After a try , ipset created with PVE UI cannot be managed with ipset direcly.
ipset created with PVE UI can be updated with CLI pvesh create /cluster/firewall/ipset/my-pve-ipset-name --cidr x.x.x.x/y but too slow if many lines.
editing cluster.fw...
Note that there may be additional systemd-timers, which are not visible in the classic crontab context. Run systemctl list-timers -a instead.
You also did not mention user-specific crontabs, editable by everybody by crontab -e - including one...
Try to get a temporary DHCP lease like this and share the output. The first command gets a lease and the second restores the original configuration again.
# For PVE 8 / Debian 12
ifdown vmbr0; dhclient -v
dhclient -r; ifup vmbr0
# For PVE 9 /...
From my point of view it is not best practice to connect a PVE cluster directly to the outer internet. There should always exist a router with filtering capabilities. In that picture the router would do Geo blocking, beside other things. My...
Edit : UdoB link is less complicated.
I use this script https://github.com/mkorthof/ipset-country on a host
customize the code to keep ipdeny.com download/update and ipset generation/update
Remove firewall/rules parts
Then use the "ipset"...
Just hit a bug with Realtek on PVE , 10 MB/s download speed from LAN while 110MB/s download speed from WAN IP (NAT rule on router).
Try disable offloading : ethtool -K enp1s0 gso off gro off tso off
( Credits to Gemini for my case because was...
Further testing has confirmed that the issue recurs after applying this update…
Reinstalling the package with a specific version resolves the issue.
I wonder if they'll release a fix...
apt list --upgradable
libpve-common-perl/stable 9.1.9...
Nice catch.
Reproduced here : i440fx doesn't boot with ISO Windows 10 build 1904x.6456 (the EoL build)
on a PVE 8.4.16 EPYC 2th Gen host and a PVE 9.1 i5 6th Gen host , vCPU type isn't relevant.
EDIT : Only reproduced with the updated iso , with...
if device is not mounted, backups are written to / filesystem.
umount and delete backups if they exist in the mount point.
use chattr +i /mnt/.../proxback to prevent its usage when mount is missing.
Thanks for the tips ! But I won't be using it, changing all the containers and VM network configuration will be to much work and change in our infrastructure (~250 containers and VM on ~8 proxmox server). It is much easier to modify the proxmox...
One small thing to know (same as almost all vGPU/SR-IOV setups): the physical HDMI/DP ports cant be used in the VM's. You’ll access the VMs via Parsec, Moonlight, Looking Glass, or RDP/SPICE. The VMs themselves still see a full normal GPU inside...
Proxmox VE, with its default vmbr0 Linux bridge, acts like a hardware switch, it does not manage guests network configuration.
But you can block ipv6 with PVE Firewall. Enable it in each guest and each guests nic.
Then set NDP to "No" in each guest.
The root cause is the Proxmox firewall service (pve-firewall). When it starts, it sets net.ipv6.conf.all.forwarding=1 globally because VMs and containers need IPv6 packet forwarding to work. This happens even if the firewall is technically...