global.conf

############################################
#
#	Global firewall configuration
#
############################################

# Trusted Networks and hosts
TRUSTNETS='10.228.3.1/32 194.199.227.0/24'

# PVE Peers, all required protocols are enabled between nodes
PROXMOX_PEERS='192.168.1.2 192.168.1.3'

# This node IP address
PROXMOX_ADDR='192.168.1.15'

# Uncomment this to allow routed Virtual Machines
#IP_FORWARD=1

# Uncomment this to allow logging
#LOG_INVALID_PACKETS=1

##################################
#	Scanning prevention
##################################
#
# Uncomment HYPERVISOR_BLOCK_XMAS_SCAN to block XMAS Scan technique on the hypervisor
# Uncomment HYPERVISOR_BLOCK_NULL_SCAN to block NULL Scan technique on the hypervisor
# Uncomment HYPERVISOR_BLOCK_FIN_SCAN to block FIN Scan technique on the hypervisor
#
# Uncomment BRIDGED_VM_BLOCK_XMAS_SCAN to block XMAS Scan technique
#	on the bridged virtual machines
# Uncomment BRIDGED_VM_BLOCK_NULL_SCAN to block NULL Scan technique
#	on the bridged virtual machines

# Uncomment BRIDGED_VM_BLOCK_FIN_SCAN to block FIN Scan technique
#	on the bridged virtual machines

#HYPERVISOR_BLOCK_XMAS_SCAN=1
#HYPERVISOR_BLOCK_NULL_SCAN=1
#HYPERVISOR_BLOCK_FIN_SCAN=1

#BRIDGED_VM_BLOCK_XMAS_SCAN=1
#BRIDGED_VM_BLOCK_NULL_SCAN=1
#BRIDGED_VM_BLOCK_FIN_SCAN=1

#####################################
#	STRICT TCP SYN 
#####################################
#
# uncomment HYPERVISOR_STRICT_SYN to drop NEW connexions without SYN flag on the hypervisor
# uncomment BRIDGED_VM_STRICT_SYN to drop NEW connexions
#	without SYN flag on the bridged virtual machines
#

#HYPERVISOR_STRICT_SYN=1

#BRIDGED_VM_STRICT_SYN=1

#####################################
#	IPTABLES user chains names
#####################################
# Iptables User Chain names
#COMMON_VM_CHAIN='common_vm_newin'
#VM_CHAIN='vm_newin'
#PROXMOX_CHAIN='proxmox_newin'
#LOGDROP_CHAIN='log_drop'

######################################
#	path to iptables executable
######################################

#IPTABLES='/sbin/iptables'