Block outgoing DHCP from Bridge vmbr0

[Tim Weyand]

Hi,
maybe someone in this Forum can help me.

• On each Proxmox Server there should be an local DHCP Server for the Virtual Machines.
  • The DHCP registers the VMs to the DNS (ddns entry)
• The Local-Private-Network Spans over all Proxmox Machines (currently 8 Proxmox Machines)
  • 10.0.0.0/14
  • Every Server has an IP Range within this Network
    • Datacenter 1 - Server 1: 10.0.0.0/22
    • Datacenter 1 - Server 2: 10.0.4.0/22
    • ...
    • ...
    • Datacenter 2 - Server 1: 10.1.0.0/22
    • ...

Everything I try does not seem to work.

• Using an Bridge vmbr0 with a Bonding to eth0
  • Adding IPtables on eth0 does not do anything (udp 67&68 IN&Out)
• Using an Bridge vmbr0 and giving it the same IP Adress as eth0
  • I am getting only Error Logs: "IPv4: martian source 10.0.0.1 from 10.1.0.1, on dev eth0"
• Seperating the Network and working with routes
  • Does not seem to work at all :-/

Has anyone an Tipp/Idea what I am doing wrong - or an direction how I can accomplish that the DHCP requests stay local on the pve machine?

-edit

/etc/pve/firewall/cluster.fw
[group dhcp_block]

OUT REJECT -p udp -sport 67
OUT REJECT -p udp -sport 68
IN REJECT -p udp -sport 68
IN REJECT -p udp -sport 67
OUT REJECT -p udp -dport 67
OUT REJECT -p udp -dport 68
IN REJECT -p udp -dport 68
IN REJECT -p udp -dport 67

Im Datacenter I have the group rule Above - the Group Rule is bound on the Interface on the Server. In the Datacenter I allow Incoming and Outgoing Traffic from the local Network Ranges. Could this be the Error?

Thanks and Best,
Tim

 

[Tim Weyand]

Ok - scheinbar lässt sich DHCP nicht mit iptables abfangen :-/

https://lists.netfilter.org/pipermail/netfilter/2002-May/023826.html

Nun habe ich noch weniger Einfälle, wie ich das Szenario lösen könnte.

 

[Richard]

Ok - scheinbar lässt sich DHCP nicht mit iptables abfangen :-/

https://lists.netfilter.org/pipermail/netfilter/2002-May/023826.html

Nun habe ich noch weniger Einfälle, wie ich das Szenario lösen könnte.

Maybe (means: not tested yet) ebtables is the solution: avoid that DHCP requests leave the host.