Can´t access to Proxmox web console using port 443

pbernardino · Apr 16, 2024

Add some problems with Tailscale blocked by my ISP.
And change some things on IPTABLES.
Then forgot and removed Tailscale cause its forbidden the use of VPN by my ISP.
So I used the Proxmox Wiki to install and configure a nginx reverse proxy to use 443 port.
iI had it running ok on my local network them gone change things again on IPTABLES and now can only access by port 443 (https) on a VM installed on my pve node and can't reach it from LAN.
You will say that using 8006 its no problem but need to use 443 cause its the only port I can use from WAN cause VPNs are forbidden by my ISP.
My pve IPATABLES status:
root@pve:~# systemctl status iptables.service
● netfilter-persistent.service - netfilter persistent con>
Loaded: loaded (/lib/systemd/system/netfilter-persis>
Active: active (exited) since Tue 2024-04-16 15:20:5>
Docs: man:netfilter-persistent(8)
Process: 6876 ExecStart=/usr/sbin/netfilter-persisten>
Main PID: 6876 (code=exited, status=0/SUCCESS)
CPU: 4ms

Apr 16 15:20:52 pveml330g6 systemd[1]: Starting netfilter>
Apr 16 15:20:52 pveml330g6 systemd[1]: Finished netfilter>
root@pveml330g6:~# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
IPTABLES Rules ( /etc/iptables/rules.v4)
# Generated by iptables-save v1.8.9 on Tue Apr 16 14:15:1>
*raw

REROUTING ACCEPT [206315:8529962]
:OUTPUT ACCEPT [204412:14573417]
COMMIT
# Completed on Tue Apr 16 14:15:12 2024
# Generated by iptables-save v1.8.9 on Tue Apr 16 14:15:1>
*filter
:INPUT ACCEPT [6568:826844]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [5632:1026061]
COMMIT
# Completed on Tue Apr 16 14:15:12 2024
Network interfaces:
root@pveml330g6:~# cat /etc/network/interfaces
# network interface settings; autogenerated
# Please do NOT modify this file directly, unless you know what
# you're doing.
#
# If you want to manage parts of the network configuration manually,
# please utilize the 'source' or 'source-directory' directives to do
# so.
# PVE will preserve these directives, but will NOT read its network
# configuration from sourced files, so do not attempt to move any of
# the PVE managed interfaces into external files!

auto lo
iface lo inet loopback

iface enp3s4f0 inet manual

iface enp3s4f1 inet manual

auto vmbr0
iface vmbr0 inet static
address 10.20.4.3/24
gateway 10.20.4.254
bridge-ports enp3s4f0
bridge-stp off
bridge-fd 0
#Proxmox

auto vmbr1
iface vmbr1 inet static
address 10.116.4.0/24
bridge-ports enp3s4f1
bridge-stp off
bridge-fd 0
#VMs
Hope someone can help me cause already have pve running with the VMs I need and can't start from zero again
Thx

_gabriel · Apr 16, 2024

post output of "iptable-save" in [CODE][/CODE]

pbernardino · Apr 17, 2024

Code:

root@pveml330g6:~# iptables-save
# Generated by iptables-save v1.8.9 on Tue Apr 16 22:57:06 2024
*raw
:PREROUTING ACCEPT [268398:53087773]
:OUTPUT ACCEPT [256143:72236060]
COMMIT
# Completed on Tue Apr 16 22:57:06 2024
# Generated by iptables-save v1.8.9 on Tue Apr 16 22:57:06 2024
*filter
:INPUT ACCEPT [265425:52469146]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [256202:72240106]
COMMIT
# Completed on Tue Apr 16 22:57:06 2024

_gabriel · Apr 17, 2024

sorry not expert here. iptables-save not needed.
iptables -S was ok.
seems you have flushed/cleared iptables, reboot host then re-post iptables -S in code always.

pbernardino · Apr 17, 2024

After reboot can´t access to web console even in port 8006, had to do pve-firewall stop to use web console again. But have firewall off on Datacenter and pve host.
Here the output you asked for.

