.1,10.0.0.2,10.0.0.3 #accept ssh for ip list
IN SSH(ACCEPT) -i net0 -source +mynetgroup # accept ssh for ipset mynetgroup
IN SSH(ACCEPT) -i net0 -source myserveralias #accept ssh for alias myserveralias
|IN SSH(ACCEPT) -i net0 # disabled rule
IN DROP # drop all incoming packages
OUT ACCEPT # accept all outgoing packages
Security Groups
A security group is a collection of rules, defined at cluster level, which
can be used in all VMs' rules. For example you can define a group named
webserver
with rules to open the http and https ports.
# /etc/pve/firewall/cluster.fw
[group webserver]
IN ACCEPT -p tcp -dport 80
IN ACCEPT -p tcp -dport 443
Then, you can add this group to a VM’s firewall
# /etc/pve/firewall/<VMID>.fw
[RULES]
GROUP webserver
IP Aliases
IP Aliases allow you to associate IP addresses of networks with a name. You can then refer to those names:
-
inside IP set definitions
-
in
source
anddest
properties of firewall rules
Standard IP alias local_network
This alias is automatically defined. Please use the following command to see assigned values:
# pve-firewall localnet
local hostname: example
local IP address: 192.168.2.100
network auto detect: 192.168.0.0/20
using detected local_network: 192.168.0.0/20
The firewall automatically sets up rules to allow everything needed for cluster communication (corosync, API, SSH) using this alias.
The user can overwrite these values in the cluster.fw alias section. If you use a single host on a public network, it is better to explicitly assign the local IP address
# /etc/pve/firewall/cluster.fw
[ALIASES]
local_network 1.2.3.4 # use the single ip address
IP Sets
IP sets can be used to define groups of networks and hosts. You can
refer to them with ‘+name` in the firewall rules’ source
and dest
properties.
The following example allows HTTP traffic from the management
IP
set.
IN HTTP(ACCEPT) -source +management
Standard IP set management
This IP set applies only to host firewalls (not VM firewalls). Those ips are allowed to do normal management tasks (PVE GUI, VNC, SPICE, SSH).
The local cluster network is automatically added to this IP set (alias
cluster_network
), to enable inter-host cluster
communication. (multicast,ssh,…)
# /etc/pve/firewall/cluster.fw
[IPSET management]
192.168.2.10
192.168.2.10/24
Standard IP set blacklist
Traffic from these ips is dropped by every host’s and VM’s firewall.
# /etc/pve/firewall/cluster.fw
[IPSET blacklist]
77.240.159.182
213.87.123.0/24
Standard IP set ipfilter-net*
These filters belong to a VM’s network interface and are mainly used to prevent IP spoofing. If such a set exists for an interface then any outgoing traffic with a source IP not matching its interface’s corresponding ipfilter set will be dropped.
For containers with configured IP addresses these sets, if they exist (or are
activated via the general IP Filter
option in the VM’s firewall’s options
tab), implicitly contain the associated IP addresses.
For both virtual machines and containers they also implicitly contain the standard MAC-derived IPv6 link-local address in order to allow the neighbor discovery protocol to work.
/etc/pve/firewall/<VMID>.fw
[IPSET ipfilter-net0] # only allow specified IPs on net0
192.168.2.10
Services and Commands
The firewall runs two service daemons on each node:
-
pvefw-logger: NFLOG daemon (ulogd replacement).
-
pve-firewall: updates iptables rules
There is also a CLI command named pve-firewall, which can be used to start and stop the firewall service:
# pve-firewall start
# pve-firewall stop
To get the status use:
# pve-firewall status
The above command reads and compiles all firewall rules, so you will see warnings if your firewall configuration contains any errors.
If you want to see the generated iptables rules you can use:
# iptables-save
Tips and Tricks
How to allow FTP
FTP is an old style protocol which uses port 21 and several other dynamic ports. So you need a rule to accept port 21. In addition, you need to load the ip_conntrack_ftp module. So please run:
modprobe ip_conntrack_ftp
and add ip_conntrack_ftp
to /etc/modules (so that it works after a reboot) .
