Host-initiated ping dropped on VLAN-aware Thunderbolt bridge (vmbr1, kernel 6.8.12)

B

banksiaboy

Member
Nov 17, 2022
16
0
6
I'm running Proxmox VE 8.4.14 (kernel 6.8.12-15-pve) on a Mac mini with a Thunderbolt Gigabit Ethernet adapter (Apple A1433).

Apple Mac mini "Core i7" 2.3 (Late 2012)

The NIC (ens9) is bridged as vmbr1, with `bridge-vlan-aware yes` and `bridge-pvid 1`.​


Issue:
- ARP resolves.
- ICMP echo-replies are seen on vmbr1 via tcpdump.
- But the ping process on the host never receives them.
- No nftables, no rp_filter issue, no bridge-nf interference.
- `bridge vlan show` fails with “No buffer space available”, suggesting bridge VLAN table corruption.
- Disabling vlan_filtering or adding VID 1 to `vmbr1 self` does not fix the issue.

Only host-originated untagged traffic is affected. Containers and VMs using vmbr1 function normally.

This exactly matches known issues in upstream Linux bridge code, especially with USB/Thunderbolt NICs:
- https://github.com/openwrt/openwrt/issues/18576

Can this be confirmed and tracked in your kernel release notes?
 
[...]

The issue is resolved. It was not a Thunderbolt or kernel bug.


The actual cause was a stale/locked ARP entry on my OPNsense firewall for the old NIC MAC address. When I swapped vmbr1 from a USB NIC to an Apple Thunderbolt NIC, OPNsense kept the previous MAC marked as “permanent” and ignored packets from the new MAC.


Deleting the ARP entry on OPNsense immediately fixed the problem.


Thanks — nothing further needed.
 
You must log in or register to reply here.
Top Bottom