feat: add Firewall management section to Proxmox, including routing and help documentation for enhanced security configuration
This commit is contained in:
@@ -129,6 +129,13 @@
|
||||
<x-ri-restart-line class="size-4" />
|
||||
<span>Boot Settings</span>
|
||||
</button>
|
||||
<button @click="activeSection = 'firewall'"
|
||||
x-show="shouldShowSection('firewall', 'firewall rules allow block port access security', 'firewall rules allow block port access security')"
|
||||
:class="activeSection === 'firewall' ? 'bg-background text-base font-semibold' : 'text-base/70 hover:text-base'"
|
||||
class="w-full text-left px-3 py-2 rounded-md transition-colors flex items-center gap-2">
|
||||
<x-ri-shield-line class="size-4" />
|
||||
<span>Firewall</span>
|
||||
</button>
|
||||
<button @click="activeSection = 'network'"
|
||||
x-show="shouldShowSection('network', 'network ip address mtu gateway routes firewall', 'network ip address mtu gateway routes firewall')"
|
||||
:class="activeSection === 'network' ? 'bg-background text-base font-semibold' : 'text-base/70 hover:text-base'"
|
||||
@@ -1252,6 +1259,169 @@ preserve_hostname: false</code></pre>
|
||||
|
||||
<!-- I'll continue with a few more key sections to show the pattern, then you can see the full implementation -->
|
||||
|
||||
<!-- Firewall Section -->
|
||||
<div x-show="activeSection === 'firewall'" x-transition style="display: none;" data-section-id="firewall">
|
||||
<div class="flex items-center gap-3 mb-4">
|
||||
<div class="flex items-center justify-center w-10 h-10 rounded-lg bg-primary/10">
|
||||
<x-ri-shield-line class="size-5 text-primary" />
|
||||
</div>
|
||||
<h2 class="text-2xl font-bold">Firewall Tab</h2>
|
||||
</div>
|
||||
|
||||
<p class="text-base/80 mb-6">
|
||||
The Firewall tab provides comprehensive firewall management for your virtual machine. You can enable or disable the firewall, create allow and block rules for network traffic, manage aliases for IP addresses and networks, and configure IP sets for advanced rule management.
|
||||
</p>
|
||||
|
||||
<h3 class="text-xl font-semibold mt-6 mb-4 flex items-center gap-2">
|
||||
<x-ri-toggle-line class="size-5 text-base/60" />
|
||||
Firewall Status
|
||||
</h3>
|
||||
<div class="bg-background border border-neutral rounded-md p-4 mb-4">
|
||||
<p class="text-sm text-base/70 mb-3">
|
||||
The firewall can be enabled or disabled using the toggle switch at the top of the Firewall tab. When enabled, all configured firewall rules will be active and enforced. When disabled, all traffic will be allowed by default.
|
||||
</p>
|
||||
<ul class="list-disc list-inside text-sm text-base/70 space-y-1 ml-2">
|
||||
<li><strong>Enabled:</strong> All firewall rules are active and traffic is filtered according to your rules</li>
|
||||
<li><strong>Disabled:</strong> All traffic is allowed, firewall rules are ignored</li>
|
||||
</ul>
|
||||
</div>
|
||||
|
||||
<h3 class="text-xl font-semibold mt-6 mb-4 flex items-center gap-2">
|
||||
<x-ri-list-check class="size-5 text-base/60" />
|
||||
Firewall Rules
|
||||
</h3>
|
||||
<div class="bg-background border border-neutral rounded-md p-4 mb-4">
|
||||
<p class="text-sm text-base/70 mb-3">
|
||||
Firewall rules control which network traffic is allowed or blocked. Rules are processed in order from top to bottom, and the first matching rule determines the action taken.
