0

I've just got a powerful dedicated server, and I'd like to virtualize it. The idea is to install Proxmox VE on the host and then create a VM for each use: one for my website, one for mi Git repo, and so on.

I just began fiddling around with iptables, and I have to admit I'm having a bad time. I composed a tiny script:

#!/bin/bash

# Empty any existing rule
iptables -F
iptables -t nat -F
iptables -t mangle -F

# Remove personnal chains
iptables -X
iptables -t nat -X
iptables -t mangle -X

# Enable ESTABLISHED and RELATED communications, accepts answers
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Enable ping
iptables -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p icmp -m limit --limit 5/s -j ACCEPT

# Enable remote acccess through SSH
iptables -A INPUT -p TCP --dport ssh -j ACCEPT
iptables -A INPUT -p TCP --dport http -j ACCEPT

# ACCEPT DNS
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT

# Web output (HTTP & HTTPS)
iptables -I INPUT -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -p tcp --dport 443 -j ACCEPT

# Open ports for proxmox input
iptables -I INPUT -p tcp --dport 8006 -j ACCEPT
iptables -I INPUT -p tcp --dport 5900 -j ACCEPT
iptables -I INPUT -p tcp --dport 5999 -j ACCEPT
iptables -I INPUT -p tcp --dport 3128 -j ACCEPT

# Default to DROP
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

Here, no flux routing yet. My aim is, first, to open all the ports needed for proxmox to work correctly on a safe environment.

Once that script's executed, I can display proxmox's Web UI (8006), but cannot log. Proxmox says "Login failed, please try again". When all the rules are flushed away ,everything works fine.

Can someone help?

4

You should have a rule to accept everything on the loopback device so internal communication is not blocked by iptables.

iptables -I INPUT -i lo -j ACCEPT
iptables -I OUTPUT -o lo -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.