Firewall concepts

Enforcement at the network adapter

The distributed firewall checks traffic at the network adapter of a virtual machine, on the host where the machine runs, in both directions. Inbound is traffic that arrives at the adapter, outbound is traffic that leaves it. Because the check happens on the host and not in the guest, the guest operating system cannot change or bypass it, and traffic between two virtual machines on the same host is checked as well.

The firewall covers network adapters on host-bridge networks that are Open vSwitch bridges with port security on. An adapter on a Linux bridge, on a quarantine bridge, or on a network with port security off cannot be firewalled. The tab Firewall of the virtual machine shows such an adapter with the protection Unprotected and keeps its mode at Off. When the adapter has a public address, the tab also warns that every port is reachable.

Rules are stateful by default. When a connection is allowed in one direction, the replies to it are allowed automatically, so a rule for the reverse direction is not needed. A policy can be made stateless with the switch Stateful. Before any rule is evaluated, the firewall lets through the traffic that a network needs to work: neighbour discovery and DHCP.

Rules, groups and order

A rule names sources, destinations and services, a direction, an action and the adapters it applies to. Empty sources, destinations or services mean any. The actions are Allow (allow), Drop (drop), which discards the packet silently, Reject (reject), which discards it and answers the sender, and Pass (pass), which ends the evaluation of the current category and continues with the next one. Groups collect adapters, virtual machines, networks, tag criteria and addresses, and services collect protocols and ports, so a rule can name them once and keep working when the members change.

Policies are evaluated in four categories, in this order: Emergency, Infrastructure, Environment and Application. Inside a category, policies follow their sequence number, lowest first, and inside a policy the rules follow their position, first to last. The first rule that matches with the action allow, drop or reject decides. When no rule matches, the default profile of the adapter decides. The effective rules of an adapter list every rule that applies to it in exactly this order.

Default profiles and modes

A default profile gives an adapter its default action for each direction, and may add a baseline policy that is evaluated last. An adapter that has a public address starts with public-default: inbound is dropped except SSH and ping, outbound is allowed. An adapter on a private network starts with private-default, which allows both directions. Opening more ports is done with rules, not by changing the profile.

Each adapter has a mode that decides what the rules do:

• Off: traffic is switched as before the firewall existed, and nothing is filtered. Existing adapters start in this mode.
• Monitor: the rules run, packets that would be dropped are counted and reported, and every packet is still forwarded.
• Enforce: packets that no rule allows are dropped or rejected.

The values are off, monitor and enforce. Only a provider administrator changes the mode, and a switch can carry a confirmation timer that restores the previous mode when it is not confirmed.

Provider and tenant scope

Objects belong to a scope: the provider, or one tenant. The categories Emergency and Infrastructure belong to the provider, and the platform keeps its own built-in policies there, for example the block of outbound mail. The categories Environment and Application are open to the provider and to tenants, and a tenant policy applies only to the adapters of that tenant. A tenant never sees or changes the objects of another tenant. Tenant isolation describes the limits in detail.

Related tasks

• Open a port on one virtual machine.
• Rules and policies creates, orders and publishes policies.
• Groups and services defines what rules refer to.
• Default profiles sets the defaults per kind of adapter.
• Rollout to existing virtual machines moves adapters through the modes.
• Firewall on OVN networks lists the differences on OVN-backed networks.