|
||||
</p>
|
||||
|
||||
<h4 class="text-lg font-semibold mt-4 mb-2">Rule Actions</h4>
|
||||
<table class="w-full border border-neutral rounded-md mb-4">
|
||||
<thead>
|
||||
<tr>
|
||||
<th class="text-left py-2 px-3 font-semibold border-b border-neutral text-sm">Action</th>
|
||||
<th class="text-left py-2 px-3 font-semibold border-b border-neutral text-sm">Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody class="text-sm text-base/70">
|
||||
<tr class="border-b border-neutral/20">
|
||||
<td class="py-2 px-3 font-semibold">ACCEPT</td>
|
||||
<td class="py-2 px-3">Allows the matching traffic to pass through</td>
|
||||
</tr>
|
||||
<tr class="border-b border-neutral/20">
|
||||
<td class="py-2 px-3 font-semibold">REJECT</td>
|
||||
<td class="py-2 px-3">Blocks the traffic and sends a rejection response to the sender</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class="py-2 px-3 font-semibold">DROP</td>
|
||||
<td class="py-2 px-3">Silently blocks the traffic without sending a response</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<h4 class="text-lg font-semibold mt-4 mb-2">Rule Parameters</h4>
|
||||
<ul class="list-disc list-inside text-sm text-base/70 space-y-2 ml-2">
|
||||
<li><strong>Source:</strong> IP address or network (CIDR notation) where traffic originates from (e.g., <code>192.168.1.0/24</code>)</li>
|
||||
<li><strong>Destination:</strong> IP address or network (CIDR notation) where traffic is going to</li>
|
||||
<li><strong>Protocol:</strong> Network protocol (TCP, UDP, ICMP, ICMPv6, or Any)</li>
|
||||
<li><strong>Destination Port:</strong> Port number or range (e.g., <code>80</code>, <code>443</code>, or <code>1000:2000</code>)</li>
|
||||
<li><strong>Source Port:</strong> Source port number or range</li>
|
||||
<li><strong>Interface:</strong> Network interface name (e.g., <code>net0</code>) to apply the rule to</li>
|
||||
<li><strong>Log Level:</strong> Optional logging level for matching traffic (info, warning, error, etc.)</li>
|
||||
<li><strong>Comment:</strong> Optional description for the rule</li>
|
||||
</ul>
|
||||
|
||||
<h4 class="text-lg font-semibold mt-4 mb-2">Rule Order</h4>
|
||||
<p class="text-sm text-base/70 mb-2">
|
||||
Rules are processed in order from top to bottom. The first matching rule determines the action. It's important to place more specific rules before general ones. For example:
|
||||
</p>
|
||||
<ol class="list-decimal list-inside text-sm text-base/70 space-y-1 ml-2">
|
||||
<li>Allow specific IP addresses first</li>
|
||||
<li>Then allow specific port ranges</li>
|
||||
<li>Finally, block or reject all other traffic</li>
|
||||
</ol>
|
||||
</div>
|
||||
|
||||
<h3 class="text-xl font-semibold mt-6 mb-4 flex items-center gap-2">
|
||||
<x-ri-bookmark-line class="size-5 text-base/60" />
|
||||
Aliases
|
||||
</h3>
|
||||
<div class="bg-background border border-neutral rounded-md p-4 mb-4">
|
||||
<p class="text-sm text-base/70 mb-3">
|
||||
Aliases allow you to create named references to IP addresses or networks. This makes firewall rules more readable and easier to maintain. Instead of typing IP addresses repeatedly, you can use an alias name.
|
||||
</p>
|
||||
<p class="text-sm text-base/70 mb-3">
|
||||
<strong>Example:</strong> Create an alias named <code>trusted-network</code> for <code>192.168.1.0/24</code>, then use <code>trusted-network</code> in your firewall rules instead of the full CIDR notation.
|
||||
</p>
|
||||
<ul class="list-disc list-inside text-sm text-base/70 space-y-1 ml-2">
|
||||
<li>Alias names must be unique</li>
|
||||
<li>CIDR notation is required (e.g., <code>192.168.1.0/24</code>)</li>
|
||||
<li>Aliases can be used in firewall rule source and destination fields</li>
|
||||
</ul>
|
||||
</div>
|
||||
|
||||
<h3 class="text-xl font-semibold mt-6 mb-4 flex items-center gap-2">
|
||||
<x-ri-stack-line class="size-5 text-base/60" />
|
||||
IP Sets
|
||||
</h3>
|
||||
<div class="bg-background border border-neutral rounded-md p-4 mb-4">
|
||||
<p class="text-sm text-base/70 mb-3">
|
||||
IP sets are collections of IP addresses or networks that can be referenced in firewall rules. They are useful for managing large lists of IP addresses, such as blocked IPs or allowed IPs for specific services.