Code:

root@pveml330g6:~# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT

pbernardino · Apr 17, 2024

Created rules for Datacenter to accept in 80 443 8006 and icmp
And ssh in pve Host and started pve-firewall, this is the output but lost access from LAN to web console in port 8006

Code:

root@pveml330g6:~# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N PVEFW-Drop
-N PVEFW-DropBroadcast
-N PVEFW-FORWARD
-N PVEFW-FWBR-IN
-N PVEFW-FWBR-OUT
-N PVEFW-HOST-IN
-N PVEFW-HOST-OUT
-N PVEFW-INPUT
-N PVEFW-OUTPUT
-N PVEFW-Reject
-N PVEFW-SET-ACCEPT-MARK
-N PVEFW-logflags
-N PVEFW-reject
-N PVEFW-smurflog
-N PVEFW-smurfs
-N PVEFW-tcpflags
-A INPUT -j PVEFW-INPUT
-A FORWARD -j PVEFW-FORWARD
-A OUTPUT -j PVEFW-OUTPUT
-A PVEFW-Drop -j PVEFW-DropBroadcast
-A PVEFW-Drop -p icmp -m icmp --icmp-type 3/4 -j ACCEPT
-A PVEFW-Drop -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A PVEFW-Drop -m conntrack --ctstate INVALID -j DROP
-A PVEFW-Drop -p udp -m multiport --dports 135,445 -j DROP
-A PVEFW-Drop -p udp -m udp --dport 137:139 -j DROP
-A PVEFW-Drop -p udp -m udp --sport 137 --dport 1024:65535 -j DROP
-A PVEFW-Drop -p tcp -m multiport --dports 135,139,445 -j DROP
-A PVEFW-Drop -p udp -m udp --dport 1900 -j DROP
-A PVEFW-Drop -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A PVEFW-Drop -p udp -m udp --sport 53 -j DROP
-A PVEFW-Drop -m comment --comment "PVESIG:83WlR/a4wLbmURFqMQT3uJSgIG8"
-A PVEFW-DropBroadcast -m addrtype --dst-type BROADCAST -j DROP
-A PVEFW-DropBroadcast -m addrtype --dst-type MULTICAST -j DROP
-A PVEFW-DropBroadcast -m addrtype --dst-type ANYCAST -j DROP
-A PVEFW-DropBroadcast -d 224.0.0.0/4 -j DROP
-A PVEFW-DropBroadcast -m comment --comment "PVESIG:NyjHNAtFbkH7WGLamPpdVnxHy4w"
-A PVEFW-FORWARD -m conntrack --ctstate INVALID -j DROP
-A PVEFW-FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PVEFW-FORWARD -m physdev --physdev-in fwln+ --physdev-is-bridged -j PVEFW-FWBR-IN
-A PVEFW-FORWARD -m physdev --physdev-out fwln+ --physdev-is-bridged -j PVEFW-FWBR-OUT
-A PVEFW-FORWARD -m comment --comment "PVESIG:qnNexOcGa+y+jebd4dAUqFSp5nw"
-A PVEFW-FWBR-IN -m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs
-A PVEFW-FWBR-IN -m comment --comment "PVESIG:Ijl7/xz0DD7LF91MlLCz0ybZBE0"
-A PVEFW-FWBR-OUT -m comment --comment "PVESIG:2jmj7l5rSw0yVb/vlWAYkK/YBwk"
-A PVEFW-HOST-IN -i lo -j ACCEPT
-A PVEFW-HOST-IN -m conntrack --ctstate INVALID -j DROP
-A PVEFW-HOST-IN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PVEFW-HOST-IN -m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs
-A PVEFW-HOST-IN -p igmp -j RETURN
-A PVEFW-HOST-IN -i vmbr0 -p tcp -m tcp --dport 22 -j RETURN
-A PVEFW-HOST-IN -i vmbr0 -p tcp -m tcp --sport 8006 -j RETURN
-A PVEFW-HOST-IN -i vmbr0 -p tcp -m tcp --sport 443 -j RETURN
-A PVEFW-HOST-IN -i vmbr0 -p tcp -m tcp --sport 80 -j RETURN
-A PVEFW-HOST-IN -i vmbr0 -p icmp -j RETURN
-A PVEFW-HOST-IN -p tcp -m set --match-set PVEFW-0-management-v4 src -m tcp --dport 8006 -j RETURN
-A PVEFW-HOST-IN -p tcp -m set --match-set PVEFW-0-management-v4 src -m tcp --dport 5900:5999 -j RETURN
-A PVEFW-HOST-IN -p tcp -m set --match-set PVEFW-0-management-v4 src -m tcp --dport 3128 -j RETURN
-A PVEFW-HOST-IN -p tcp -m set --match-set PVEFW-0-management-v4 src -m tcp --dport 22 -j RETURN
