We are getting into virtualization with a Proxmox VE (OpenVZ + KVM) server. Our plan for firewall is to have CSF (http://configserver.com/cp/csf.html) running on the host machine as we've had a reasonable good experience with it in the past.

Apart from that we plan simple firewall rules on the VM machines (mostly OpenVZ containers with same kernel) and maybe fail2ban simple specific rules.

I would appreciate comments with anyone with similar experiences?

I understand all traffic comes via the host machine so a combined firewall there with specific firewalling on the VM should work, alltough some iptables rules are hard to get to work on OpenVZ containers.


My advice is to perform the following on the hardware node:

  1. If your HN has two interfaces, configure them both as bridges (in my case I have vmbr0 and vmbr1)
  2. In the csf.conf, configure your ETH_DEVICE as "vmbr+"
  3. Create a file called csfpost.sh in /etc/csf/ that simply allows forwarding:

  4. Now your HN is protected on all interfaces, but will transparently pass traffic to and from your containers.

  5. Configure your containers with CSF to keep them protected.

Make sure the modules needed for CSF are available to your VE's by placing the following in your /etc/vz/vz.conf:

 IPTABLES="iptable_filter iptable_mangle ipt_limit ipt_multiport ipt_tos ipt_TOS ipt_REJECT ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_LOG ipt_length ip_conntrack ip_conntrack_ftp ip_conntrack_irc ipt_conntrack ipt_state ipt_helper iptable_nat ip_nat_ftp ip_nat_irc ipt_REDIRECT"  

Also make sure that your value for "numiptent" value is around 256 or higher, the default or 128 will cause CSF to half-load on your VE's (see /proc/user_bean_counters to see if you're hitting the numiptent limit)

I've also added the above netfilter modules to my /etc/modules (1 per line). I'm not entirely sure if this is necessary. Hope this helps!

  • Thanks for the detailed reply. I might consider it but having CSF installed on all VMs seems to me just too much overhead in our case and my initial intention was simple firewall rules and maybe a fail2ban on those just for repeated http violations. – luison Feb 10 '11 at 12:38
  • Not sure where you mean or how to set numiptent but I don't think I am having issues with that but just with certain processes running on the VMs that the host seems to find excessive. As for the rest, your suggestions worked great, thanks. – luison Mar 2 '11 at 16:13
  • You know, you could vote the post up too :) – Squeeb May 8 '11 at 1:19

You don't need fail2ban if you are using CSF. CSF comes with LFD, which does everything that fail2ban does (and more!). I don't see any problems that would occur from the setup that you are proposing, though I would suggest minimal firewall rules on the host to prevent any sort of overhead there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.