Can forward NFS traffic fine, except from Proxmox and its VMs

[foglertech]

Hello.

I have a NAS directly connected to my Proxmox machine, which forwards all NFS traffic via iptables to the NAS (I can't directly connect the NAS per our system policy). I can connect to the NFS share from every other machine on our network but not from ProxMox or the VMs running on it. When I try to, I get a connection refused error. I've added all the IPs I can think of to the NFS permissions, but nothing seems to work. Has anybody experienced this before? What am I missing? My PREROUTING chain is below:

Chain PREROUTING (policy ACCEPT 242K packets, 22M bytes)
 pkts bytes target     prot opt in     out     source               destination
  154  8392 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:2049 to:192.168.137.70:2049
    0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:2049 to:192.168.137.70:2049
  166  8732 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:111 to:192.168.137.70:111
   22  1616 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:111 to:192.168.137.70:111
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:662 to:192.168.137.70:662
    0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:662 to:192.168.137.70:662
   53  2772 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:892 to:192.168.137.70:892
    3   288 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:892 to:192.168.137.70:892
    4   208 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:4045 to:192.168.137.70:4045
    0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:4045 to:192.168.137.70:4045

 

[foglertech]

I figured out the problem. I needed to add rules to the OUTPUT chain since traffic is being generated internally; thus it never hits the INPUT chain.