[SOLVED] Firewall blocking incoming traffic

[Strange0ne]

Hi!
I have a server with installed proxmox 7.3. After I enable datacenter firewall with ACCEPT input policy, I can't connect to my VMs. Please help me understand what I'm doing wrong =)

 

[spirit]

Hi!
I have a server with installed proxmox 7.3. After I enable datacenter firewall with ACCEPT input policy, I can't connect to my VMs. Please help me understand what I'm doing wrong =)

datacenter rules only apply to all proxmox hosts management ip, not vms.

you need to add rules for each vm.

 

[Strange0ne]

Thanks for your reply, but I add rules to all levels. More than that, if I disable firewall, I still can't ping my VM. After I delete all files from /etc/pve/firewall and restart the server, ping and other connections works again(((

Spoiler: Screenshots

 

[spirit]

are you sure that you don't have mtu problem with fragmented packets ? (firewall drop fragmented packets)

can you try: "ping -m do -s 1470 ..." ? (with firewall disabled)

 

[Strange0ne]

are you sure that you don't have mtu problem with fragmented packets ? (firewall drop fragmented packets)

can you try: "ping -m do -s 1470 ..." ? (with firewall disabled)

When I try to ping with those flags, I get an error)

 

[spirit]

When I try to ping with those flags, I get an error)
View attachment 47808

sorry , "ping -M do -s 1470"

 

[Strange0ne]

sorry , "ping -M do -s 1470"

After I delete firewall files and reboot server

 

[spirit]

ok, so it's ok for this.

can you try to disabled ebtables in datacenter option ? (filtering mac address)

 

[Strange0ne]

ok, so it's ok for this.

can you try to disabled ebtables in datacenter option ? (filtering mac address)

Sure, but it didn't help(
I don't understand why I can't ping VM even firewall turned off.

 

[spirit]

can you try to add in /etc/pve/local/host.fw

nf_conntrack_allow_invalid: 1

?

(create the file if it's not exist). This option is not yet available in gui.

 

[Strange0ne]

can you try to add in /etc/pve/local/host.fw

nf_conntrack_allow_invalid: 1

?

(create the file if it's not exist). This option is not yet available in gui.

Done, still can't ping VMs)

 

[spirit]

I'm really out of idea ....

 

[Strange0ne]

I'm really out of idea ....

No problem, thanks for trying to help me)

 

[Strange0ne]

Maybe somebody from staff can help me, please?)

 

[Strange0ne]

I'm really out of idea ....

Well, I just reinstalled proxmox and firewall working now =)

 

[Strange0ne]

I'm really out of idea ....

Wow, I figured it out... If you install docker on proxmox host, it will mess up iptables config.