Incident Published on 22 September 2026 · 1U · PROXMOX

A Proxmox container firewall that does nothing: [OPTIONS] enable: 1 is missing

I had restricted the containers' SSH to my machines and the VPN, and blocked a database port. From another container both could still be reached. On 11 containers the rules were written down and did nothing.

Proxmox VE
Linux / SSH hardening

Symptom

A simple test from another container, trying to open the ports that should have been closed:

timeout 4 bash -c "</dev/tcp/<container>/22" && echo OPEN || echo BLOCKED
# → OPEN, although its .fw only allowed my PC and the VPN

Cause

Comparing a container that did filter with one that didn't, the difference was in the header of the rules file in /etc/pve/firewall/<id>.fw.

A container file with only [RULES] isn't applied, even if the interface has firewall=1 and the cluster firewall is on. It also needs the options section with the firewall enabled for that container.

[OPTIONS]
enable: 1

[RULES]
IN ACCEPT -source <my-pc> -p tcp -dport 22
IN ACCEPT -source <vpn> -p tcp -dport 22

Fix and check

Add the options section on the 11 affected containers and repeat the test from outside: ports that should be closed, closed; what should get through, getting through.

Containers created from code now always include that section, and every firewall change is tested by trying to get through it.