firewall destroys routing

[KyDay]

Hi,

I am using Proxmox V5.1 to virtualize a complete network through multiple Bridges...

I have a routing CT connected to all interfaces, handing out dhcp and dns push including default gateway to be the router. This works perfect and automatically populates my domain.

Host ---vmbr5--- Router --vmbr1 to vmbr4-- all Containers

The Host does not have IPs on vmbr1 to 4, just the router acts as default gateway.

Now I want to enable the host FW to take care of WAN traffic, however, if i enable the proxmox firewall, even with policy IN and OUT Accept all traffic is stopped. Furthermore NATed ports are ignored by the firewall.

How can I solve this issue?

 

[Alwin]

If you activate the firewall, the guests are connected on a separate bridge (eg. vmbrXfwXY), then your routing and NAT rules are not pointing to the correct bridge anymore. Either set iptables rules by hand (not through our FW wrapper; firewall disabled) or point your NAT/routing to the new bridges.