-A PVEFW-HOST-IN -p tcp -m set --match-set PVEFW-0-management-v4 src -m tcp --dport 60000:60050 -j RETURN
-A PVEFW-HOST-IN -j PVEFW-Drop
-A PVEFW-HOST-IN -j DROP
-A PVEFW-HOST-IN -m comment --comment "PVESIG:Ucq/Uw7newiqsOCowA/mLSiw80o"
-A PVEFW-HOST-OUT -o lo -j ACCEPT
-A PVEFW-HOST-OUT -m conntrack --ctstate INVALID -j DROP
-A PVEFW-HOST-OUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PVEFW-HOST-OUT -p igmp -j RETURN
-A PVEFW-HOST-OUT -d 10.20.4.0/24 -p tcp -m tcp --dport 8006 -j RETURN
-A PVEFW-HOST-OUT -d 10.20.4.0/24 -p tcp -m tcp --dport 22 -j RETURN
-A PVEFW-HOST-OUT -d 10.20.4.0/24 -p tcp -m tcp --dport 5900:5999 -j RETURN
-A PVEFW-HOST-OUT -d 10.20.4.0/24 -p tcp -m tcp --dport 3128 -j RETURN
-A PVEFW-HOST-OUT -j RETURN
-A PVEFW-HOST-OUT -m comment --comment "PVESIG:CDVV5j1CkYGzAM3txHXxXmpUrXw"
-A PVEFW-INPUT -j PVEFW-HOST-IN
-A PVEFW-INPUT -m comment --comment "PVESIG:+5iMmLaxKXynOB/+5xibfx7WhFk"
-A PVEFW-OUTPUT -j PVEFW-HOST-OUT
-A PVEFW-OUTPUT -m comment --comment "PVESIG:LjHoZeSSiWAG3+2ZAyL/xuEehd0"
-A PVEFW-Reject -j PVEFW-DropBroadcast
-A PVEFW-Reject -p icmp -m icmp --icmp-type 3/4 -j ACCEPT
-A PVEFW-Reject -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A PVEFW-Reject -m conntrack --ctstate INVALID -j DROP
-A PVEFW-Reject -p udp -m multiport --dports 135,445 -j PVEFW-reject
-A PVEFW-Reject -p udp -m udp --dport 137:139 -j PVEFW-reject
-A PVEFW-Reject -p udp -m udp --sport 137 --dport 1024:65535 -j PVEFW-reject
-A PVEFW-Reject -p tcp -m multiport --dports 135,139,445 -j PVEFW-reject
-A PVEFW-Reject -p udp -m udp --dport 1900 -j DROP
-A PVEFW-Reject -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A PVEFW-Reject -p udp -m udp --sport 53 -j DROP
-A PVEFW-Reject -m comment --comment "PVESIG:h3DyALVslgH5hutETfixGP08w7c"
-A PVEFW-SET-ACCEPT-MARK -j MARK --set-xmark 0x80000000/0x80000000
-A PVEFW-SET-ACCEPT-MARK -m comment --comment "PVESIG:Hg/OIgIwJChBUcWU8Xnjhdd2jUY"
-A PVEFW-logflags -j DROP
-A PVEFW-logflags -m comment --comment "PVESIG:MN4PH1oPZeABMuWr64RrygPfW7A"
-A PVEFW-reject -m addrtype --dst-type BROADCAST -j DROP
-A PVEFW-reject -s 224.0.0.0/4 -j DROP
-A PVEFW-reject -p icmp -j DROP
-A PVEFW-reject -p tcp -j REJECT --reject-with tcp-reset
-A PVEFW-reject -p udp -j REJECT --reject-with icmp-port-unreachable
-A PVEFW-reject -p icmp -j REJECT --reject-with icmp-host-unreachable
-A PVEFW-reject -j REJECT --reject-with icmp-host-prohibited
-A PVEFW-reject -m comment --comment "PVESIG:Jlkrtle1mDdtxDeI9QaDSL++Npc"
-A PVEFW-smurflog -j DROP
-A PVEFW-smurflog -m comment --comment "PVESIG:2gfT1VMkfr0JL6OccRXTGXo+1qk"
-A PVEFW-smurfs -s 0.0.0.0/32 -j RETURN
-A PVEFW-smurfs -m addrtype --src-type BROADCAST -g PVEFW-smurflog
-A PVEFW-smurfs -s 224.0.0.0/4 -g PVEFW-smurflog
-A PVEFW-smurfs -m comment --comment "PVESIG:HssVe5QCBXd5mc9kC88749+7fag"
-A PVEFW-tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -g PVEFW-logflags
-A PVEFW-tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -g PVEFW-logflags
-A PVEFW-tcpflags -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -g PVEFW-logflags
-A PVEFW-tcpflags -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -g PVEFW-logflags
-A PVEFW-tcpflags -p tcp -m tcp --sport 0 --tcp-flags FIN,SYN,RST,ACK SYN -g PVEFW-logflags
-A PVEFW-tcpflags -m comment --comment "PVESIG:CMFojwNPqllyqD67NeI5m+bP5mo"
root@pveml330g6:~#

