pve-firewall: status update error: unable to apply firewall changes

[Afox]

hello,

i get this error every 10 seconds in syslog of Proxmox webinterface. Can you please tell me how to find out what´s wrong?

Thanks in advance,

Afox

 

[Afox]

hello, meanwhile i did this: restarted the node, restarted pve-firewall service, checked host.fw, cluster.fw and all ID.fw of the VMs for typo and consistence. Nothing (yet). I don´t get this..

Is there any way to check which rule could cause the error and get more detailed log?

 

[lukasz.matys]

Hello.
I get the same errors,

Dec 15 11:29:05 cp-node2 pve-firewall[1545]: status update error: unable to apply firewall changes
Dec 15 11:29:15 cp-node2 pve-firewall[1545]: status update error: unable to apply firewall changes
Dec 15 11:29:25 cp-node2 pve-firewall[1545]: status update error: unable to apply firewall changes
Dec 15 11:29:35 cp-node2 pve-firewall[1545]: status update error: unable to apply firewall changes
Dec 15 11:29:45 cp-node2 pve-firewall[1545]: status update error: unable to apply firewall changes
Dec 15 11:29:55 cp-node2 pve-firewall[1545]: status update error: unable to apply firewall changes
Dec 15 11:30:05 cp-node2 pve-firewall[1545]: status update error: unable to apply firewall changes
Dec 15 11:30:15 cp-node2 pve-firewall[1545]: status update error: unable to apply firewall changes
Dec 15 11:30:25 cp-node2 pve-firewall[1545]: status update error: unable to apply firewall changes
Dec 15 11:30:35 cp-node2 pve-firewall[1545]: status update error: unable to apply firewall changes
Dec 15 11:30:45 cp-node2 pve-firewall[1545]: status update error: unable to apply firewall changes
Dec 15 11:30:55 cp-node2 pve-firewall[1545]: status update error: unable to apply firewall changes

Firewall works, but these errors confuse me.
Did anyone solved that problem?

Regards.

 

[Afox]

can you reproduce when this error started? my syslog contains it for more than 7 days so i can´t reproduce the beginning.

Also I am interested if you manually changed iptables somewhere? I did few times but as mentioned above I restarted the Node for clearing.

 

[lukasz.matys]

can you reproduce when this error started? my syslog contains it for more than 7 days so i can´t reproduce the beginning.

Also I am interested if you manually changed iptables somewhere? I did few times but as mentioned above I restarted the Node for clearing.

Of course. Simply enable/disable firewall for the specific node.
After disabling the firewall, the errors disappear.

 

[Afox]

Not for me, my webinterface crashes when disabling the firewall and the only way to login was via ipmi...
the error is still there. currently I use Proxmox 3.4-11

 

[Afox]

still need help on this. how to debug this error?

 

[gauthig]

Same issue here and all I did was enable the firewall for the first time. I also notice that the firewall is not working as I tested by using allow as a default and only setup port 22 to block. I can get to port 22 fine externally.

 

[Afox]

i push this as it still occurs. how to debug??

 

[MSerg]

Check names of Security Groups.
I had names with "-" symbol and same flood in syslog. After rename groups and reapply their on VMs problem was solved.

 

[Afox]

You Sir, just posted the solution! thank you so much!

 

[kristian.kirilov]

Today I upgraded my boxes to the latest version of Proxmox (pve-manager/5.4-5/c6fdb264 (running kernel: 4.15.18-13-pve)) and I got this error:

May  1 11:25:06 proxmox-node-1 pve-firewall[2565]: status update error: unable to apply firewall changes
May  1 11:25:16 proxmox-node-1 pve-firewall[2565]: status update error: unable to apply firewall changes

It is strange that I got this only on one of the nodes, the other node works like a charm. The node which generates these errors, acts as slave node on the cluster.

I tried to disable/enable the firewall, without success. The error still persists.
I also checked the security groups, but there is no security group with - dash character in their names. I have rules with _ in their names if this can be the problem.

So, can somebody help me to resolve this? I can attach any log if it's needed.
Thanks in advance.

 

[spirit]

Maybe

Today I upgraded my boxes to the latest version of Proxmox (pve-manager/5.4-5/c6fdb264 (running kernel: 4.15.18-13-pve)) and I got this error:

May  1 11:25:06 proxmox-node-1 pve-firewall[2565]: status update error: unable to apply firewall changes
May  1 11:25:16 proxmox-node-1 pve-firewall[2565]: status update error: unable to apply firewall changes

It is strange that I got this only on one of the nodes, the other node works like a charm. The node which generates these errors, acts as slave node on the cluster.

I tried to disable/enable the firewall, without success. The error still persists.
I also checked the security groups, but there is no security group with - dash character in their names. I have rules with _ in their names if this can be the problem.

So, can somebody help me to resolve this? I can attach any log if it's needed.
Thanks in advance.

maybe could it be related to new arp filter. can you try to disable ebtables in datacenter options ?

 

[kristian.kirilov]

It seems the error message disappeared
Many thanks spirit

 

[spirit]

ok, we have found a bug with arp filtering and lxc ip address, I think it's related.

I just send a patch
https://pve.proxmox.com/pipermail/pve-devel/2019-May/036801.html

 

[Chris]

https://bugzilla.proxmox.com/show_bug.cgi?id=2193

The patch provided by @spirit fixes the issue.

 

[kristian.kirilov]

Thanks a lot guys.