Firewall
Rulesets, address groups, and VM firewall binding
Manage guest firewall rules at /organization/firewall.
NodeRings pushes rules to the Proxmox VM firewall on the provider side through the operator. You define policy in NodeRings; the provider's hypervisor enforces it on your VM.
Tabs
| Tab | Purpose |
|---|---|
| Firewall | Rulesets (ordered rules: allow/deny, ports, sources) |
| Address group | Named IP/CIDR groups referenced in rules |
| Virtual machine | Bind rulesets to specific VMs |
URL shortcuts: ?t=address-group, ?t=virtual-machine.
Typical workflow
Create address groups (optional)
Define groups such as office-egress or monitoring with CIDRs you reuse across rules.
Create a ruleset
Add rules top-to-bottom (first match wins). Specify direction, protocol, ports, and source/destination (including address groups).
Attach to VMs
Virtual machine tab → select VMs → attach the ruleset. New VMs can be attached after provision from the same tab or VM settings.
A restrictive ruleset can block SSH (22) or ICMP. If you lose access, detach or widen the ruleset from NodeRings, or open a support ticket.
Ruleset detail
Open a ruleset at /organization/firewall/{id} to edit individual rules, reorder them, or delete the ruleset.