IPv6 ND packets dropped by PVEFW-HOST-IN ctstate INVALID

[AaronOpfer]

Hello,

I had an odd issue on my home network where I have a proxmox lab host. I have a vmbr0 bridge that bridges a NIC to my large L2 network that my VM guests and my pve host also share. I wanted the vmbr0 to obtain an IPv6 EUI-64 address automatically.

/etc/network/interfaces was given:

iface vmbr0 inet6 auto
    privext 2
    accept_ra 2

However, rdisc6 vmbr0 was timing out until pve-firewall stop.

I eventually traced it to a single rule in the PVEFW-HOST-IN chain:


update PVEFW-HOST-IN (Nq4ajh3AOU8cUQiHPAjfbfrLUx8)
-A PVEFW-HOST-IN -i lo -j ACCEPT
-A PVEFW-HOST-IN -m conntrack --ctstate INVALID -j DROP <--------------- THIS ONE
-A PVEFW-HOST-IN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PVEFW-HOST-IN -m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs
-A PVEFW-HOST-IN -p igmp -j RETURN
... and so on...


Documentation suggests that the INVALID rule can be removed by setting nf_conntrack_allow_invalid. However, I found that this was ineffective.

Cracking open /usr/share/perl5/PVE/Firewall.pem onto line 2909 finds that the firewall code unconditionally adds this INVALID drop rule without consulting $options variable.

As such, I must change this line:

ruleset_chain_add_conn_filters($ruleset, $chain, 0, 'ACCEPT');

to say this:

ruleset_chain_add_conn_filters($ruleset, $chain, 1, 'ACCEPT');

It's not clear to me why I need to remove this rule in the first place. I attempted to make these ICMPv6 packets ignored by conntrack, but this did not work:

# ip6tables -t raw -vnL
Chain PREROUTING (policy ACCEPT 659M packets, 867G bytes)
 pkts bytes target     prot opt in     out     source               destination       
 563K   32M CT         ipv6-icmp --  *      *       ::/0                 ::/0                 ipv6-icmptype 133 NOTRACK
 5173  993K CT         ipv6-icmp --  *      *       ::/0                 ::/0                 ipv6-icmptype 134 NOTRACK
1937K  139M CT         ipv6-icmp --  *      *       ::/0                 ::/0                 ipv6-icmptype 135 NOTRACK
89223 5961K CT         ipv6-icmp --  *      *       ::/0                 ::/0                 ipv6-icmptype 136 NOTRACK
    0     0 CT         ipv6-icmp --  *      *       ::/0                 ::/0                 ipv6-icmptype 137 NOTRACK

Chain OUTPUT (policy ACCEPT 71857 packets, 33M bytes)
 pkts bytes target     prot opt in     out     source               destination       
   11   528 CT         ipv6-icmp --  *      *       ::/0                 ::/0                 ipv6-icmptype 133 NOTRACK
    0     0 CT         ipv6-icmp --  *      *       ::/0                 ::/0                 ipv6-icmptype 134 NOTRACK
  166 11952 CT         ipv6-icmp --  *      *       ::/0                 ::/0                 ipv6-icmptype 135 NOTRACK
  427 29752 CT         ipv6-icmp --  *      *       ::/0                 ::/0                 ipv6-icmptype 136 NOTRACK
    0     0 CT         ipv6-icmp --  *      *       ::/0                 ::/0                 ipv6-icmptype 137 NOTRACK

Just thought I'd post in case someone else knows a better fix or needs a fix.