Problem adding Remotes to PDM - api error (status = 400: client error (connect))

E

ephoenix

New Member
Feb 9, 2026
2
0
1
Hi,

I'm quite new to Proxmox and Datacenter Manager so please bear with me, if I made some rookie mistakes.

I've had five standalone Proxmox VE instances with a couple of VMs and containers running. Now I want to unify my setup. I reinstalled two hosts with a fresh install of PVE and added them to a cluster. Then I installed PDM as a VM inside of this new cluster. I was able to add three of my five hosts as remotes to PDM, the two freshly installed clustered ones and one of the three remaining ones. But the last two give me massive headaches. I can't get them added to PDM as remotes.

If I try, it takes two minutes and then I always get an api error (status = 400: client error (connect)) message. I poked around a bit and found out that somehow Port 8006 seems to be blocked on those two machines. I never set up any firewall rules inside of PVE itself since I rely on my pfsense box as a firewall. All Proxmox instances are in the same subnet and VLAN (some VMs on those boxes are in different VLANs). I disabled everything in the GUI that could have something to do with the firewall. In the shell pve-firewall status returns disabled/stopped. nmap -p 8006 <ip-address> returns status filtered. I know it's useless but I even created some firewall rules in my pfsense, that specifically allow connections from PDM to the hosts and vice versa. If I remember correctly a nmap filtered response means the packets get dropped and not rejected.

I have absolutely no idea, what could drop the packets from PDM to the host...

Oh of course: PDM is version 1.0.2 and one of the offending hosts is 8.4.16, while I upgraded the other from 8.3.3 to 9.1.5. trying to resolve the situation.
 
Welcome, @ephoenix
Try to find what is the last place (in the network path) the packets are still present and what is the first place they aren't reaching. For instance with tcpdump
This can give a hint what drops them.
 
I spent the day tinkering with tcpdump. But how I would be able to see where the packets get dropped from the output eludes me. Maybe someone can enlighten me. I might need to run tcpdump with different parameters. I also saved the output to a .pcap-file and looked at it with Wireshark. There I can see, that A SYN-Message is transmitted, but there seems to be no answer. That message is retransmitted another 10 times before the output stops, probably when the API throws the "Connect" error.

I did some further troubleshooting. I plugged a laptop into the same subnet. I can ping both offending PVE hosts from the laptop as well as PDM. Nmap from PDM gives me the "filtered" output but the host is shown as online. From the laptop though nmap doesn't even see the host as online. The Laptop is running Ubuntu 25.10.

I attached the output from two tcpdump runs below. First one is one of the offending hosts, the second one is a working one.


