{{-- Page Header --}}

Firewall Management

Configure firewall rules, policies, aliases, and IPSets for your virtual machine

{{-- Error Modal --}} @if($error && $showErrorModal)

Error

{{ $error }}

@endif {{-- Main Firewall Toggle & Status --}}

Master Firewall Control

@if($firewallEnabled) ✓ Active - Your VM is protected by firewall rules @else ⚠ Disabled - Your VM has no firewall protection @endif

@if($firewallEnabled) @else @endif
{{-- Network Adapters - Always Visible --}}

Network Adapters (Per-Device Firewall)

Enable or disable firewall for each network adapter individually

@if(!$firewallEnabled)

Note: Per-adapter firewall settings can be configured here, but the Master Firewall above must be enabled for these settings to take effect.

@endif @if(count($networkAdapters) > 0)
@foreach($networkAdapters as $adapter)
{{ $adapter['name'] }} @if($adapterFirewallStates[$adapter['name']] ?? false) Firewall Active @else Firewall Off @endif
Model: {{ ucfirst($adapter['model'] ?? 'Unknown') }} @if($adapter['mac']) MAC: {{ $adapter['mac'] }} @endif
@if($adapterFirewallStates[$adapter['name']] ?? false) @else @endif
@endforeach
@else

No network adapters found

@endif
{{-- Firewall Policies & Filters --}} @if($firewallEnabled)
{{-- Default Policies Card --}}

Default Policies

Control default traffic behavior

Default action for incoming traffic not matching any rule

Default action for outgoing traffic not matching any rule

{{-- Policy Info Modal --}} @if($showPolicyInfoModal)

Understanding Firewall Policies

How default policies control your network traffic

Policy In (Incoming Traffic)

Controls what happens to traffic coming INTO your VM when it doesn't match any explicit firewall rule.

  • ACCEPT: Allow all incoming traffic by default (permissive, requires explicit DENY rules)
  • REJECT: Block incoming traffic and send rejection notification to sender
  • DROP: Silently discard incoming traffic without notifying sender (recommended)

Policy Out (Outgoing Traffic)

Controls what happens to traffic going OUT of your VM when it doesn't match any explicit firewall rule.

  • ACCEPT: Allow all outgoing traffic by default (recommended for most VMs)
  • REJECT: Block outgoing traffic and notify your VM
  • DROP: Silently discard outgoing traffic

Creating a Whitelist Configuration

To create a strict whitelist (only allow specific traffic):

  1. Set Policy In to DROP
  2. Set Policy Out to DROP (if restricting outbound)
  3. Create explicit ACCEPT rules for allowed traffic
  4. Everything not explicitly allowed will be blocked

Additional Filters

IP Filter: Validates that source/destination IP addresses in packets match the VM's assigned IPs. Helps prevent IP spoofing.

MAC Filter: Validates that MAC addresses match the VM's network adapters. Provides additional layer of security.

@endif {{-- Tabs Navigation --}}
{{-- Tab Contents --}}
{{-- RULES TAB --}}

Firewall Rules

@if(count($rules) > 0)
@foreach($rules as $index => $rule) @endforeach
Pos Action Type Source Destination Protocol Port Status Actions
{{ $rule['pos'] ?? '-' }} @php $actionClass = match($rule['action'] ?? '') { 'ACCEPT' => 'bg-success/20 text-success', 'REJECT' => 'bg-warning/20 text-warning', 'DROP' => 'bg-error/20 text-error', default => 'bg-base/20 text-base/60' }; @endphp {{ $rule['action'] ?? '-' }} {{ strtoupper($rule['type'] ?? 'IN') }}
{{ $rule['source'] ?? '-' }} @php $ruleSourceIP = $rule['source'] ?? ''; @endphp @if($ruleSourceIP && $ruleSourceIP !== '-' && $this->checkIsPublicIP($ruleSourceIP))
{{-- IP Location Modal (same as logs) --}}
@endif
{{ $rule['dest'] ?? '-' }} @php $ruleDestIP = $rule['dest'] ?? ''; @endphp @if($ruleDestIP && $ruleDestIP !== '-' && $this->checkIsPublicIP($ruleDestIP))
{{-- IP Location Modal (same structure) --}}
@endif
{{ $rule['dest'] ?? '-' }} @php $ruleDestIP = $rule['dest'] ?? ''; @endphp @if($ruleDestIP && $ruleDestIP !== '-' && $this->checkIsPublicIP($ruleDestIP))
{{-- IP Location Modal (same structure) --}}
@endif
{{ strtoupper($rule['proto'] ?? ($rule['macro'] ?? 'ANY')) }} {{ $rule['dport'] ?? $rule['sport'] ?? '-' }} @if(isset($rule['enable']) && $rule['enable'] == 0) Disabled @else Enabled @endif
@else

No Firewall Rules

Create your first rule to control network traffic

@endif
{{-- ALIASES TAB --}}

IP Aliases

Create named references to IP addresses or CIDR ranges

@if(count($aliases) > 0)
@foreach($aliases as $alias)
{{ $alias['name'] }}
{{ $alias['cidr'] }}
@if(!empty($alias['comment']))
{{ $alias['comment'] }}
@endif
@endforeach
@else

