Change in conntrack helpers

[LnxBil]

I just noticed, that the conntrack helpers are per default off in PVE5:

$ sysctl net.netfilter.nf_conntrack_helper
net.netfilter.nf_conntrack_helper = 0

I stumbled upon this by debugging why an LXC container with an openvpn gateways does not allow sip anymore after upgrading from PVE4 to PVE5. Still have not solved my issue, but can this be related to the underlying change in the kernel with respect to conntrack helper interaction? Just setting the aforementioned parameter to 1 does unfortunately not resolve my issue.

Anyone experiencing similar issues with conntrack/nat inside LXC containers on PVE5?

 

[LnxBil]

If I backup my container and restore it into a PVE 4, it just works, so this has to do with the upgrade to PVE 5.

 

[LnxBil]

The trick is to enable it also inside of your container.