Code: 
xyz@abcd:~# tcpdump -vv -i nic0 -n host xxx.xxx.xxx.96 and port 8006
tcpdump: listening on nic0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
11:00:40.616519 IP (tos 0x0, ttl 64, id 61408, offset 0, flags [DF], proto TCP (6), length 60)
    xxx.xxx.xxx.69.45752 > xxx.xxx.xxx.96.8006: Flags [S], cksum 0xe205 (incorrect -> 0xf7f8), seq 3899744120, win 64240, options [mss 1460,sackOK,TS val 2127682180 ecr 0,nop,wscale 7], length 0
11:00:41.632963 IP (tos 0x0, ttl 64, id 61409, offset 0, flags [DF], proto TCP (6), length 60)
    xxx.xxx.xxx.69.45752 > xxx.xxx.xxx.96.8006: Flags [S], cksum 0xe205 (incorrect -> 0xf3ff), seq 3899744120, win 64240, options [mss 1460,sackOK,TS val 2127683197 ecr 0,nop,wscale 7], length 0
11:00:42.656962 IP (tos 0x0, ttl 64, id 61410, offset 0, flags [DF], proto TCP (6), length 60)
    xxx.xxx.xxx.69.45752 > xxx.xxx.xxx.96.8006: Flags [S], cksum 0xe205 (incorrect -> 0xefff), seq 3899744120, win 64240, options [mss 1460,sackOK,TS val 2127684221 ecr 0,nop,wscale 7], length 0
11:00:43.680966 IP (tos 0x0, ttl 64, id 61411, offset 0, flags [DF], proto TCP (6), length 60)
    xxx.xxx.xxx.69.45752 > xxx.xxx.xxx.96.8006: Flags [S], cksum 0xe205 (incorrect -> 0xebff), seq 3899744120, win 64240, options [mss 1460,sackOK,TS val 2127685245 ecr 0,nop,wscale 7], length 0
11:00:44.704967 IP (tos 0x0, ttl 64, id 61412, offset 0, flags [DF], proto TCP (6), length 60)
    xxx.xxx.xxx.69.45752 > xxx.xxx.xxx.96.8006: Flags [S], cksum 0xe205 (incorrect -> 0xe7ff), seq 3899744120, win 64240, options [mss 1460,sackOK,TS val 2127686269 ecr 0,nop,wscale 7], length 0
11:00:45.728991 IP (tos 0x0, ttl 64, id 61413, offset 0, flags [DF], proto TCP (6), length 60)
    xxx.xxx.xxx.69.45752 > xxx.xxx.xxx.96.8006: Flags [S], cksum 0xe205 (incorrect -> 0xe3ff), seq 3899744120, win 64240, options [mss 1460,sackOK,TS val 2127687293 ecr 0,nop,wscale 7], length 0
11:00:47.776969 IP (tos 0x0, ttl 64, id 61414, offset 0, flags [DF], proto TCP (6), length 60)
    xxx.xxx.xxx.69.45752 > xxx.xxx.xxx.96.8006: Flags [S], cksum 0xe205 (incorrect -> 0xdbff), seq 3899744120, win 64240, options [mss 1460,sackOK,TS val 2127689341 ecr 0,nop,wscale 7], length 0
11:00:51.808968 IP (tos 0x0, ttl 64, id 61415, offset 0, flags [DF], proto TCP (6), length 60)
    xxx.xxx.xxx.69.45752 > xxx.xxx.xxx.96.8006: Flags [S], cksum 0xe205 (incorrect -> 0xcc3f), seq 3899744120, win 64240, options [mss 1460,sackOK,TS val 2127693373 ecr 0,nop,wscale 7], length 0
11:01:00.128979 IP (tos 0x0, ttl 64, id 61416, offset 0, flags [DF], proto TCP (6), length 60)
    xxx.xxx.xxx.69.45752 > xxx.xxx.xxx.96.8006: Flags [S], cksum 0xe205 (incorrect -> 0xabbf), seq 3899744120, win 64240, options [mss 1460,sackOK,TS val 2127701693 ecr 0,nop,wscale 7], length 0
11:01:16.512965 IP (tos 0x0, ttl 64, id 61417, offset 0, flags [DF], proto TCP (6), length 60)
    xxx.xxx.xxx.69.45752 > xxx.xxx.xxx.96.8006: Flags [S], cksum 0xe205 (incorrect -> 0x6bbf), seq 3899744120, win 64240, options [mss 1460,sackOK,TS val 2127718077 ecr 0,nop,wscale 7], length 0
11:01:48.768985 IP (tos 0x0, ttl 64, id 61418, offset 0, flags [DF], proto TCP (6), length 60)
    xxx.xxx.xxx.69.45752 > xxx.xxx.xxx.96.8006: Flags [S], cksum 0xe205 (incorrect -> 0xedbe), seq 3899744120, win 64240, options [mss 1460,sackOK,TS val 2127750333 ecr 0,nop,wscale 7], length 0
^C
11 packets captured
11 packets received by filter
0 packets dropped by kernel