No IP Aliases

Create aliases to simplify rule management

@endif
{{-- IPSETS TAB --}}

IP Sets

Group multiple IPs/CIDRs for easier rule management

{{-- IPSets List --}}

Available IP Sets

@if(count($ipsets) > 0)
@foreach($ipsets as $ipset)
{{ $ipset['name'] }}
@if(!empty($ipset['comment']))
{{ $ipset['comment'] }}
@endif
@endforeach
@else

No IP Sets created yet

@endif
{{-- IPSet Members --}}
@if($selectedIPSetName)

Members of: {{ $selectedIPSetName }}

@if(count($ipsetMembers) > 0)
@foreach($ipsetMembers as $member)
{{ $member['cidr'] }}
@if(!empty($member['comment']))
{{ $member['comment'] }}
@endif @if(isset($member['nomatch']) && $member['nomatch']) No Match @endif
@endforeach
@else

No members in this IPSet

@endif @else

Select an IP Set to view its members

@endif
{{-- LOGS TAB --}}

Firewall Logs

@if(!empty($logError))

{{ $logError }}

@endif @if(count($firewallLogs) > 0)
@foreach(array_slice(array_reverse($firewallLogs), 0, 50) as $log) @endforeach
Time Action Source Destination Protocol Port
{{ $log['timestamp'] ?? '-' }} {{ $log['action'] ?? '-' }}
{{ $log['source'] ?? '-' }} @php $sourceIP = $log['source'] ?? ''; @endphp @if($sourceIP && $sourceIP !== '-' && $this->checkIsPublicIP($sourceIP))
{{-- IP Location Modal --}}
@endif
{{ $log['destination'] ?? '-' }} @php $destIP = $log['destination'] ?? ''; @endphp @if($destIP && $destIP !== '-' && $this->checkIsPublicIP($destIP))
{{-- IP Location Modal --}}
@endif
{{ $log['protocol'] ?? '-' }} {{ $log['destination_port'] ?? '-' }}
@if(count($firewallLogs) > 50)
Showing latest 50 of {{ count($firewallLogs) }} log entries (most recent first)
@endif @else

No Firewall Logs

Logs will appear here when the firewall blocks or allows traffic

@endif
@else

Firewall is Disabled

Enable the firewall to start protecting your virtual machine

@endif {{-- Rule Form Modal --}} @if($showRuleForm)

{{ $editingRuleIndex !== null ? 'Edit' : 'Create' }} Firewall Rule

{{-- Action --}}
{{-- Type --}}
{{-- Macro --}}

Select a macro or leave as "None" for custom rules

{{-- Interface --}}
{{-- Source --}}

Can use alias names or leave empty for any source

{{-- Destination --}}
{{-- Protocol --}}
{{-- Destination Port --}}
{{-- Source Port --}}
{{-- Log Level --}}
{{-- Comment --}}
{{-- Enable --}}
@endif {{-- Delete Rule Modal --}} @if($showDeleteRuleModal && $deletingRuleIndex !== null && isset($rules[$deletingRuleIndex])) @php $ruleToDelete = $rules[$deletingRuleIndex]; @endphp

Delete Firewall Rule

Are you sure you want to delete this rule? This action cannot be undone.

Action: {{ $ruleToDelete['action'] ?? '-' }}
Source: {{ $ruleToDelete['source'] ?? 'Any' }}
Destination: {{ $ruleToDelete['dest'] ?? 'Any' }}
@endif {{-- Alias Form Modal --}} @if($showAliasForm)

{{ $editingAliasName ? 'Edit' : 'Create' }} IP Alias

@error('aliasName') {{ $message }} @enderror
@error('aliasCidr') {{ $message }} @enderror
@endif {{-- Delete Alias Modal --}} @if($showDeleteAliasModal && $deletingAliasName)

Delete IP Alias

Delete alias "{{ $deletingAliasName }}"?

This may affect firewall rules using this alias.

@endif {{-- IPSet Form Modal --}} @if($showIPSetForm)

Create IP Set

@error('ipsetName') {{ $message }} @enderror

After creating the IPSet, you can add IP addresses and CIDR ranges to it.

@endif {{-- Delete IPSet Modal --}} @if($showDeleteIPSetModal && $deletingIPSetName)

Delete IP Set

Delete IPSet "{{ $deletingIPSetName }}"?

All members will be removed and rules using this IPSet may be affected.

@endif {{-- IPSet Member Form Modal --}} @if($showIPSetMemberForm && $selectedIPSetName)

Add IP/CIDR to {{ $selectedIPSetName }}

@error('memberCidr') {{ $message }} @enderror
@endif {{-- Delete IPSet Member Modal --}} @if($showDeleteIPSetMemberModal && $deletingMemberCidr)

Remove Member

Remove "{{ $deletingMemberCidr }}" from {{ $selectedIPSetName }}?

@endif
@script @endscript