[SOLVED] Firewall ignores traffic vlan

[hawat]

Hi,

PVE - 6.3-3
Guest OS - Ubuntu 20.04.2 LTS
netplan config:

---
network:
  version: 2
  ethernets:
    ens19:
        dhcp-identifier: mac
        dhcp4: true

  vlans:
    vlan5:
        accept-ra: false
        addresses:
        - 192.168.100.125/24
        id: 5
        link: ens19

For ens19 interface traffic, PVE firewall works correctly.
For vlan5, firewall rules are ignored.

Tcpdump from the tap interface, firewall works

14:19:20.940916 f2:75:57:4c:5f:39 > be:70:19:a3:8c:a6, ethertype IPv4 (0x0800), length 98: 192.168.0.16 > 192.168.0.254: ICMP echo request, id 7, seq 1, length 64
14:19:21.950212 f2:75:57:4c:5f:39 > be:70:19:a3:8c:a6, ethertype IPv4 (0x0800), length 98: 192.168.0.16 > 192.168.0.254: ICMP echo request, id 7, seq 2, length 64

does not work

14:19:23.496525 f2:75:57:4c:5f:39 > 0a:31:11:5b:61:33, ethertype 802.1Q (0x8100), length 102: vlan 5, p 0, ethertype IPv4, 192.168.100.125 > 192.168.100.150: ICMP echo request, id 8, seq 1, length 64
14:19:23.497458 0a:31:11:5b:61:33 > f2:75:57:4c:5f:39, ethertype 802.1Q (0x8100), length 102: vlan 5, p 0, ethertype IPv4, 192.168.100.150 > 192.168.100.125: ICMP echo reply, id 8, seq 1, length 64
14:19:23.497479 0a:31:11:5b:61:33 > f2:75:57:4c:5f:39, ethertype 802.1Q (0x8100), length 102: vlan 5, p 0, ethertype IPv4, 192.168.100.150 > 192.168.100.125: ICMP echo reply, id 8, seq 1, length 64

How can this be fixed?
thank

 

[hawat]

Solution to my problem
https://forum.proxmox.com/threads/pve-firewall-ignores-traffic-from-public-ip.84027/post-376211