Datacenter Filewall enabled by mistake

[lobbia]

mistakenly, I enabled firewall on my PVE GUI without any whitelist rule (INPUT default is Deny), now I can't access GUI or any guest systems, though I can still SSH to the host. I tried to compose /etc/pve/fireewall/cluster.fw file like below:

[OPTIONS]

enable: 0

And also disables iptables:

#iptables -F

But, then when I tried to restart firewall, it failled:

# pve-firewall restart
ipcc_send_rec[1] failed: Connection refused
ipcc_send_rec[2] failed: Connection refused
ipcc_send_rec[3] failed: Connection refused
Unable to load access control list: Connection refused

Seems all internal connection are denied due to filewall setting. Anyone has good idea to restore my GUI and disable data center firewall? Thanks!

 

[fba]

You could add a iptables rule via cli, like this

iptables -A INPUT -p tcp --dport 8006 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

Eventually you have to use -I instead of -A

or just reboot the host after you modified the cluster.fw and disabled the firewall, if the downtime is acceptable for the running services, of course.

 

[Alwin Antreich]

# pve-firewall restart
ipcc_send_rec[1] failed: Connection refused
ipcc_send_rec[2] failed: Connection refused
ipcc_send_rec[3] failed: Connection refused
Unable to load access control list: Connection refused

This sounds like /etc/pve is not accessible (lost quorum) or pve-cluster service is dead. Please check if the pve-cluster.service is running and should you use the node in a cluster, then also check if corosync.service runs and pvecm status shows a quorum. Also if it turns out that pve-cluster is fine, check the pveproxy.service, maybe the certificate couldn't be loaded und only the pveproxy is impacted.

Seems all internal connection are denied due to filewall setting. Anyone has good idea to restore my GUI and disable data center firewall? Thanks!

By default the UI and corosync are already allowed by the firewall rules. Unless you've made your own rules dropping traffic.
https://pve.proxmox.com/pve-docs/chapter-pve-firewall.html#_ports_used_by_proxmox_ve