Proxmox Gui not accessible, even with 8006 allowed

[Tom1100]

Hello,
I tried to avoid another Post in this Forum where the Solution is probably stupid easy, but I was not able to figure the following problem out, for days.

Server Setup:
Proxmox runs on a dedicated server of Hetzner
I have one static IPv4 + an extra IPv4/29 Subnet
I access the proxmox host through the one static IPv4 and the Subnet is for the VMs.
I have also an IPv6/64 Subnet.

CPU: AMD Ryzen 7 1700X
RAM: 4x RAM 16384 MB DDR4
2x 512 Sata SSD in Software Raid 1

I also created a cluster but only the Cluster create node is part of the cluster yet.



The Problem is that I can't access the WebGui when the Firewall is on.
Other Ports like 22 that I have added into the GUI (when Firewall is off) are working.
I tried to figure out which ports has to be opened (normally only 8006) by opening all Ports 0-65535 and then splitting that up in 0-29999 and 30000-65535 and testing out where the error could be. The weird thing is, when I have 0-65535 and the firewall on, I can access the GUI, but if I have 0-29999 and 30000-65535 and the same time I can't access the GUI anymore.


Thats the screenshot of the Security Group which I have called "default". I tried testing out every port I found in any docs about proxmox.









The Firewall that comes from Hetzner is opened except two ports 111 and 3389

That's the Output after I started the Firewall via "pve-firewall start" and using "sudo iptables -L INPUT -v -n"


Do you need any further Informations like /etc/hosts or /etc/network/interfaces?
Or any command to get all firewall rules on iptables?

I hope that's nothing common and I'm too blind to see.
Thanks in advance

Regards Tom

 

[remark]

Try to remove S.Port 8006, leave D.Port only in last rule.
Usually connections are made from random source ports,

 

[remark]

iptables rules work ONLY on full match -- so, that rule works and pass traffic only when TCP packet have source port 8006 AND destination port 8006.

 

[Tom1100]

Intresting doesn't proxmox translate the gui stuff into iptables? I did delete the source port entry and it seems working

 

[remark]

Intresting doesn't proxmox translate the gui stuff into iptables? I did delete the source port entry and it seems working

This is not Proxmox issue. This is how iptables works. To write rules in the right way, you need basic knowledge of iptables and kernel packet filter logic.

 

[B.Otto]

Intresting doesn't proxmox translate the gui stuff into iptables? I did delete the source port entry and it seems working

It does.

You were missing a thing how TCP connections work: The client (your browser) chooses a random high port (1024+) as source port and connects to the port 8006/tcp on the server. That way you can make several different TCP-Connections from the client to the same service on the server (which then have different source-dest-port combinations).

So for incoming TCP traffic you never know what the source port is. Only the destination-port is known which decides what service you want.