Suricata IPS integration
If you want to use the Suricata IPS (Intrusion Prevention System), it’s possible.
Packets will be forwarded to the IPS only after the firewall ACCEPTed them.
Rejected/Dropped firewall packets don’t go to the IPS.
Install suricata on proxmox host:
# apt-get install suricata
# modprobe nfnetlink_queue
Don’t forget to add nfnetlink_queue
to /etc/modules for next reboot.
Then, enable IPS for a specific VM with:
# /etc/pve/firewall/<VMID>.fw
[OPTIONS]
ips: 1
ips_queues: 0
ips_queues
will bind a specific cpu queue for this VM.
Available queues are defined in
# /etc/default/suricata
NFQUEUE=0
Avoiding link-local addresses on tap and veth devices
With IPv6 enabled by default every interface gets a MAC-derived link local address. However, most devices on a typical Proxmox VE setup are connected to a bridge and so the bridge is the only interface which really needs one.
To disable a link local address on an interface you can set the interface’s
disable_ipv6
sysconf variable. Despite the name, this does not prevent IPv6
traffic from passing through the interface when routing or bridging, so the
only noticeable effect will be the removal of the link local address.
The easiest method of achieving this setting for all newly started VMs is to
set it for the default
interface configuration and enabling it explicitly on
the interfaces which need it. This is also the case for other settings such as
forwarding
, accept_ra
or autoconf
.
Here’s a possible setup:
# /etc/sysconf.d/90-ipv6.conf
net.ipv6.conf.default.forwarding = 0
net.ipv6.conf.default.proxy_ndp = 0
net.ipv6.conf.default.autoconf = 0
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.default.accept_ra = 0
net.ipv6.conf.lo.disable_ipv6 = 0
# /etc/network/interfaces
(...)
# Dual stack:
iface vmbr0 inet static
address 1.2.3.4
netmask 255.255.255.128
gateway 1.2.3.5
iface vmbr0 inet6 static
address fc00::31
netmask 16
gateway fc00::1
accept_ra 0
pre-up echo 0 > /proc/sys/net/ipv6/conf/$IFACE/disable_ipv6
# With IPv6-only 'pre-up' is too early and 'up' is too late.
# Work around this by creating the bridge manually
iface vmbr1 inet manual
pre-up ip link add $IFACE type bridge
up echo 0 > /proc/sys/net/ipv6/conf/$IFACE/disable_ipv6
iface vmbr1 inet6 static
address fc00:b:3::1
netmask 96
bridge_ports none
bridge_stp off
bridge_fd 0
bridge_vlan_aware yes
accept_ra 0
(...)
Notes on IPv6
The firewall contains a few IPv6 specific options. One thing to note is that IPv6 does not use the ARP protocol anymore, and instead uses NDP (Neighbor Discovery Protocol) which works on IP level and thus needs IP addresses to succeed. For this purpose link-local addresses derived from the interface’s MAC address are used. By default the NDP option is enabled on both host and VM level to allow neighbor discovery (NDP) packets to be sent and received.
Beside neighbor discovery NDP is also used for a couple of other things, like autoconfiguration and advertising routers.
By default VMs are allowed to send out router solicitation messages (to query
for a router), and to receive router advetisement packets. This allows them to
use stateless auto configuration. On the other hand VMs cannot advertise
themselves as routers unless the Allow Router Advertisement (radv: 1
) option
is set.
As for the link local addresses required for NDP, there’s also an IP Filter
(ipfilter: 1
) option which can be enabled which has the same effect as adding
an ipfilter-net*
ipset for each of the VM’s network interfaces containing the
corresponding link local addresses. (See the
Standard IP set ipfilter-net* section for details.)
