[SOLVED] Firewall blocks traffic between VMs on same host and in different VLANs

[mathrock74]

Hi,

I was trying to use Promox firewall but ran into "strange" problems:
as soon as firewall on DC level (but not on VM level!!) is active real traffic between VMS running on the same host, but in different VLANs, doesn't work. I emphasize "real traffic" because ping still works and also a portscan between the 2 VMs shows open ports on the other side (but also shows that everything is "filtered"), but when I try to actually use SSH or SMB from VM1 to VM2 I get a timeout.

We are using a VLAN aware bridge on Proxmox hosts. When firewall is active traffic within the same VLAN always works and also works between different VLANs when VMs reside on different hosts. All Proxmox firewall settings are default (Cluster FW: active, Host FW: active, VM FW: inactive, VM NIC interface FW: active). Policy for FW on cluster level for Input + Output is ACCEPT. Without firewall everything works.

Can anyone explain what's going on?

thx
Matthias

 

[mathrock74]

This problem and it's solution is discussed here https://forum.proxmox.com/threads/f...ridge-vm-comunication-on-the-same-node.21372/ and here https://forum.proxmox.com/threads/p...irewall-for-vms-only-on-the-same-node.108485/. Maybe it's time Proxmox mentions this somewhere in documentation.