Network
Provider outbound SMTP controls for customer VMs
Provider Network settings control outbound SMTP from customer virtual machines. Configure them at /infrastructure/network (SMTP tab).
These controls are provider-only. Customers do not see SMTP policy in their firewall UI, VM list, or organization settings. Customer firewall rulesets stay separate: NodeRings does not inject SMTP rules into shared customer rulesets.
What it does
When outbound SMTP is blocked for a VM, the operator ensures Proxmox guest firewall DROP rules for outbound TCP ports 25, 465, and 587. Those rules sit ahead of customer firewall rules so they take effect even if a customer ruleset would otherwise allow the traffic.
| Setting | Meaning |
|---|---|
| Block by default | VMs set to Inherit block outbound SMTP |
| Inherit | Follow the provider default |
| Allow | Outbound SMTP allowed on that VM |
| Block | Outbound SMTP blocked on that VM |
New VMs start as Inherit.
Configure default and per-VM policy
Open Network
Go to /infrastructure/network. Use the SMTP tab.
Set the default
Toggle Block outbound SMTP by default. Confirm the dialog: it applies to all VMs whose action is Inherit. Explicit Allow or Block on a VM is unchanged.
Override individual VMs
In the virtual machine table, VMs are grouped by customer (owner email and user ID). Set Inherit, Allow, or Block per hostname. Search matches hostname, VM ID, or customer email.
After you change a default or per-VM action, NodeRings regenerates the affected ProxmoxVM custom resources. The operator reconciles guest firewall rules on the hypervisor.
How this relates to customer firewalls
| Layer | Owner | Role |
|---|---|---|
| Customer firewall ruleset | Client | Ingress/egress rules they define and attach to VMs |
| Outbound SMTP policy | Provider | Independent DROP on TCP 25/465/587 when blocked |
A single customer ruleset can stay attached to both allow-SMTP and block-SMTP VMs. SMTP enforcement differs per VM via the provider policy, not by cloning or merging rulesets.
If you allow SMTP for a VM (or by default), customers can still restrict egress with their own firewall rules. Provider block is an additional hard stop when enabled.
Troubleshooting
| Symptom | What to check |
|---|---|
| SMTP still works from a blocked VM | Confirm the VM action is Block or Inherit with default block on; wait for operator reconcile; on Proxmox, guest firewall should show DROP out/tcp 25, 465, and 587 |
| SMTP blocked after you set Allow | Confirm the VM action is Allow (not Inherit with default block); check customer ruleset egress does not deny those ports |
| New VM not listed | Refresh the Network SMTP table; only active VMs for your provider org appear |
For agent or operator connectivity issues, see Troubleshooting and Agents.