Ports used by Proxmox VE
-
Web interface: 8006
-
VNC Web console: 5900-5999
-
SPICE proxy: 3128
-
sshd (used for cluster actions): 22
-
rpcbind: 111
-
corosync multicast (if you run a cluster): 5404, 5405 UDP
Macro Definitions
Amanda
|
Amanda Backup |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
udp |
10080 |
|
PARAM |
tcp |
10080 |
Auth
|
Auth (identd) traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
113 |
BGP
|
Border Gateway Protocol traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
179 |
BitTorrent
|
BitTorrent traffic for BitTorrent 3.1 and earlier |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
6881:6889 |
|
PARAM |
udp |
6881 |
BitTorrent32
|
BitTorrent traffic for BitTorrent 3.2 and later |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
6881:6999 |
|
PARAM |
udp |
6881 |
CVS
|
Concurrent Versions System pserver traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
2401 |
Ceph
|
Ceph Storage Cluster traffic (Ceph Monitors, OSD & MDS Deamons) |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
6789 |
|
PARAM |
tcp |
6800:7300 |
Citrix
|
Citrix/ICA traffic (ICA, ICA Browser, CGP) |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
1494 |
|
PARAM |
udp |
1604 |
|
PARAM |
tcp |
2598 |
DAAP
|
Digital Audio Access Protocol traffic (iTunes, Rythmbox daemons) |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
3689 |
|
PARAM |
udp |
3689 |
DCC
|
Distributed Checksum Clearinghouse spam filtering mechanism |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
6277 |
DHCPfwd
|
Forwarded DHCP traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
udp |
67:68 |
67:68 |
DHCPv6
|
DHCPv6 traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
udp |
546:547 |
546:547 |
DNS
|
Domain Name System traffic (upd and tcp) |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
udp |
53 |
|
PARAM |
tcp |
53 |
Distcc
|
Distributed Compiler service |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
3632 |
FTP
|
File Transfer Protocol |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
21 |
Finger
|
Finger protocol (RFC 742) |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
79 |
GNUnet
|
GNUnet secure peer-to-peer networking traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
2086 |
|
PARAM |
udp |
2086 |
|
PARAM |
tcp |
1080 |
|
PARAM |
udp |
1080 |
GRE
|
Generic Routing Encapsulation tunneling protocol |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
47 |
Git
|
Git distributed revision control traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
9418 |
HKP
|
OpenPGP HTTP keyserver protocol traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
11371 |
HTTP
|
Hypertext Transfer Protocol (WWW) |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
80 |
HTTPS
|
Hypertext Transfer Protocol (WWW) over SSL |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
443 |
ICPV2
|
Internet Cache Protocol V2 (Squid) traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
udp |
3130 |
ICQ
|
AOL Instant Messenger traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
5190 |
IMAP
|
Internet Message Access Protocol |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
143 |
IMAPS
|
Internet Message Access Protocol over SSL |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
993 |
IPIP
|
IPIP capsulation traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
94 |
IPsec
|
IPsec traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
udp |
500 |
500 |
PARAM |
50 |
IPsecah
|
IPsec authentication (AH) traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
udp |
500 |
500 |
PARAM |
51 |
IPsecnat
|
IPsec traffic and Nat-Traversal |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
udp |
500 |
|
PARAM |
udp |
4500 |
|
PARAM |
50 |
IRC
|
Internet Relay Chat traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
6667 |
Jetdirect
|
HP Jetdirect printing |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
9100 |
L2TP
|
Layer 2 Tunneling Protocol traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
udp |
1701 |
LDAP
|
Lightweight Directory Access Protocol traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
389 |
LDAPS
|
Secure Lightweight Directory Access Protocol traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
636 |
MSNP
|
Microsoft Notification Protocol |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
1863 |
MSSQL
|
Microsoft SQL Server |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
1433 |
Mail
|
Mail traffic (SMTP, SMTPS, Submission) |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
25 |
|
PARAM |
tcp |
465 |
|
PARAM |
tcp |
587 |
Munin
|
Munin networked resource monitoring traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
4949 |
MySQL
|
MySQL server |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
3306 |
NNTP
|
NNTP traffic (Usenet). |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
