Change Proxmox 4 default Firewall Rules?

[Oliver Treck]

Hello.

Is there any chance to change the default firewall-rules in proxmox 4?

I have the same problem with GRE-Tunneling as:
https://forum.proxmox.com/threads/gre-broken-after-upgrading-from-3-3-5-to-3-4-6.22158/

As i see, there is no possibility to change the rules regarding the forward-chain.

Even if i flush the chain with:
iptables -F FORWARD
it get's loaded again.

Any possibility to stop that behavior?

Oliver

 

[dietmar]

And the proposed fix from that thread helps?

 

[Oliver Treck]

Hello Dietmar.

No, it does not work either with GRE-Tunneling, but how do i modify the default rules in general?
I would like to use the firewall-feature, but if i enable the firewall openvswitch over GRE stops working.

Do you have any helpful idea for me?

Regards,
Oliver

 

[dietmar]

No, it does not work either with GRE-Tunneling, but how do i modify the default rules in general?

Those rules are hard coded, so you cannot change them. We need to find a generic solution, so that we can include
that in the default rules.

 

[wbumiller]

Does it help if you load the GRE protocol module for conntrack?

# modprobe nf_conntrack_proto_gre

Link: http://www.spinics.net/lists/netfilter/msg55920.html

 

[Oliver Treck]

I switched tunnel type to VXLAN, which works with the default firewall-rules.

 

[jdl]

Hello,
Same here.
I'm building a cluster hosted by a provider which forbids multicast on the private network.
The workaround was to setup a GRE tunnel between the hosts, which worked perfectly until i enabled pve-firewall.
The firewall completely broke the GRE tunnel.
Switching the tunnel to VXLAN (unicast, but makes multicast work inside the tunnel) instead of GRE "fixed" the issue, the cluster and the firewall are working without any hack.
GRE is still useful in some cases, it would be great if it could be fixed
Hope that helps,
Thank you.

 

[dietmar]

Again, does it help if you load the GRE protocol module for conntrack?

 

[jdl]

It did.

root@PVE001:~# lsmod |grep -i gre
nf_conntrack_proto_gre 16384 0
nf_conntrack 106496 4 nf_conntrack_proto_gre,xt_conntrack,nf_conntrack_ipv4,nf_conntrack_ipv6
ip_gre 20480 0
ip_tunnel 28672 1 ip_gre
gre 16384 1 ip_gre

With this module loaded, tunnel, cluster and firewall are ok.
Should have tried this first.
At least i learned this kind of setup also works with vxlan
Thanks for your help.