Shorewall and Proxmox VE Cluster Configuration

This is a follow up article describing how to use Proxmox VE and Shorewall together. This article focus on using Shorewall within your Proxmox cluster. If you have not read the first article I recommend that you do so, it will aid your understanding with what is going in this one.

Network Layout and Shorewall Configuration

We are going to be using a bridging configuration. This is what Proxmox VE uses with by default. Bridging allows for easy migration of hosts without having to re-configure the firewall each time a machine is migrated.

Proxmox VE does not come with a firewall by default there are several solutions to this problem but the most flexible and robust is integrating the Shorewall firewall. This document assumes a basic knowledge of the Shorewall program and will not cover all of Shorewall capabilities but will give you a good working model to get you started. For more advanced topics check out the Shorewall documentation.

Shorewall will have 3 zones: 1) the fw zone which is the Proxmox host, 2) the net zone which is the Internet and 3) the dmz zone which is where the virtual machines will reside. The hardware just has one network interface card; vmbr0 is a just a bridge interface.

Intro
Proxmox VE version 1.1 does not ship with a firewall. This is a bad thing for a production server for obvious reasons. Proxmox VE 2.0 is supposed to ship with firewall support built in. Until that time here is an easy script that you can put on your Proxmox VE box to protect it and the virtual machines running on it, if you so choose. This is based off of http://wiki.openvz.org/Setting_up_an_iptables_firewall but works with KVM machines and tailored to a Proxmox install.

Installation and Usage

I sent this to the centos-virt mailing list today... and thought I'd share it here as well.

Greetings,

I'm a big OpenVZ fanboy. I've sent a few emails on this list that proves that... and I'm sure I've annoyed some people... but be that as it may... I would like to draw everyone on this list's attention to Proxmox VE. What is Proxmox VE?

OpenVZ and KVM are Linux based virtualization programs, both are part of the Proxmox VE distribution. The goal of this article is to provide some knowledge on moving physical machines to virtual containers (OpenVZ) or fully virtualized machines (KVM). This article is not specific to Proxmox VE and the principles outlined and scripts provided should work on "stock" KVM or OpenVZ machines with a few minor changes to path settings.