IPv6 connectivity to VMs with enabled firewall

[SamFischer]

Hello folks,
I’m trying to solve a problem regarding ipv6 and firewalling.

As soon as I enable firewall on datacenter level, I lose ipv6 connectivity to VMs. IPv4 connections are still working as expected including IP filter. According to Proxmox documentation its not necessary to have different rules for ipv4 and ipv6, so rules shouldn’t be the problem.

Everything works fine with disabled firewall on datacenter level (ipv6 and ipv4 connections are possible).

I’m currently running Proxmox 8.1.3

Can anyone give me a hint, where to look at and why this is the case?

Thanks and regards Sam

 

[SamFischer]

Its a single host test system, so there is only one node in datacenter.
Trying the same thing with an very old Proxmox 5 and apparently the same configuration regarding firewalling, there is not issue.
There are no active rules on node and datacenter level.

There are two simple rules on VM level.

Rule 0:
Type: out
Action: accept
Interface: net0
Source: Set of IP addresses of VM

Rule 1:
Type: in
Action: accept
Interface: net0
Destination: Set of IP addresses of VM

 

[encryptedserver]

I also have firewall enabled on the datacenter level and IPv6 is working fine for both Proxmox and VMs.

Are you also allowing router advertisements?
accept_ra 2

Example

 

[SteveITS]

Do you have https://pve.proxmox.com/pve-docs/chapter-pve-firewall.html#pve_firewall_ipfilter_section configured?

 

[encryptedserver]

I checked and it is not configured for my VMs and they all have native IPv6 connectivity.

This is what I have in the config

[OPTIONS]

enable: 1
radv: 1
macfilter: 1
policy_in: ACCEPT

[RULES]

|GROUP deny-lan-access