net.bridge.bridge-nf-call-iptables and PVE Firewall

[Don Daniello]

In most cases where IPs are routed through the PVE host, the bridge-nf-call-* settings do not need to be enabled for PVE Firewall to work.

However, we have recently switched to using a vlan-aware bridge on the host and configure the VLAN ID directly in Proxmox for each container/VM interface.
This is quick and easy with vRack (OVH) or vSwitch (Hetzner).

Because of a file /etc/sysctl.d/pve.conf containing the following, the firewall rules didn't apply to guests in this setup.

net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0
net.bridge.bridge-nf-filter-vlan-tagged = 0
fs.aio-max-nr = 1048576

I couldn't trace that file to any package (via apt-file search pve.conf) and I'm not sure if it's dropped by the PVE installer or an "addon" from the way OVH and Hetzner install Proxmox automatically.

It would be helpful to know where these settings are coming from and to document their existence if they come from Proxmox. Maybe Proxmox should check for their values, knowing that in some setups the firewall just won't work.

 

[mira]

Where did you configure the firewall rules?
The pve.conf file is part of the PVE installer.
All except the bridge-nf-filter-vlan-tagged one are set to '1' as soon as the guest firewall is enabled.

 

[Don Daniello]

@mira
The firewall rules are obviously configured via the PVE web interface, it is the PVE firewall after all.
If bridge-nf-filter-vlan-tagged doesn't get set then the setup I described above wouldn't have firewall operational.

However, I queried the status of all those sysctl settings and they all reported to be 0. And I restarted pvefirewall repeatedly first to make sure it get reapply whatever it wants if it hasn't already.

 

[mira]

There are 4 separate firewall options: Datacenter level, Node level, VM level and then the NIC (on/off).
So where exactly did you set the rules?

 

[Don Daniello]

I enabled it at all those levels and set the rules at the VM level. There are other rules set at other levels but I'm not expecting those to apply now.

 

[mira]

Please provide some more information about the rules you configured and what exactly you're trying to do.

Also, do the rules compile? (pve-firewall compile)

 

[Don Daniello]

The rules do compile. Everything is applied fine from PVE side of things. I can see the rules configured in iptables, nftables, ipset, etc.

The only problem is that the kernel does not even process packets through them because of net.bridge.bridge-nf-call-iptables=0.
There should be a mechanism that changes those sysctl values to 1 for the firewall to work in non-routed setups.