Output of iptables-save:

Code:

# Generated by iptables-save v1.8.9 on Wed Apr 17 00:36:18 2024
*raw
:PREROUTING ACCEPT [4951:1172202]
:OUTPUT ACCEPT [2819:1132081]
COMMIT
# Completed on Wed Apr 17 00:36:18 2024
# Generated by iptables-save v1.8.9 on Wed Apr 17 00:36:18 2024
*filter
:INPUT ACCEPT [3:244]
:FORWARD ACCEPT [42:3706]
:OUTPUT ACCEPT [21:1566]
:PVEFW-Drop - [0:0]
:PVEFW-DropBroadcast - [0:0]
:PVEFW-FORWARD - [0:0]
:PVEFW-FWBR-IN - [0:0]
:PVEFW-FWBR-OUT - [0:0]
:PVEFW-HOST-IN - [0:0]
:PVEFW-HOST-OUT - [0:0]
:PVEFW-INPUT - [0:0]
:PVEFW-OUTPUT - [0:0]
:PVEFW-Reject - [0:0]
:PVEFW-SET-ACCEPT-MARK - [0:0]
:PVEFW-logflags - [0:0]
:PVEFW-reject - [0:0]
:PVEFW-smurflog - [0:0]
:PVEFW-smurfs - [0:0]
:PVEFW-tcpflags - [0:0]
-A INPUT -j PVEFW-INPUT
-A FORWARD -j PVEFW-FORWARD
-A OUTPUT -j PVEFW-OUTPUT
-A PVEFW-Drop -j PVEFW-DropBroadcast
-A PVEFW-Drop -p icmp -m icmp --icmp-type 3/4 -j ACCEPT
-A PVEFW-Drop -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A PVEFW-Drop -m conntrack --ctstate INVALID -j DROP
-A PVEFW-Drop -p udp -m multiport --dports 135,445 -j DROP
-A PVEFW-Drop -p udp -m udp --dport 137:139 -j DROP
-A PVEFW-Drop -p udp -m udp --sport 137 --dport 1024:65535 -j DROP
-A PVEFW-Drop -p tcp -m multiport --dports 135,139,445 -j DROP
-A PVEFW-Drop -p udp -m udp --dport 1900 -j DROP
-A PVEFW-Drop -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A PVEFW-Drop -p udp -m udp --sport 53 -j DROP
-A PVEFW-Drop -m comment --comment "PVESIG:83WlR/a4wLbmURFqMQT3uJSgIG8"
-A PVEFW-DropBroadcast -m addrtype --dst-type BROADCAST -j DROP
-A PVEFW-DropBroadcast -m addrtype --dst-type MULTICAST -j DROP
-A PVEFW-DropBroadcast -m addrtype --dst-type ANYCAST -j DROP
-A PVEFW-DropBroadcast -d 224.0.0.0/4 -j DROP
-A PVEFW-DropBroadcast -m comment --comment "PVESIG:NyjHNAtFbkH7WGLamPpdVnxHy4w"
-A PVEFW-FORWARD -m conntrack --ctstate INVALID -j DROP
-A PVEFW-FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PVEFW-FORWARD -m physdev --physdev-in fwln+ --physdev-is-bridged -j PVEFW-FWBR-IN
-A PVEFW-FORWARD -m physdev --physdev-out fwln+ --physdev-is-bridged -j PVEFW-FWBR-OUT
-A PVEFW-FORWARD -m comment --comment "PVESIG:qnNexOcGa+y+jebd4dAUqFSp5nw"
-A PVEFW-FWBR-IN -m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs
