Problem firewall dropping packet

root@FRI-KVM-50:~# systemctl status proxmox-firewall
● proxmox-firewall.service - Proxmox nftables firewall
Loaded: loaded (/lib/systemd/system/proxmox-firewall.service; enabled; preset: enabled)
Active: active (running) since Tue 2024-08-13 22:47:04 CEST; 3 weeks 1 day ago
Main PID: 2176 (proxmox-firewal)
Tasks: 1 (limit: 57394)
Memory: 2.7M
CPU: 21min 1.881s
CGroup: /system.slice/proxmox-firewall.service
└─2176 /usr/libexec/proxmox/proxmox-firewall

Aug 13 22:47:04 FRI-KVM-50 systemd[1]: Started proxmox-firewall.service - Proxmox nftables firewall.
root@FRI-KVM-50:~#





No firewall enabled at the VM level!
Shutting down the VM and started the VM and now the problem remain the same!
 
Can you check the MTU settings inside the VM?
 
Interesting, I'd have to take another look. Does your software provide any settings for MTU / packet size? It still seems suspicious that all packets, but the ones >1500 bytes, pass through so I'm almost positive it has to do with MTU handling somewhere. It's a bit weird that the packet is not sent fragmented in the first place - which leads me to believe that the server is not set up properly.

Curious as to why this only poses a problem when the firewall is active though.
 
Finally the workaround was to add this:

nf_conntrack_allow_invalid: 1

into the /etc/pve/nodes/"HOST"/host.fw

and reboot the node!

But there is a serious issue into the proxmox firewall....

Founded the workaround with this thread: https://forum.proxmox.com/threads/enabling-firewall-breaks-connection-to-all-vms.128946/

THis workaround need to be really temporary and the cause need to be fixed by ProxMox team urgently because this workaround can create big security breach into the system!
 
Last edited:
shanreich said:
Interesting, I'd have to take another look. Does your software provide any settings for MTU / packet size? It still seems suspicious that all packets, but the ones >1500 bytes, pass through so I'm almost positive it has to do with MTU handling somewhere. It's a bit weird that the packet is not sent fragmented in the first place - which leads me to believe that the server is not set up properly.

Curious as to why this only poses a problem when the firewall is active though.
Click to expand...
Hello!

Do you have some news for me?

This workaround is absolutly not a solution a long term....

Thank you
 
Has there ever been a solution found or published for these issues, the other threads dont seem to have reached a proper conclussion either.
We are experiencing a similiar issue on PVE 9.2.4 with SFTP uploads randomly timing out on the very first try because syn-ack cant complete, the packets never even leave the pve node.
We have managed to narrow it down to be an issue somewhere between the VMs network and the proxmox NIC, but no progress since.
Firewall being entirely off on the VM makes me think its related to conntrack which is still marking packets regardless.

Edit Sep 15
I have found my exact issue detailed and fixed here
E

[SOLVED] Thread 'pve-firewall REJECT rule from other VM prevents connection on first try'

Hi,

on a PVE 7.4 cluster, with vmbr0 (vlan aware, stp off), connected to bond0 (2 physical interfaces), with firewall enabled at the cluster level, I have an issue when first opening connections.

a VM protected (100) has a firewall policy in REJECT (so that connection errors are explicit)
a VM client (159) on the same host has no firewall enabled and tries to reach server (a service outside the cluster)

Here is what happens:

  1. after some inactivity, when the connection from client to server is attempted the client gets connection refused...
 
Last edited:
You must log in or register to reply here.
Top Bottom
Back