Code: 
xyz@abcd:~# tcpdump -vv -i nic0 -n host xxx.xxx.xxx.95 and port 8006
tcpdump: listening on nic0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
11:07:45.395080 IP (tos 0x0, ttl 64, id 43599, offset 0, flags [DF], proto TCP (6), length 60)
    xxx.xxx.xxx.69.59352 > xxx.xxx.xxx.95.8006: Flags [S], cksum 0xe204 (incorrect -> 0x616b), seq 112571967, win 64240, options [mss 1460,sackOK,TS val 2211496425 ecr 0,nop,wscale 7], length 0
11:07:45.395663 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    xxx.xxx.xxx.95.8006 > xxx.xxx.xxx.69.59352: Flags [S.], cksum 0xc88b (correct), seq 1786034234, ack 112571968, win 31856, options [mss 1460,sackOK,TS val 2999861713 ecr 2211496425,nop,wscale 7], length 0
11:07:45.395717 IP (tos 0x0, ttl 64, id 43600, offset 0, flags [DF], proto TCP (6), length 52)
    xxx.xxx.xxx.69.59352 > xxx.xxx.xxx.95.8006: Flags [.], cksum 0xe1fc (incorrect -> 0x71d2), seq 1, ack 1, win 502, options [nop,nop,TS val 2211496425 ecr 2999861713], length 0
11:07:45.396383 IP (tos 0x0, ttl 64, id 43601, offset 0, flags [DF], proto TCP (6), length 1585)
    xxx.xxx.xxx.69.59352 > xxx.xxx.xxx.95.8006: Flags [P.], cksum 0xe7f9 (incorrect -> 0x5b13), seq 1:1534, ack 1, win 502, options [nop,nop,TS val 2211496426 ecr 2999861713], length 1533
11:07:45.396917 IP (tos 0x0, ttl 64, id 19636, offset 0, flags [DF], proto TCP (6), length 52)
    xxx.xxx.xxx.95.8006 > xxx.xxx.xxx.69.59352: Flags [.], cksum 0x6ccf (correct), seq 1, ack 1534, win 249, options [nop,nop,TS val 2999861715 ecr 2211496426], length 0
11:07:45.398796 IP (tos 0x0, ttl 64, id 19637, offset 0, flags [DF], proto TCP (6), length 1899)
    xxx.xxx.xxx.95.8006 > xxx.xxx.xxx.69.59352: Flags [P.], cksum 0xe933 (incorrect -> 0xe7ac), seq 1:1848, ack 1534, win 249, options [nop,nop,TS val 2999861716 ecr 2211496426], length 1847
11:07:45.398826 IP (tos 0x0, ttl 64, id 43603, offset 0, flags [DF], proto TCP (6), length 52)
    xxx.xxx.xxx.69.59352 > xxx.xxx.xxx.95.8006: Flags [.], cksum 0xe1fc (incorrect -> 0x64a6), seq 1534, ack 1848, win 488, options [nop,nop,TS val 2211496428 ecr 2999861716], length 0
11:07:45.400233 IP (tos 0x0, ttl 64, id 43604, offset 0, flags [DF], proto TCP (6), length 132)
    xxx.xxx.xxx.69.59352 > xxx.xxx.xxx.95.8006: Flags [P.], cksum 0xe24c (incorrect -> 0x49d3), seq 1534:1614, ack 1848, win 488, options [nop,nop,TS val 2211496430 ecr 2999861716], length 80
11:07:45.401055 IP (tos 0x0, ttl 64, id 19639, offset 0, flags [DF], proto TCP (6), length 562)
    xxx.xxx.xxx.95.8006 > xxx.xxx.xxx.69.59352: Flags [P.], cksum 0xab4f (correct), seq 1848:2358, ack 1614, win 249, options [nop,nop,TS val 2999861719 ecr 2211496430], length 510
11:07:45.401107 IP (tos 0x0, ttl 64, id 43605, offset 0, flags [DF], proto TCP (6), length 181)
    xxx.xxx.xxx.69.59352 > xxx.xxx.xxx.95.8006: Flags [P.], cksum 0xe27d (incorrect -> 0x8c2f), seq 1614:1743, ack 2358, win 485, options [nop,nop,TS val 2211496431 ecr 2999861719], length 129
11:07:45.404904 IP (tos 0x0, ttl 64, id 19640, offset 0, flags [DF], proto TCP (6), length 2818)
    xxx.xxx.xxx.95.8006 > xxx.xxx.xxx.69.59352: Flags [P.], cksum 0xecca (incorrect -> 0xe7a9), seq 2358:5124, ack 1743, win 249, options [nop,nop,TS val 2999861723 ecr 2211496431], length 2766
11:07:45.405098 IP (tos 0x0, ttl 64, id 43606, offset 0, flags [DF], proto TCP (6), length 52)
    xxx.xxx.xxx.69.59352 > xxx.xxx.xxx.95.8006: Flags [.], cksum 0xe1fc (incorrect -> 0x5713), seq 1743, ack 5124, win 464, options [nop,nop,TS val 2211496435 ecr 2999861723], length 0
11:07:45.405509 IP (tos 0x0, ttl 64, id 43607, offset 0, flags [DF], proto TCP (6), length 76)
    xxx.xxx.xxx.69.59352 > xxx.xxx.xxx.95.8006: Flags [P.], cksum 0xe214 (incorrect -> 0x7928), seq 1743:1767, ack 5124, win 468, options [nop,nop,TS val 2211496435 ecr 2999861723], length 24
11:07:45.405520 IP (tos 0x0, ttl 64, id 43608, offset 0, flags [DF], proto TCP (6), length 52)
    xxx.xxx.xxx.69.59352 > xxx.xxx.xxx.95.8006: Flags [F.], cksum 0xe1fc (incorrect -> 0x56f6), seq 1767, ack 5124, win 468, options [nop,nop,TS val 2211496435 ecr 2999861723], length 0
11:07:45.406118 IP (tos 0x0, ttl 64, id 19642, offset 0, flags [DF], proto TCP (6), length 52)
    xxx.xxx.xxx.95.8006 > xxx.xxx.xxx.69.59352: Flags [F.], cksum 0x57cf (correct), seq 5124, ack 1768, win 249, options [nop,nop,TS val 2999861724 ecr 2211496435], length 0
11:07:45.406146 IP (tos 0x0, ttl 64, id 43609, offset 0, flags [DF], proto TCP (6), length 52)
    xxx.xxx.xxx.69.59352 > xxx.xxx.xxx.95.8006: Flags [.], cksum 0xe1fc (incorrect -> 0x56f3), seq 1768, ack 5125, win 468, options [nop,nop,TS val 2211496436 ecr 2999861724], length 0
^C
16 packets captured
16 packets received by filter
0 packets dropped by kernel
 
You must log in or register to reply here.
Top Bottom
Back