-A PVEFW-FWBR-IN -m comment --comment "PVESIG:Ijl7/xz0DD7LF91MlLCz0ybZBE0"
-A PVEFW-FWBR-OUT -m comment --comment "PVESIG:2jmj7l5rSw0yVb/vlWAYkK/YBwk"
-A PVEFW-HOST-IN -i lo -j ACCEPT
-A PVEFW-HOST-IN -m conntrack --ctstate INVALID -j DROP
-A PVEFW-HOST-IN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PVEFW-HOST-IN -m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs
-A PVEFW-HOST-IN -p igmp -j RETURN
-A PVEFW-HOST-IN -i vmbr0 -p tcp -m tcp --dport 22 -j RETURN
-A PVEFW-HOST-IN -i vmbr0 -p tcp -m tcp --sport 8006 -j RETURN
-A PVEFW-HOST-IN -i vmbr0 -p tcp -m tcp --sport 443 -j RETURN
-A PVEFW-HOST-IN -i vmbr0 -p tcp -m tcp --sport 80 -j RETURN
-A PVEFW-HOST-IN -i vmbr0 -p icmp -j RETURN
-A PVEFW-HOST-IN -p tcp -m set --match-set PVEFW-0-management-v4 src -m tcp --dport 8006 -j RETURN
-A PVEFW-HOST-IN -p tcp -m set --match-set PVEFW-0-management-v4 src -m tcp --dport 5900:5999 -j RETURN
-A PVEFW-HOST-IN -p tcp -m set --match-set PVEFW-0-management-v4 src -m tcp --dport 3128 -j RETURN
-A PVEFW-HOST-IN -p tcp -m set --match-set PVEFW-0-management-v4 src -m tcp --dport 22 -j RETURN
-A PVEFW-HOST-IN -p tcp -m set --match-set PVEFW-0-management-v4 src -m tcp --dport 60000:60050 -j RETURN
-A PVEFW-HOST-IN -j PVEFW-Drop
-A PVEFW-HOST-IN -j DROP
-A PVEFW-HOST-IN -m comment --comment "PVESIG:Ucq/Uw7newiqsOCowA/mLSiw80o"
-A PVEFW-HOST-OUT -o lo -j ACCEPT
-A PVEFW-HOST-OUT -m conntrack --ctstate INVALID -j DROP
-A PVEFW-HOST-OUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PVEFW-HOST-OUT -p igmp -j RETURN
-A PVEFW-HOST-OUT -d 10.20.4.0/24 -p tcp -m tcp --dport 8006 -j RETURN
-A PVEFW-HOST-OUT -d 10.20.4.0/24 -p tcp -m tcp --dport 22 -j RETURN
-A PVEFW-HOST-OUT -d 10.20.4.0/24 -p tcp -m tcp --dport 5900:5999 -j RETURN
-A PVEFW-HOST-OUT -d 10.20.4.0/24 -p tcp -m tcp --dport 3128 -j RETURN
-A PVEFW-HOST-OUT -j RETURN
-A PVEFW-HOST-OUT -m comment --comment "PVESIG:CDVV5j1CkYGzAM3txHXxXmpUrXw"
-A PVEFW-INPUT -j PVEFW-HOST-IN
-A PVEFW-INPUT -m comment --comment "PVESIG:+5iMmLaxKXynOB/+5xibfx7WhFk"
-A PVEFW-OUTPUT -j PVEFW-HOST-OUT
-A PVEFW-OUTPUT -m comment --comment "PVESIG:LjHoZeSSiWAG3+2ZAyL/xuEehd0"
-A PVEFW-Reject -j PVEFW-DropBroadcast
-A PVEFW-Reject -p icmp -m icmp --icmp-type 3/4 -j ACCEPT
