Firewall dropping packet

[vnovotny98]

Hi everyone,
we are running Proxmox Virtual Environment 8.4.14 with a 3-node cluster, and we need to configure firewall rules for ports 22 and 8006 on the physical nodes.

We tried enabling and configuring the Datacenter Firewall, but after turning it on we started experiencing packet loss between virtual machines. The strange behavior we observe:

• Packets from VM1 → router → VM2 leave VM1 correctly.
• The router forwards the return packets back to VM1.
• However, VM2 never receives the packets, even though the router does send them.

We did not modify the firewall on the VMs or the hosts themselves. The issue appeared only after enabling the Datacenter firewall. After troubleshooting we ended up with the following configuration:

Actual firewall setup:

[hostmachine ~]# cat /etc/pve/firewall/cluster.fw
[OPTIONS]

policy_in: ACCEPT
ebtables: 0
enable: 0

[ALIASES]

admin xxx/24 # Admin Zone
lbint xxx/24 # LB Ingess INT
lbtda xxx/24 # LB Ingress ACC
custom xxx/24 # User Zone
monitoring xxx/24 # Monitoring Zone

[RULES]

IN ACCEPT -source dc/lbtda -p tcp -dport 8006 -log nolog
IN ACCEPT -source dc/monitoring -p tcp -dport 8006 -log nolog
IN ACCEPT -source dc/admin -p tcp -dport 8006 -log nolog
IN ACCEPT -source dc/custom -p tcp -dport 8006 -log nolog
IN ACCEPT -source dc/monitoring -p tcp -dport 9100 -log nolog
IN ACCEPT -source dc/admin -p tcp -dport 10050 -log nolog
IN ACCEPT -source dc/admin -p tcp -dport 22 -log nolog
IN ACCEPT -source dc/custom -p tcp -dport 22 -log nolog

[hostmachine ~]# cat /etc/pve/nodes/hostmachine/host.fw

[OPTIONS]

tcp_flags_log_level: debug
log_level_in: debug
smurf_log_level: debug
enable: 0
log_level_forward: debug
nosmurfs: 0
log_level_out: debug

[RULES]

IN ACCEPT -source dc/custom -log debug
|IN ACCEPT -source dc/admin -log debug
IN ACCEPT -source dc/monitoring -log debug
IN ACCEPT -source dc/lbtda -log debug
FORWARD ACCEPT -log debug
OUT ACCEPT -log debug
IN DROP -log debug

[hostmachine ~]# cat /etc/pve/firewall/294.fw

[OPTIONS]

policy_in: ACCEPT
enable: 0
log_level_in: nolog
log_level_out: nolog

​

Question​

Has anyone encountered similar behavior where VM-to-VM traffic starts dropping when the Datacenter firewall is enabled, even with permissive rules? Are we missing some global setting or interaction between Datacenter and node-level rules?

Any pointers or ideas would be greatly appreciated.
Thanks!

 

[vnovotny98]

hi any advice?