# Managed by ansible proxmox-hardening role — do not edit by hand
# Proxmox datacenter-level firewall (Stage 1: single-node management access only)
# Stage 2 (Corosync/Ceph cluster) rules remain commented until needed.

[OPTIONS]
enable: 1
policy_in: DROP
policy_out: ACCEPT

[IPSET mgmt]
# Management subnet — SSH and web UI access only from here
{{ proxmox_mgmt_cidr }}

[RULES]
# Allow SSH from management network
IN ACCEPT -source +mgmt -p tcp --dport 22 -log nolog
# Allow PVE web UI from management network
IN ACCEPT -source +mgmt -p tcp --dport 8006 -log nolog
# Allow SPICE console from management network
IN ACCEPT -source +mgmt -p tcp --dport 3128 -log nolog

# Stage 2 — Corosync (uncomment when clustering pve1 with additional nodes)
# IN ACCEPT -source +mgmt -p udp --dport 5404:5405 -log nolog

# Stage 2 — Ceph (uncomment when Ceph OSD replication is active)
# IN ACCEPT -source +mgmt -p tcp --dport 6800:7568 -log nolog