Datacentre Firewall Blocks VM and Container traffic

retrojp

New Member
Apr 29, 2021
17
2
3
45
Scotland
I have noticed some similar threads to this situation, but a few years old.

My problem is enabling the datacentre firewall, and even with both Input and Output rules set to accept, i seem to lose networking to my VMs and Containers, and adding firewall rules to the VM's and containers don't appear to help.
If i run pve-firewall stop, and/or disable the datacentre firewall, my VM's and containers are still stuck with the issue.
My only fix for now, seems to be a reboot with the datacentre firewall disabled.

When i run pve-firewall stop the iptables firewall rules do seem to flush, so i'm not entirely sure what else could be blocking the connections.

I've had it running like this for a while, and was quite happy to control my firewalls from within VM's, but since using a privileged container to allow in a GPU, it would have been nice to wrap it up a little in the PVE firewall.

I have also tried disabling the network firewall in the guest configs, but this doesn't seem to make a difference.

Anything else I can check?

Several months ago i removed this host from a cluster, so i'm not sure if this had anything to do with it, i'm not certain the timeline of this event and when i started having firewall issues.
 
Some details...

PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
pve-manager/7.2-11/b76d3178 (running kernel: 5.15.53-1-pve)
 
are you sure that you don't have mtu or network fragmentation packet issues ?

because when conntrack moduled is loaded, (once the firewall is enabled), the fragmented packets are dropped.

(and stopping the pve-firewall don't unload conntrack modue)

Looks like the mtu is set at 1500, but i've not changed this since it's been installed. I was able to use the proxmox firewall once upon a time with this specific installation.