[Feature Req.] LXC Creation option Firewall

[CrazyWolf13]

Hi

I enable the firewall on every LXC, to make sure everything is secure.
In proxmox this is a bit annoying, as the firewall has to be turned on on the interface and on the actual firewall tab, is there a way that the helper scripts could ask for firewall enabling/disabling on interface level?

[Mellowlynx]

As the firewall, then needs to be managed and setup through the datacenter, I did play with this, but decided not to use is, as it's not that friendly in maintaining and special circumstances gave me to match problems.

A reverse proxy (for if you want to allow access from outside) is pretty good, I only like 2 things public and the rest can only be accessed through my VPN or my work's VPN.
My home firewall takes care of the rest.

In other words, the firewall should be before Proxmox, not Proxmox itself.

[remz1337]

I 100% agree, but users (and scripts) should have the option to chose. In my fork, I've added the option when going into advanced configuration during LXC creation. That way you can keep the default (disabled) for all, but can be overidden. This could also be an "environment settings" (user can chose to enable/disable for all LXC creation). I might open a PR with these few proposed improvements and see what the community thinks

[CrazyWolf13]

I definitely also have a firewall before proxmox, but I care about security, so proxmox also has the firewall enabled.

Though this suggestion is for a question during advanced setup if one would like to enable the firewall by the script.

[remz1337]

I've done this in my fork, which I try to keep up to date, if you want to leverage it.

[tteck]

I'd think 95% of Proxmox users do not have firewall rules setup.

[remz1337]

Yes, so do I. Enabling this option without any rules configured won't do anything. I guess this is more a perception issue. Since Proxmox's default configuration has the firewall enabled, new users might be surprised to see it disabled when creating an LXC through these scripts.

[judeibe]

Firewall rules require work to be done right and are not managed solely on the LXC and VM level. I am of the opinion that it would only cause more questions then solving anything. If a user cares for the firewall they should know enough about proxmox go about it themselves.

[remz1337]

Alot of people are getting into proxmox with very minimal technical knowledge (thanks to these scripts I would say) but would still wander why are community scripts not following the default config that Proxmox itself uses.

I really don't care either way, as for 99.99% of the case there won't be any functional impact as to whether it's enabled or not. But I feel this question will soon find a place in our upcoming wiki ;)

[Mellowlynx]

As the name is, Helper-scripts, is a way to get you started, and we can't do everything for everyone.
If someone only wants (or can) to use a specific DNS server for lookups, it's a local infrastructure change.
As we have no idea how your infra is working, so use the 'norm' and you can change it to fit your infra situation.

Yes, we can probably add this question, but I don't think it will help newcomers, they will see it and don't know what it does.
Most likely just check it to turn on, and do nothing more, so no rules are set anyway.

[Mellowlynx]

But we have noted your request and will keep an eye on more requests.

[CrazyWolf13]

@Mellowlynx Thanks for the explaination, I'll close this then, was just some little "very nice to have" "quality of life" improvement suggestion, which would save me probably less than 20 seconds so no problem at all :D