[SOLVED] Can't access CT/VM via SSH with some routers (but ping works and they have internet access)

[the_blacksmith1]

EDIT : SOLUTION here => https://forum.proxmox.com/threads/c...d-they-have-internet-access.84334/post-371109

--

Hello,

I'm facing an issue and I have no idea how to fix it. I'm assuming it's coming from Proxmox, but I'm not even sure.

I have a fritzbox 7590 as a router, I have my computer, and I have my server with proxmox on it (9 CT and 2 VM).
Everything is working like a charm, very basic setup, nothing special.

I'm currently trying to change my router for something else. And when I do so, I can't connect via SSH to my CT / VM.
I can ping all my CT / VM, they have internet access, but any SSH connection times out.
!! But I can connect to the host !! SSH is working there. And I can login to my CT / VM through the hosts (pct enter) or through the console. And they all have internet access.

I tried PFsense, OPNsense, Cisco router, Mikrotik Router, Ubiquity Router.
They all have the same issue.

Funny enough, Peplink router doesn't have that issue...
And funny enough, the CT where I have Pihole installed doesn't have that issue (except on OPNsense, where SSH doesn't work even for that CT ).

I tried to disabled the proxmox firewall (see attachment), but it didn't change anything.

Of course, as soon as I swap back the router to my Fritzbox, ssh is working instantly.

Do you guys have any idea where that behavior is coming from ?
Let me know if you need more informations (I'm kind of a noob ^^').

Thank you for the reading.

 

[Pierre-Yves]

Hi
Connect from where to where ?
Most of the solutions you talked about are firewall "ready to use" ... So if your proxmox is connected on LAN, WAN or OPT card, the implicit rules are not the same ...
And you're problem seems to be a filter port issue.
Regards

 

[the_blacksmith1]

Ho my bad, completely forgot the most important information ^^'

Everything is on my LAN (my PC and my proxmox server). So from LAN to LAN.
I'm trying to connect to my CT's directly via their LAN address (192.168.X.X), nothing else.

Of course, my first idea was to blame the firewall as well, but since it's just my LAN, by default, there is no rule that should mess with the SSH connection from my understanding.

 

[Pierre-Yves]

so you've got a switch that connects your personnal computer, your proxmox server and your router
all are connected on the same network (192.168.X.0/24) and the gateway is your internet router (probably 192.168.X.1 or 192.168.X.254)
when the router is fritzbox, all works
when other router, SSH from your personnal computer to CTs on proxmox do not work any more
that's it ?

 

[the_blacksmith1]

That's exactly it.

 

[Pierre-Yves]

and your CT's IP are on the same network too ?

 

[the_blacksmith1]

Yes they are.

Router => 192.168.1.1
My PC => 192.168.1.42
My CTs => 192.168.1.100-115

 

[Pierre-Yves]

Neither VM or CT works ... same thing for both of them ?

 

[the_blacksmith1]

VM or CT, SSH don't work when I'm using an other router than my Fritzbox.

I just tried SSH with my synology. I switch to my router (OPNsense), enabled SSH on my syno, and it's working fine, I can login to my synology via SSH, when using OPNsense (same port, obviously).

So the issue is definitely on proxmox side.

Is it possible that my network config is missing something on my proxmos host ?

source /etc/network/interfaces.d/*

auto lo eno1
iface lo inet loopback

allow-hotplug eno1

iface eno1 inet manual
# This is an autoconfigured IPv6 interface

iface eno1 inet6 auto

auto vmbr0
iface vmbr0 inet static
    address  192.168.1.110
    netmask  255.255.255.0
    gateway  192.168.1.1
    bridge_ports eno1
    bridge_stp off
    bridge_fd 0

 

[Pierre-Yves]

you can try to delete
iface eno1 inet6 auto

 

[the_blacksmith1]

It didn't help.

I've attached some screenshots so you can check that I'm not mad or something ^^'

One when it fails (tried to login to a CT : 192.168.1.116)
One when it's working (tried to login to my syno : 192.168.1.100)

I've already mentionned it : I can login to the host, ssh is working there.

 

[Pierre-Yves]

and if there is no router connected, does it work ?

 

[oguz]

It didn't help.

did you do systemctl restart networking after changing this?

 

[the_blacksmith1]

did you do systemctl restart networking after changing this?

I rebooted the host before retrying, yes.

and if there is no router connected, does it work ?

How am I suppose to connect to my CT's from my PC if there is no router involved ? I don't have any managed switch.

 

[oguz]

could you show us your proxmox firewall rules for all levels? (datacenter, node, VM/CT)

 

[Pierre-Yves]

I rebooted the host before retrying, yes.


How am I suppose to connect to my CT's from my PC if there is no router involved ? I don't have any managed switch.

 

[Pierre-Yves]

I rebooted the host before retrying, yes.


How am I suppose to connect to my CT's from my PC if there is no router involved ? I don't have any managed switch.

all your computers are on the same network, there is no need of a router
a basic switch is enough
a router makes communications possible between 2 different networks
there is only one on yours, no need for a router

 

[the_blacksmith1]

See attachments about the firewall.
All the firewalls are disabled (it was the first thing I tried a couple of weeks ago). I don't have any fw rule (they are all empty)

all your computers are on the same network, there is no need of a router
a basic switch is enough
a router makes communications possible between 2 different networks
there is only one on yours, no need for a router

I had no idea it could work like that !!
I can't disconnect my router right now, tomorrow I'll try for sure and let you know what's up.

 

[the_blacksmith1]

and if there is no router connected, does it work ?

I was able to try without any router. The CT's doesn't even ping.

See attachment for the full results and the three situations :

1) With my initial setup (fritzbox router) where everything is working
2) without any router where the CT's don't ping (and ofc, ssh doesn't work)
3) with OPNsense (it was the same with Mikrotik, cisco and ubqn routers) where the CT's ping, but SSH doesn't work

I've added my nas as well in my tests. And the ssh is working everytime there.

 

[oguz]

is it possible that swapping the router changes your windows firewall configuration?