Cluster firewall enabled blocks SDN simple zone VNet DHCP

[BobAtSmith]

Just getting started and have a cluster with a simple SDN zone configured with a Vnet and subnet with SNAT and DHCP enabled.

With the cluster level firewall disabled Windows VMs in the Vnet subnet get a DHCP lease but with the cluster level firewall enabled they do not.

I've been trying to find out what allow rule I need to add to the cluster firewall to enable DHCP without success.

Help!

Thanks
Bob

 

[pille99]

UDP-Ports 67 and 68

 

[BobAtSmith]

So the Simple Zone, VNet has the network 10.0.1.0/24 and a gateway of 10.0.1.1
Testing with a Win 2022 server VM.

With the Datacenter firewall off the VM gets a DHCP address from 10.0.1.1
With the datacenter firewall on it gets '...unable to contact your DHCP server'

I tried adding an allow all East-West rule for the 10.0.1.0 network - no go
Also tried UDP 67, 68 to-from the VNet and host management network - no go

Once the VM has an IP address with the Datacenter firewall off the firewall can be re-enabled and the VM continues to work fine. If an ipconfig /release, ipconfig /renew is performed or a server restart happens then it fails to reach the DHCP server again.

Appreciate the assistance.
Bob

 

[BobAtSmith]

Still wrestling with, and attempting an understanding of, how a VM in a simple Zone gets a DHCP address - because mine are not.

Simple Zone, VNet 10.0.1.0/24 and a gateway of 10.0.1.1 SNAT enabled and a DHCP range of 10.0.1.11-10.0.1.100

IPAM shows the VM has been granted an IP of 10.0.1.11 but the VM (Windows 2022 server) says DHCP server unreachable.

Where exactly does the DHCP process run?

 

[hisdad]

Hi Bob,
I am also wrestling with this. The dhcp configuration in the VNET becomes a dnsmasq configuration in your host.
Zone is "Simple" With Vnet "xx" and Subnet 10.0.0.0/24 Generates the following:

In /etc/dnsmasq.d/Simple/

10-xx.conf
00-default.conf

10-xx.conf is:
dhcp-range=set:Simple-10.0.0.0-24,10.0.0.0,static,255.255.255.0,infinite
interface=xx

So the VNET like and interface
You assign the VNNET interface, "xx" in this case, to your VM.

This is all according to this docs. https://pve.proxmox.com/wiki/Setup_Simple_Zone_With_SNAT_and_DHCP

For me I"m now seeing a issue where dnsmasq is seeing the dhcp request on interface "xx" but logging a error.
packet received on xx which has no address
because "xx" does not have an IP address host side.

This is nothing in the docs on this issue.
If you have insight, please let me know. --Dad

 

[hisdad]

The issue is that if you use dhcp , you must also set a gateway.
That becomes the IP on the host that works with dhcp.
If you set a gateway, it will try and confirm the existence of the reverse (PTR) lookup in you DNS.