Utah Tech Logo

IT3300

DevOps virtualization

Proxmox 4 — VLANs and Virtual Firewall

Overview

In this project, you will configure a segmented virtual network using VLANs and the Proxmox firewall.

Your Proxmox environment is already connected to a physical network that provides two VLANs for this course:

VLAN IPv4 Network IPv6 Network
321 10.160.x.y/16 2001:1948:E10:2271::/64
322 10.170.x.y/16 2001:1948:E10:2272::/64

The x octet from above can be viewed on this page. You can choose whatever address you want for the y octet.

You will use these existing VLANs to create a small virtual network consisting of a server and a client.

The primary goal of this project is to understand the relationship between virtual networking, VLANs, and firewall rules.

You will configure the network, establish a baseline, implement a security policy, test the policy, and troubleshoot a deliberately incorrect configuration.

Scenario

You are a systems administrator responsible for a company’s virtual infrastructure.

The company has two networks:

A web server is located on the Server Network (you can use a pokemon instance), while employee workstations are located on the Client Network.

The security administrator has established the following requirements:

  1. Clients must be able to access the web server using HTTP.
  2. Clients must be able to access the web server using HTTPS.
  3. Clients must not be able to SSH into the web server.
  4. Clients must not be able to access other unnecessary services on the web server.
  5. The server should not be allowed to initiate arbitrary connections to clients.
  6. The firewall should follow the principle of least privilege.

Your job is to implement and demonstrate this security policy using Proxmox.

Learning Objectives

By completing this project, you should be able to:

  1. Configure virtual machines to use VLANs in Proxmox.
  2. Explain the relationship between VLANs and IP subnets.
  3. Test network connectivity between virtual machines.
  4. Configure firewall rules in Proxmox.
  5. Apply firewall rules at the appropriate level.
  6. Use network testing tools to verify firewall behavior.
  7. Troubleshoot VLAN and firewall configuration problems.
  8. Explain how firewall rules implement a security policy.

Part 1 — Configure the Server

Create or use a virtual machine to act as your Web Server (pokemon).

Connect the VM to VLAN 321.

Configure the appropriate IPv4 network settings using an address from your assigned VLAN 321 network.

Verify

From inside the server, verify:

You should be able to access the web server from an appropriate network.

Part 2 — Configure the Client

Create or use a second virtual machine to act as the Client.

Connect the VM to VLAN 322.

Configure the appropriate IPv4 network settings using an address from your assigned VLAN 322 network.

Verify

From the client, verify:

Document the network configuration of both machines.

Your environment should now resemble:

                    Proxmox
                       |
              +--------+--------+
              |                 |
           VLAN 321          VLAN 322
        Server Network     Client Network
              |                 |
         Web Server           Client
       10.160.x.x           10.170.x.x

Part 3 — Establish a Baseline

Before configuring the firewall, determine what communication is currently possible between the client and server.

From the Client VM, test the Server VM using several different types of traffic.

At minimum, test:

You may use additional network testing tools if appropriate.

Create a table documenting your results.

Test Protocol Port Result
Ping Server ICMP —  
HTTP TCP 80  
HTTPS TCP 443  
SSH TCP 22  

For each test, explain whether the connection succeeded or failed.

This establishes your baseline before firewall rules are applied.

Part 4 — Implement the Security Policy

Configure the Proxmox firewall to enforce the company’s security requirements.

The required policy is:

Client → Server

Traffic Requirement
HTTP Allow
HTTPS Allow
SSH Deny
Other unnecessary TCP services Deny

Server → Client

The server should not be able to initiate arbitrary connections to the client.

You must determine how to implement these requirements using Proxmox firewall rules.

Important

Do not simply create rules that make the required tests pass.

Your configuration should implement the stated security policy.

You should be able to explain why each rule exists.

Part 5 — Test the Firewall

Repeat the tests from Part 3 after implementing your firewall configuration.

Complete the following table:

Test Protocol Port Expected Actual
Ping Server ICMP —    
HTTP TCP 80 Allow  
HTTPS TCP 443 Allow  
SSH TCP 22 Deny  
Other TCP service TCP — Deny  

Investigate any difference between the expected and actual results.

Questions

  1. Which connections were allowed?
  2. Which connections were blocked?
  3. How do you know that the firewall caused the connection to be blocked?
  4. How did you verify that HTTP and HTTPS were still available?
  5. What happens when you attempt to connect to a port for which no firewall rule exists?
  6. What is the purpose of your default firewall policy?

Part 6 — Investigate Firewall Rule Scope

Proxmox provides multiple levels at which firewall configuration can be applied.

Investigate the difference between firewall configuration at the:

Answer the following:

  1. What is the purpose of each level?
  2. At which level did you implement your rules?
  3. Why did you choose that level?
  4. What would happen if you placed the rule at the Datacenter level instead?
  5. What would happen if you placed the rule at the VM level?

Your answer should demonstrate that you understand where the firewall policy is being applied, not simply where you clicked to create the rule.

Final Demonstration

During your project demonstration, you should be prepared to show:

  1. Your Server VM.
  2. Your Client VM.
  3. The VLAN configuration of each VM.
  4. The IP configuration of each VM.
  5. Your Proxmox firewall configuration.
  6. Evidence that HTTP/HTTPS access is allowed.
  7. Evidence that unauthorized traffic is blocked.
  8. Your troubleshooting results.

You should also be able to explain your configuration without simply reading your firewall rules.

Your instructor may ask you to modify a firewall rule or test an additional connection.

Submission Requirements

Submit a document containing:

Screenshots should be used as evidence, not as a substitute for explanations.