PVE 9.0.3 firewall does not work, but same configuration work well in PVE 8.4.14 & 8.2.4

[gunterwa]

Hi,

I have two PVE clusters (PVE-A & PVE-B) running on 8.4.14 & 8.2.4 for more than 2 years (same configuration), a newly deployed PVE with PVE 9.0.3 reused the configuration of PVE-A & PVE-B. BUT the firewall does not work...

Config summary:

1. Enable FW on DC level with security-group;
2. Enable FW on physical host level with same security-group in step_1;
3. Enable FW (in "Option" menu) on VM&LXC level with white-list (ipset & fw entries)

trouble shooting summary (Per gemini suggestion):

1. Carefully check the configuration, make sure FW enabled on DC and host level; VM/LXC level, FW-->Option-->Enable FW, Input Policy default "DROP"....
2. I added two new entries in LXC FW entry then check on host "pve-firewall compile" can see the newly added ones. Yes, it did in my case, but still didn't work.

Any comments and suggestions will be highly appreciated!

 

[gunterwa]

3. VM/LXC network --> NIC --> Firewall enabled already.

 

[shanreich]

What is the status of the firewall daemon?

systemctl status pve-firewall

 

[gunterwa]

I checked the status of daemon pve-firewall, it's running well without any warning or error as below (I also restart pve-firewall but no help...) :

root@PVE01:/home/gunterwa# systemctl status pve-firewall
● pve-firewall.service - Proxmox VE firewall
Loaded: loaded (/usr/lib/systemd/system/pve-firewall.service; enabled; preset: enabled)
Active: active (running) since Mon 2026-09-07 13:32:00 CST; 6 days ago
Invocation: eb8e4a46ca224c13b30105c3339fff1b
Process: 4083191 ExecReload=/usr/sbin/pve-firewall restart (code=exited, status=0/SUCCESS)
Main PID: 3285565 (pve-firewall)
Tasks: 1 (limit: 154439)
Memory: 106M (peak: 207.2M)
CPU: 3h 46min 31.169s
CGroup: /system.slice/pve-firewall.service
└─3285565 pve-firewall

Sep 07 13:57:22 PVE01 pve-firewall[3285565]: received signal HUP
Sep 07 13:57:22 PVE01 pve-firewall[3285565]: server shutdown (restart)
Sep 07 13:57:22 PVE01 systemd[1]: Reloaded pve-firewall.service - Proxmox VE firewall.
Sep 07 13:57:23 PVE01 pve-firewall[3285565]: restarting server
Sep 08 11:37:22 PVE01 systemd[1]: Reloading pve-firewall.service - Proxmox VE firewall...
Sep 08 11:37:23 PVE01 pve-firewall[4083191]: send HUP to 3285565
Sep 08 11:37:23 PVE01 pve-firewall[3285565]: received signal HUP
Sep 08 11:37:23 PVE01 pve-firewall[3285565]: server shutdown (restart)
Sep 08 11:37:23 PVE01 systemd[1]: Reloaded pve-firewall.service - Proxmox VE firewall.
Sep 08 11:37:24 PVE01 pve-firewall[3285565]: restarting server
root@PVE01:/home/gunterwa#