119 |
NNTPS
|
Encrypted NNTP traffic (Usenet) |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
563 |
NTP
|
Network Time Protocol (ntpd) |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
udp |
123 |
NeighborDiscovery
|
IPv6 neighbor solicitation, neighbor and router advertisement |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
icmpv6 |
router-solicitation |
|
PARAM |
icmpv6 |
router-advertisement |
|
PARAM |
icmpv6 |
neighbor-solicitation |
|
PARAM |
icmpv6 |
neighbor-advertisement |
OSPF
|
OSPF multicast traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
89 |
OpenVPN
|
OpenVPN traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
udp |
1194 |
PCA
|
Symantec PCAnywere (tm) |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
udp |
5632 |
|
PARAM |
tcp |
5631 |
POP3
|
POP3 traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
110 |
POP3S
|
Encrypted POP3 traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
995 |
PPtP
|
Point-to-Point Tunneling Protocol |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
47 |
||
PARAM |
tcp |
1723 |
Ping
|
ICMP echo request |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
icmp |
echo-request |
PostgreSQL
|
PostgreSQL server |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
5432 |
Printer
|
Line Printer protocol printing |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
515 |
RDP
|
Microsoft Remote Desktop Protocol traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
3389 |
RIP
|
Routing Information Protocol (bidirectional) |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
udp |
520 |
RNDC
|
BIND remote management protocol |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
953 |
Razor
|
Razor Antispam System |
Action | proto | dport | sport |
---|---|---|---|
ACCEPT |
tcp |
2703 |
Rdate
|
Remote time retrieval (rdate) |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
37 |
Rsync
|
Rsync server |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
873 |
SANE
|
SANE network scanning |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
6566 |
SMB
|
Microsoft SMB traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
udp |
135,445 |
|
PARAM |
udp |
137:139 |
|
PARAM |
udp |
1024:65535 |
137 |
PARAM |
tcp |
135,139,445 |
SMBswat
|
Samba Web Administration Tool |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
901 |
SMTP
|
Simple Mail Transfer Protocol |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
25 |
SMTPS
|
Encrypted Simple Mail Transfer Protocol |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
465 |
SNMP
|
Simple Network Management Protocol |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
udp |
161:162 |
|
PARAM |
tcp |
161 |
SPAMD
|
Spam Assassin SPAMD traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
783 |
SSH
|
Secure shell traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
22 |
SVN
|
Subversion server (svnserve) |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
3690 |
SixXS
|
SixXS IPv6 Deployment and Tunnel Broker |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
3874 |
|
PARAM |
udp |
3740 |
|
PARAM |
41 |
||
PARAM |
udp |
5072,8374 |
Squid
|
Squid web proxy traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
3128 |
Submission
|
Mail message submission traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
587 |
Syslog
|
Syslog protocol (RFC 5424) traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
udp |
514 |
|
PARAM |
tcp |
514 |
TFTP
|
Trivial File Transfer Protocol traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
udp |
69 |
Telnet
|
Telnet traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
23 |
Telnets
|
Telnet over SSL |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
992 |
Time
|
RFC 868 Time protocol |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
37 |
Trcrt
|
Traceroute (for up to 30 hops) traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
udp |
33434:33524 |
|
PARAM |
icmp |
echo-request |
VNC
|
VNC traffic for VNC display’s 0 - 99 |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
5900:5999 |
VNCL
|
VNC traffic from Vncservers to Vncviewers in listen mode |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
5500 |
Web
|
WWW traffic (HTTP and HTTPS) |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
80 |
|
PARAM |
tcp |
443 |
Webcache
|
Web Cache/Proxy traffic (port 8080) |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
8080 |
Webmin
|
Webmin traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
10000 |
Whois
|
Whois (nicname, RFC 3912) traffic |
Action | proto | dport | sport |
---|---|---|---|
PARAM |
tcp |
43 |
Copyright and Disclaimer
Copyright © 2007-2016 Proxmox Server Solutions GmbH
This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License along with this program. If not, see http://www.gnu.org/licenses/