|
||||
</p>
|
||||
<p class="text-sm text-base/70 mb-3">
|
||||
<strong>Use Cases:</strong>
|
||||
</p>
|
||||
<ul class="list-disc list-inside text-sm text-base/70 space-y-1 ml-2">
|
||||
<li>Blocking multiple IP addresses from accessing your services</li>
|
||||
<li>Creating allow lists for specific applications</li>
|
||||
<li>Managing IP addresses that change frequently</li>
|
||||
</ul>
|
||||
<p class="text-sm text-base/70 mt-3">
|
||||
<strong>Note:</strong> After creating an IP set, you can add individual IP addresses or networks to it through the API. IP sets can then be referenced in firewall rules using the set name.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<h3 class="text-xl font-semibold mt-6 mb-4 flex items-center gap-2">
|
||||
<x-ri-lightbulb-line class="size-5 text-base/60" />
|
||||
Best Practices
|
||||
</h3>
|
||||
<div class="bg-background border border-neutral rounded-md p-4 mb-4">
|
||||
<ul class="list-disc list-inside text-sm text-base/70 space-y-2 ml-2">
|
||||
<li><strong>Default Deny:</strong> Start with a default deny policy and explicitly allow only necessary traffic</li>
|
||||
<li><strong>Specific Rules First:</strong> Place more specific rules before general ones to ensure correct matching</li>
|
||||
<li><strong>Use Aliases:</strong> Use aliases for frequently referenced networks to improve readability and maintenance</li>
|
||||
<li><strong>Enable Logging:</strong> Enable logging on important rules to monitor traffic and troubleshoot issues</li>
|
||||
<li><strong>Test Rules:</strong> Test new rules carefully to avoid accidentally blocking legitimate traffic</li>
|
||||
<li><strong>Document Rules:</strong> Use comments to document the purpose of each rule</li>
|
||||
<li><strong>Regular Review:</strong> Periodically review and clean up unused rules, aliases, and IP sets</li>
|
||||
</ul>
|
||||
</div>
|
||||
|
||||
<h3 class="text-xl font-semibold mt-6 mb-4 flex items-center gap-2">
|
||||
<x-ri-question-line class="size-5 text-base/60" />
|
||||
Common Scenarios
|
||||
</h3>
|
||||
<div class="bg-background border border-neutral rounded-md p-4 mb-4">
|
||||
<h4 class="text-lg font-semibold mt-2 mb-2">Allow SSH from Specific IP</h4>
|
||||
<pre class="bg-background-secondary p-3 rounded text-xs overflow-x-auto mb-3"><code>Action: ACCEPT
|
||||
Source: 192.168.1.100
|
||||
Protocol: TCP
|
||||
Destination Port: 22
|
||||
Comment: Allow SSH from office</code></pre>
|
||||
|
||||
<h4 class="text-lg font-semibold mt-4 mb-2">Block All Traffic from a Network</h4>
|
||||
<pre class="bg-background-secondary p-3 rounded text-xs overflow-x-auto mb-3"><code>Action: DROP
|
||||
Source: 10.0.0.0/8
|
||||
Comment: Block private network range</code></pre>
|
||||
|
||||
<h4 class="text-lg font-semibold mt-4 mb-2">Allow Web Traffic on Ports 80 and 443</h4>
|
||||
<pre class="bg-background-secondary p-3 rounded text-xs overflow-x-auto mb-3"><code>Action: ACCEPT
|
||||
Protocol: TCP
|
||||
Destination Port: 80,443
|
||||
Comment: Allow HTTP and HTTPS</code></pre>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Network Section with Tables -->
|
||||
<div x-show="activeSection === 'network'" x-transition style="display: none;" data-section-id="network">
|
||||
<div class="flex items-center gap-3 mb-4">
|
||||
|
||||
Reference in New Issue
Block a user