Firewall status "pending changes" due to IPSet

[hjstn]

Hi all,

I'm relatively new to Proxmox, but I have a little bit of experience with Debian and Linux. I'm running a newly-configured Proxmox 7.0-10 (bullseye) on the PVE-no-subscription repo and all packages are up to date as of this post.

I'm facing an (albeit minor) issue with the PVE-firewall, where running pve-firewall status always returns Status: enabled/running (pending changes).

These are the results of pve-firewall compile:
https://pastebin.com/hD2ekDJP (Pastebin'd because post exceeded character limit)

Looking at other threads posted on this forum with similar issues, it appears that my ipset cmdlist should also show exists instead of update, but even after running pve-firewall restart and restarting the entire node, the firewall status still remains on "pending changes" and the outputs of compile remain the same.

The only IPTables-related changes I've made to the installation is installing iptables-persistent to add NAT tables, but I'm not sure if that is the cause. I've included the rules below.

Spoiler: rules.v4

*nat

-A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-port 8006

COMMIT

Spoiler: rules.v6

*nat

-A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-port 8006

COMMIT

Thanks in advance. Please let me know if you need any other details.

 

[mira]

The `iptables-persistent` package might interfere with it.
Could you disable it and instead add the rules via post-up on the network interface?

 

[wmr]

Those "pending changes" message is caused by the ipset_chain_digest function from PVE/Firewall.pm which did not got updated to userspace changes at least in ipset 7.7 (documented here).
Calling

# ipset list; sleep 10; ipset list

will show the changing of the initval hex encoded value.

So any calculated hash which includes this will always differ from a hash calculated some seconds ago.

Also is the bucketsize parameter missing from the proxmox ruleset and not filtered by ipset_chain_digest.
Given that, any calculated hash calculated from the running ipset will differ from the proxmox ruleset ones.

There is also a bug filed which contains a supposed fix almost 14 days ago.