pve-firewall log: "value does not look like a valid IP address or CIDR network"

[markus7220]

Hello,

above error currently pollutes my machine's log with 24 log entries every 10 seconds. These are all shown via journalctl, MyNode > System > System log and pve-firewall:

root@pve:~# pve-firewall status
value does not look like a valid IP address or CIDR network
...
value does not look like a valid IP address or CIDR network
Status: enabled/running

There is no hint in the log line, what the actual mal-formatted entry is. There also is no error indicator for firewall/ipset entries in web interface. Having had a first manual glance at all rules/ipsets/aliases, I could not find an obvious format mistake (like non-fitting CIDR IP).

What is weird: I always entered firewall rules, IP sets, and aliases via Promox web interface, never manually edited files on terminal, so no idea, how this could have been caused.

PVEv9 with iptables/pve-firewall is used.
(There was a hint, that proxmox-firewall/nftables might deliver more details, but IIRC that's currently experimental and not used as default. )

How can this error be debugged and traced further, as apparently not providing additional information?

Thanks in advance

 

[abied-charreton]

Hello, which pve-firewall version do you currently run? (pveversion -v)?

Also, do you have any ipfilter-* IPSets with alias members defined in some guest firewall configs?

 

[markus7220]

Appreciate the quick answer @abied-charreton.

root@pve:~# pveversion -v
proxmox-ve: 9.2.0
...
proxmox-firewall: 1.2.3
...
pve-firewall: 6.0.6

Also, do you have any ipfilter-* IPSets with alias members defined in some guest firewall configs?

Do you mean those values under [VM ID] > Firewall > IPSet > ipfilter-net0 ?
Yes, multiple VMs have an alias dc/xxx declared for IP spoofing protection - is that wrong or not supported?

 

[abied-charreton]

Okay, thanks for confirming. This is a supported configuration, however there is a bug in how pve-firewall builds the ARP filter from those IPSets. Alias members are not resolved, which aborts the generation of all ebtables rules for the guest.

The rules have already been missing before, but the error was not logged; pve-firewall 6.0.6 started logging it with this commit [0], which is why the messages only started appearing recently.

I sent a fix already [1]. Until it is released, you can work around this bug by replacing all alias members in the ipfilter-netX IPSets with the actual IP addresses. You can verify the result with ebtables -L.

Thanks a lot for reporting this!!

[0] https://git.proxmox.com/?p=pve-fire...e;hp=0644089430cd7feac0c1058cc82188db7b661173
[1] https://lore.proxmox.com/pve-devel/20261012093956.285433-1-a.bied-charreton@proxmox.com/T/#t

 

[markus7220]

Ah, that's interesting.
Out of interest: The bug must have been introduced at some point in v9, right? As latest v8 + ipfilter-netX worked fine for me.
I can live with those logs, till your fix gets released, so that I do not need to re-configure aliases.
Thank you very much!

 

[abied-charreton]

No, this has been around since this functionality was introduced in 2019, PVE 8 just did not log it.

Just to be clear: the IP filter itself still works, since it is generated via a different code path, the guests cannot send IP packets from addresses outside their ipfilter IPSet. What is missing are the layer 2 rules, mainly the ARP filter. The log messages are just another symptom that was introduced with pve-firewall 6.0.6.

I would still recommend applying the workaround until the fix is released if you rely on the ARP filter.