Block outgoing DHCP from Bridge vmbr0

T

Tim Weyand

Member
Proxmox Subscriber
Feb 19, 2018
4
0
21
43
Hi,
maybe someone in this Forum can help me.
  • On each Proxmox Server there should be an local DHCP Server for the Virtual Machines.
    • The DHCP registers the VMs to the DNS (ddns entry)
  • The Local-Private-Network Spans over all Proxmox Machines (currently 8 Proxmox Machines)
    • 10.0.0.0/14
    • Every Server has an IP Range within this Network
      • Datacenter 1 - Server 1: 10.0.0.0/22
      • Datacenter 1 - Server 2: 10.0.4.0/22
      • ...
      • ...
      • Datacenter 2 - Server 1: 10.1.0.0/22
      • ...
Everything I try does not seem to work.
  • Using an Bridge vmbr0 with a Bonding to eth0
    • Adding IPtables on eth0 does not do anything (udp 67&68 IN&Out)
  • Using an Bridge vmbr0 and giving it the same IP Adress as eth0
    • I am getting only Error Logs: "IPv4: martian source 10.0.0.1 from 10.1.0.1, on dev eth0"
  • Seperating the Network and working with routes
    • Does not seem to work at all :-/
Has anyone an Tipp/Idea what I am doing wrong - or an direction how I can accomplish that the DHCP requests stay local on the pve machine?

-edit
/etc/pve/firewall/cluster.fw
[group dhcp_block]

OUT REJECT -p udp -sport 67
OUT REJECT -p udp -sport 68
IN REJECT -p udp -sport 68
IN REJECT -p udp -sport 67
OUT REJECT -p udp -dport 67
OUT REJECT -p udp -dport 68
IN REJECT -p udp -dport 68
IN REJECT -p udp -dport 67
Click to expand...

Im Datacenter I have the group rule Above - the Group Rule is bound on the Interface on the Server. In the Datacenter I allow Incoming and Outgoing Traffic from the local Network Ranges. Could this be the Error?

Thanks and Best,
Tim
 
Last edited:
You must log in or register to reply here.
Top Bottom