Proxmox VE 8 - Unable to edit a VM firewall rule if "source" is a IP address.

[wmr]

Hi,

with pve 8.0.3 I am able to create a new firewall rule which uses a IP address as source via the web interface but I am unable to change such a rule.
I can only delete and re-create it with changed values.

The error message is:

Parameter verification failed. (400)
source: invalid ipset name '+undefined/undefined'

Which is as far as correct as there is no ipset given.

The simplest example is to create such a rule (Direction: in, Action: ACCEPT, source: IP address, Enabled: checked) as enabled an then trying to disable it.

It looks like the parameter verification lost the check for IP adresses somehow form VE 7 to VE 8.

The cluster is updated form VE 6 to 7 and now to 8, if that is of any interest.

Regards, Ralf

 

[patrick7]

Looks like firewall is broken in v8, might be related to

• https://forum.proxmox.com/threads/pve-8-pve-firewall-status-no-such-alias.130202/
• https://forum.proxmox.com/threads/ipset-not-working-for-accepting-cluster-traffic.129599/

 

[mikefnasr]

Looks like firewall is broken in v8, might be related to

• https://forum.proxmox.com/threads/pve-8-pve-firewall-status-no-such-alias.130202/
• https://forum.proxmox.com/threads/ipset-not-working-for-accepting-cluster-traffic.129599/

Hello

What do you mean by firewall is broken in v8?

 

[nsc117]

the same issus

 

[Neobin]

For reference:
https://bugzilla.proxmox.com/show_bug.cgi?id=4963

 

[theRealNo]

Has this been patched ? I'm on 8.1.4, I have the error:

Parameter verification failed. (400)

source: invalid ipset name '+undefined/undefined'

 

[thiagotgc]

Still having the same problem in PVE 8.1.3

 

[radvincula]

Hello.

To resolve this problem, navigate to Datacenter > Firewall > Alias

Then, create a named alias for your IP address.




Afterwards, edit your firewall rule, and in the source field, you will see a list of aliases that you previously added in the Datacenter > Firewall > Alias section.





I believe Proxmox should allow both types of information, either a fixed IP or an alias, since it already permits defining network addresses without the need to create aliases.