-A PVEFW-Reject -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A PVEFW-Reject -m conntrack --ctstate INVALID -j DROP
-A PVEFW-Reject -p udp -m multiport --dports 135,445 -j PVEFW-reject
-A PVEFW-Reject -p udp -m udp --dport 137:139 -j PVEFW-reject
-A PVEFW-Reject -p udp -m udp --sport 137 --dport 1024:65535 -j PVEFW-reject
-A PVEFW-Reject -p tcp -m multiport --dports 135,139,445 -j PVEFW-reject
-A PVEFW-Reject -p udp -m udp --dport 1900 -j DROP
-A PVEFW-Reject -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A PVEFW-Reject -p udp -m udp --sport 53 -j DROP
-A PVEFW-Reject -m comment --comment "PVESIG:h3DyALVslgH5hutETfixGP08w7c"
-A PVEFW-SET-ACCEPT-MARK -j MARK --set-xmark 0x80000000/0x80000000
-A PVEFW-SET-ACCEPT-MARK -m comment --comment "PVESIG:Hg/OIgIwJChBUcWU8Xnjhdd2jUY"
-A PVEFW-logflags -j DROP
-A PVEFW-logflags -m comment --comment "PVESIG:MN4PH1oPZeABMuWr64RrygPfW7A"
-A PVEFW-reject -m addrtype --dst-type BROADCAST -j DROP
-A PVEFW-reject -s 224.0.0.0/4 -j DROP
-A PVEFW-reject -p icmp -j DROP
-A PVEFW-reject -p tcp -j REJECT --reject-with tcp-reset
-A PVEFW-reject -p udp -j REJECT --reject-with icmp-port-unreachable
-A PVEFW-reject -p icmp -j REJECT --reject-with icmp-host-unreachable
-A PVEFW-reject -j REJECT --reject-with icmp-host-prohibited
-A PVEFW-reject -m comment --comment "PVESIG:Jlkrtle1mDdtxDeI9QaDSL++Npc"
-A PVEFW-smurflog -j DROP
-A PVEFW-smurflog -m comment --comment "PVESIG:2gfT1VMkfr0JL6OccRXTGXo+1qk"
-A PVEFW-smurfs -s 0.0.0.0/32 -j RETURN
-A PVEFW-smurfs -m addrtype --src-type BROADCAST -g PVEFW-smurflog
-A PVEFW-smurfs -s 224.0.0.0/4 -g PVEFW-smurflog
-A PVEFW-smurfs -m comment --comment "PVESIG:HssVe5QCBXd5mc9kC88749+7fag"
-A PVEFW-tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -g PVEFW-logflags
-A PVEFW-tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -g PVEFW-logflags
-A PVEFW-tcpflags -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -g PVEFW-logflags
-A PVEFW-tcpflags -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -g PVEFW-logflags
-A PVEFW-tcpflags -p tcp -m tcp --sport 0 --tcp-flags FIN,SYN,RST,ACK SYN -g PVEFW-logflags
-A PVEFW-tcpflags -m comment --comment "PVESIG:CMFojwNPqllyqD67NeI5m+bP5mo"
COMMIT
# Completed on Wed Apr 17 00:36:18 2024

