Hi.
I'm configuring a Proxmox server on a notebook, using a Wifi connection. The communication is OK between on entire network.
When the firewall option on the container network configuration is off, the machine can communicate with other machines (host, containers, and other network machines).
If I enable the Network Firewall option in the Container Network menu, the container can't communicate in inbound and outbound directions. Even that I have created container firewall rules accepting inbound and outbound connections.
It occurs if the node firewall is on or off either and it occurs if the data center firewall is on or off either.
LXC Container Network configuration:
LXC Container Firewall Options:
LXC Container Firewall test rules:
I can't find where the wrong configuration is.
I'm configuring a Proxmox server on a notebook, using a Wifi connection. The communication is OK between on entire network.
When the firewall option on the container network configuration is off, the machine can communicate with other machines (host, containers, and other network machines).
If I enable the Network Firewall option in the Container Network menu, the container can't communicate in inbound and outbound directions. Even that I have created container firewall rules accepting inbound and outbound connections.
It occurs if the node firewall is on or off either and it occurs if the data center firewall is on or off either.
LXC Container Network configuration:
LXC Container Firewall Options:
LXC Container Firewall test rules:
auto lo
iface lo inet loopback
auto wlan0
iface wlan0 inet static
address 192.168.1.200/24
gateway 192.168.1.1
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up echo 1 > /proc/sys/net/ipv4/conf/wlan0/proxy_arp
iface enp7s0 inet manual
auto vmbr0
iface vmbr0 inet static
address 10.1.1.1/24
bridge-ports none
bridge-stp off
bridge-fd 0
post-up iptables -t nat -A POSTROUTING -s '10.1.1.0/24' -o wlan0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '10.1.1.0/24' -o wlan0 -j MASQUERADE
post-up iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1
iface lo inet loopback
auto wlan0
iface wlan0 inet static
address 192.168.1.200/24
gateway 192.168.1.1
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up echo 1 > /proc/sys/net/ipv4/conf/wlan0/proxy_arp
iface enp7s0 inet manual
auto vmbr0
iface vmbr0 inet static
address 10.1.1.1/24
bridge-ports none
bridge-stp off
bridge-fd 0
post-up iptables -t nat -A POSTROUTING -s '10.1.1.0/24' -o wlan0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '10.1.1.0/24' -o wlan0 -j MASQUERADE
post-up iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1
[OPTIONS]
enable: 1
policy_out: ACCEPT
ipfilter: 0
policy_in: ACCEPT
[RULES]
IN ACCEPT -p icmp -log nolog
OUT ACCEPT -p icmp -log nolog
enable: 1
policy_out: ACCEPT
ipfilter: 0
policy_in: ACCEPT
[RULES]
IN ACCEPT -p icmp -log nolog
OUT ACCEPT -p icmp -log nolog
root@openvpn:~# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dptpenvpn
ACCEPT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dptpenvpn
ACCEPT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 10.1.1.4/24
gateway 10.1.1.1
iface lo inet loopback
auto eth0
iface eth0 inet static
address 10.1.1.4/24
gateway 10.1.1.1
root@virt:~# pve-firewall status
vm 100 - unable to parse value of 'nameserver' - value does not look like a valid IP address
Status: enabled/running
** The "vm 100 - unable to parse value" occurs because I configure the DNS Server to 127.0.0.1#5335 to use unbound local DNS.
vm 100 - unable to parse value of 'nameserver' - value does not look like a valid IP address
Status: enabled/running
** The "vm 100 - unable to parse value" occurs because I configure the DNS Server to 127.0.0.1#5335 to use unbound local DNS.
local hostname: virt
local IP address: 10.1.1.1
network auto detect: 10.1.1.0/24
using detected local_network: 10.1.1.0/24
local IP address: 10.1.1.1
network auto detect: 10.1.1.0/24
using detected local_network: 10.1.1.0/24
I can't find where the wrong configuration is.
Last edited: