iptables: no traffic in FORWARD chain for VMs

carlosho17

Renowned Member
Dec 6, 2010
11
1
68
Hi

i upgraded to newest version, and traffic accounting stopped working for VMs, though still works for CTs

VM network interfaces are RTL8139 in bridged mode over vmbr0

pveversion:

pve-manager: 2.1-14 (pve-manager/2.1/f32f3f46)
running kernel: 2.6.32-14-pve
proxmox-ve-2.6.32: 2.1-74
pve-kernel-2.6.32-14-pve: 2.6.32-74
pve-kernel-2.6.32-6-pve: 2.6.32-52
lvm2: 2.02.95-1pve2
clvm: 2.02.95-1pve2
corosync-pve: 1.4.3-1
openais-pve: 1.1.4-2
libqb: 0.10.1-2
redhat-cluster-pve: 3.1.92-3
resource-agents-pve: 3.9.2-3
fence-agents-pve: 3.1.8-1
pve-cluster: 1.0-27
qemu-server: 2.0-49
pve-firmware: 1.0-18
libpve-common-perl: 1.0-30
libpve-access-control: 1.0-24
libpve-storage-perl: 2.0-30
vncterm: 1.0-3
vzctl: 3.0.30-2pve5
vzprocps: 2.0.11-2
vzquota: 3.0.12-3
pve-qemu-kvm: 1.1-8
ksm-control-daemon: 1.1-1


I use to measure outgoing traffic with:

iptables -A FORWARD -o vmbr0 -s xxx.xxx.xxx.xxx

and then after five minutes

iptables -L -V -x -n
and parse the output


I've tried replacing vmbr0 with eth0 , and even using the TAP interface with and without the ip address, but no traffic shows up.

tcpdump show a lot of traffic for the corresponding IPs and tap interface, for instance
tcpdump -n -i tap<VMID>i0
logs many packets


My /etc/modules was empty, I also tried with modprobe ip_conntrack , and problem persists.

Can you help ?

Thanks !
 
Found a thread with the solution:

in /etc/sysctl.d/pve.conf set

net.bridge.bridge-nf-call-iptables = 1



sysctl -p /etc/sysctl.d/pve.conf

and it works!