Distributed firewall

The distributed firewall filters the traffic of every virtual machine at its network adapter, on the host where the machine runs. It covers network adapters on host-bridge networks. Rules are stateful by default, and a guest cannot switch the firewall off from inside. Administrators manage the policies of the provider and the defaults, tenants manage the policies of their own virtual machines, and both work on the page Firewall of the console and on the tab Firewall of a virtual machine.

Firewall concepts explains the model: the four categories and their order, default profiles, the modes Off, Monitor and Enforce, and provider and tenant scope.

Tasks

• Open a port opens a port or applies a template on one virtual machine.
• Rules and policies creates policies and rules, orders them and publishes the changes.
• Groups and services collects network adapters and addresses into groups, and ports into named services.
• Effective rules and simulation shows what applies to an adapter and tests a packet against it.
• Default profiles sets what an adapter allows when no rule matches.
• Outbound mail on port 25 explains the block per pool and the switch per virtual machine.
• Rollout to existing virtual machines moves a machine from Off through Monitor to Enforce.
• Statistics and logs reads hit counters and log records.
• Realization checks that every host applied the current rules.
• Emergency bypass suspends the firewall on a host for a limited time.

Concepts and reference

• Tenant isolation describes what provider scope and tenant scope keep apart.
• Firewall on OVN networks lists what is the same and what differs on OVN-backed networks.
• Firewall reference lists fields, actions, categories, profiles and limits.
• Firewall troubleshooting lists symptoms with cause and remedy.
• NSX Policy API describes the subset of the NSX Policy API that Kyvernon serves.

• Firewall conceptsHow the distributed firewall works: enforcement at the network adapter, stateful rules, the four categories, default profiles, modes and scope.
• Default profilesRead and change the default profiles that decide what a network adapter allows when no firewall rule matches, per kind of adapter.
• Open a port on a virtual machineOpen a TCP or UDP port to everyone or to chosen addresses on one virtual machine, or apply a template such as web, from its Firewall tab.
• Rules and policiesCreate firewall policies and rules, set category, sequence and scope, order the rules, review validation issues and publish the changes.
• Groups and servicesCollect adapters, VMs, networks, tags, MAC addresses and address ranges into firewall groups, and ports and source ports into named services.
• Effective rules and packet simulationRead the rules that apply to each network adapter of a virtual machine, in evaluation order with hit counters, and simulate a packet to see what decides.
• Roll out the firewall to existing virtual machinesMove existing virtual machines from firewall mode off to monitor and then enforce, with the monitor report, its proposal and a confirmation timer.
• Outbound mail on port 25How outbound mail on port 25 is blocked per IP pool and unblocked per virtual machine, and where the firewall shows the rule.
• Statistics and logsRead how often each firewall rule matched, turn on logging for a rule, and read the log records of matching packets per host or per virtual machine.
• Check that the hosts apply the firewallRead the realization state of the firewall on each host, the wanted and applied version, preconditions and errors, and what to do when a host lags.
• Emergency bypassOpen every network adapter of one host for a limited time with a reason, to recover from a firewall mistake, and end the bypass again.
• Tenant isolationHow provider scope and tenant scope keep tenants apart in the firewall, what a tenant can change, and what stays with the provider.
• Firewall on OVN networksWhat the distributed firewall does the same way on OVN-backed networks, what differs in behaviour, and what the console shows for them.
• Firewall referenceTables of the distributed firewall: rule and policy fields, actions, directions, categories, profiles, templates, modes, protection states and limits.
• Firewall troubleshootingSymptoms of the distributed firewall, such as a closed port, an unprotected adapter, a pending realization or a refused publish, with cause and remedy.