evpn datacenter firewall default input policy drop

C

clash

Member
Feb 12, 2024
6
0
6
I have two pve nodes with evpn working. I created a vnet admlan and started a vm on every pve node.
- pve-node a: admlan: 192.168.100.2/24
- pve-node b: admlan: 192.168.100.3/24

As long as I have the ´Datacenter Firewall disabled, everything ist working okay. Both vms can ping the other one.
No I turned on DC Firewall with INPUT Policy DROP. After that the vms cant reach the other one.

On each node is a Bridge admlan. I can see the traffic on the bridge but the pve firewall drop it.
Each VM has no firewall enabled.

Other Bridges like vlan bridges dont have this problem.

Can anybody help?
 
Do you have VXLAN traffic allowed in the firewall? (UDP dest port 4789)
 
You need to allow all traffic that's required for the EVPN network to function: WireGuard and VXLAN would probably be the main culprits. Also, make sure that the BGP sessions could be established as well (TCP port 179). None of this is done automatically in the firewall atm, you need to create explicit rules.

You can check if BGP works via:
Code: 
vtysh -c 'show bgp summary'

Then you should try pinging via the WireGuard tunnel - and then finally via the VNet inside the VMs. You can always use tcpdump on both ends to check the traffic going out / in - which should help you in formulating the proper firewall rules.
 
Hey,

BGP is working.

Code: 
Neighbor        V         AS   MsgRcvd   MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd   PfxSnt Desc
srv1(10.0.0.1)  4      65001     13241     13148      324    0    0 06:16:06            1        5 FRRouting/10.6.1
10.0.0.3        4      65001         0         0        0    0    0    never      Connect        0 N/A

Total number of neighbors 2

So Iam think you are pointing me in the right direction. I just have no rule to allow udp traffic for vxlan for the wireguard devices.
I will adjust my settings and leave you a note.
 
You must log in or register to reply here.
Top Bottom
Back