[SOLVED] Firewall enable on different nodes's vms, one can ping, the other not, what's wrong?

[harold]

Hi, I have configured firewall cluster-wide, those are my two security group:
1. vm-default: which is default for management network
2. mcsgw-sg: which is for public network


on my two vms, the Firewall configurations are the same;
but I can ping one of the vm's public ip, the other cannot;
after I disable the firewall, I can ping the ip, so these's nothing wrong about my network.
vm firewall setting:


iptables-save:

:tap109i0-IN - [0:0]
:tap109i0-OUT - [0:0]
:tap109i1-IN - [0:0]
:tap109i1-OUT - [0:0]
-A PVEFW-FWBR-IN -m physdev --physdev-out tap109i0 --physdev-is-bridged -j tap109i0-IN
-A PVEFW-FWBR-IN -m physdev --physdev-out tap109i1 --physdev-is-bridged -j tap109i1-IN
-A PVEFW-FWBR-OUT -m physdev --physdev-in tap109i0 --physdev-is-bridged -j tap109i0-OUT
-A PVEFW-FWBR-OUT -m physdev --physdev-in tap109i1 --physdev-is-bridged -j tap109i1-OUT
-A tap109i0-IN -p udp -m udp --sport 67 --dport 68 -j ACCEPT
-A tap109i0-IN -j GROUP-vm-default-IN
-A tap109i0-IN -m mark --mark 0x80000000/0x80000000 -j ACCEPT
-A tap109i0-IN -j PVEFW-Drop
-A tap109i0-IN -m limit --limit 1/sec -j NFLOG --nflog-prefix  ":109:6:tap109i0-IN: policy DROP: "
-A tap109i0-IN -j DROP
-A tap109i0-IN -m comment --comment "PVESIG:e0a/GaEnf2jecKz4d1FKUbKBc7A"
-A tap109i0-OUT -p udp -m udp --sport 68 --dport 67 -g PVEFW-SET-ACCEPT-MARK
-A tap109i0-OUT -m mac ! --mac-source fe:53:31:4a:46:88 -j DROP
-A tap109i0-OUT -j MARK --set-xmark 0x0/0x80000000
-A tap109i0-OUT -j GROUP-vm-default-OUT
-A tap109i0-OUT -m mark --mark 0x80000000/0x80000000 -j RETURN
-A tap109i0-OUT -g PVEFW-SET-ACCEPT-MARK
-A tap109i0-OUT -m comment --comment "PVESIG:bESsMtpDDlXYySYW2uXT0h2L6Es"
-A tap109i1-IN -p udp -m udp --sport 67 --dport 68 -j ACCEPT
-A tap109i1-IN -j GROUP-mcsgw-sg-IN
-A tap109i1-IN -m mark --mark 0x80000000/0x80000000 -j ACCEPT
-A tap109i1-IN -j PVEFW-Drop
-A tap109i1-IN -m limit --limit 1/sec -j NFLOG --nflog-prefix  ":109:6:tap109i1-IN: policy DROP: "
-A tap109i1-IN -j DROP
-A tap109i1-IN -m comment --comment "PVESIG:RZ3eT5sDHBPvEsuPcAIY0fBqjQ4"
-A tap109i1-OUT -p udp -m udp --sport 68 --dport 67 -g PVEFW-SET-ACCEPT-MARK
-A tap109i1-OUT -m mac ! --mac-source 9e:4e:97:a4:c7:99 -j DROP
-A tap109i1-OUT -j MARK --set-xmark 0x0/0x80000000
-A tap109i1-OUT -j GROUP-mcsgw-sg-OUT
-A tap109i1-OUT -m mark --mark 0x80000000/0x80000000 -j RETURN
-A tap109i1-OUT -g PVEFW-SET-ACCEPT-MARK
-A tap109i1-OUT -m comment --comment "PVESIG:ldt/mi45eEYa0gBwSa89PIicEak"

 

[harold]

on network device net1, I create a bridge: br0, which has different mac address, would this affect the firewall?

 

[harold]

on network device net1, I create a bridge: br0, which has different mac address, would this affect the firewall?

I deleted this bridge br0, and set public ip on the net1 device, all firewall rules works fine!