pbernardino · Apr 17, 2024

Ok my rules for in 80 443 and 8006 where wrong putted ports on source instead of destination.
But no access from LAN to web console only on VM by port 443

encryptedserver · Apr 17, 2024

Why dont you change port in proxmox interfaces file.

post-up iptables -t nat -A PREROUTING -p tcp -d 192.168.1.10 --dport 443 -j REDIRECT --to-ports 8006

https://saudiqbal.github.io/Proxmox/proxmox-IPv6-interface-setup-DHCPv6-or-static.html

_gabriel · Apr 17, 2024

pbernardino said:
Ok my rules for in 80 443 and 8006

indeed I've forgotten output of /etc/pve/firewall/cluster.fw

pbernardino · Apr 17, 2024

encryptedserver said:
Why dont you change port in proxmox interfaces file.

post-up iptables -t nat -A PREROUTING -p tcp -d 192.168.1.10 --dport 443 -j REDIRECT --to-ports 8006

https://saudiqbal.github.io/Proxmox/proxmox-IPv6-interface-setup-DHCPv6-or-static.html

The problem it´s not the redirection but the port 443, it´s blocked

pbernardino · Apr 18, 2024

_gabriel said:
indeed I've forgotten output of /etc/pve/firewall/cluster.fw

Here is it:

Code:

[OPTIONS]

enable: 0

[RULES]

IN ACCEPT -i vmbr0 -p tcp -dport 8006 -log nolog
IN ACCEPT -i vmbr0 -p tcp -dport 443 -log nolog
IN ACCEPT -i vmbr0 -p tcp -dport 80 -log nolog
IN ACCEPT -i vmbr0 -p icmp -log nolog

Now firewall on cluster it's disable but if I enable it didn't solve the problem.

_gabriel · Apr 18, 2024

and /etc/pve/nodes/<HOSTNAME>/host.fw

edit: btw, afaik, encryptedserver is right about iptables redirect , the result should be the same as nginx redirect.

pbernardino · Apr 18, 2024

Code:

[OPTIONS]

enable: 0

[RULES]

IN SSH(ACCEPT) -i vmbr0 -log nolog

pbernardino · Apr 18, 2024

Code:

netstat -tulpn | grep :443
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      5023/nginx: master

pbernardino · Apr 18, 2024

Thx for the help but decide to reinstall proxmox again from 6.4 to 8.1(the server only accept 6.4 cause lost monitor image on recent versions) . Will take time but lost more tryng to solve this. Hope the restore from backup VM machines will work. Later will say something if this lot of work had sucess.

_gabriel · Apr 18, 2024

btw, PVE has anti lockout rules that allow 8006 on same subnet.

pbernardino · Apr 19, 2024

All day working on install, update, mounting hdd and recovering VMs and it's the same only have access by port 443 on local Windows VM.

_gabriel · Apr 19, 2024

what ip connect to what ip port ?

Search

Search

Can´t access to Proxmox web console using port 443

pbernardino

New Member

_gabriel

Renowned Member

pbernardino

New Member

_gabriel

Renowned Member

pbernardino

New Member

pbernardino

New Member

pbernardino

New Member

encryptedserver

Member

_gabriel

Renowned Member

pbernardino

New Member

pbernardino

New Member

_gabriel

Renowned Member

pbernardino

New Member

pbernardino

New Member

pbernardino

New Member

_gabriel

Renowned Member

pbernardino

New Member

_gabriel

Renowned Member