Problem on firewall in PX 8.1.4 (enterprise) very last upgrade

[Luca De Andreis]

Hi all,

I've a 3 nodes cluster running in PX 8.1.4 (ent repository, full upgrade) only 1 VM use firewall (to block RDP access from specific source in subnet level).
The whole thing has always worked correctly, we haven't changed that firewall rule (in Proxmox) in years.

Today we noticed a problem.

On a VM, connected to a specific VMBR, the firewall is active, it allows access to port 3389 are to specific sources, otherwise it does a drop.
On the same host and on the same VMBR, if I try to connect in RDP to another machine, even if that machine has the firewall DISABLED, the above rules continue to apply.

Until a few weeks ago we had no problems and the behavior was correct.

One (perhaps important) note, the vmbr in question is configured in promiscuous mode (I don't know if that has anything to do with it or not, but full disclosure).

 

[Luca De Andreis]

Yes I can confirm, the problem is easily reproduced. I've created a new VM (a Debian live), remapped SSH to tcp 3389 and tried to do a telnet on that port, although the firewall is disabled the same rules are applied as in the VM that has it enabled (on the same VMBR).

 

[Luca De Andreis]

Mhhhh I've solved to set DROP instead of REJECT.
Setting DROP in a specific rules in a single VM, other VMs in the same vmbr are not affected, by setting REJECT, they are.
Whether it is a correlation with the promiscuous mode setting of the vmbr ?