PVE 9.0.3 firewall does not work, but same configuration work well in PVE 8.4.14 & 8.2.4

G

gunterwa

Active Member
Apr 1, 2022
48
2
28
Hi,

I have two PVE clusters (PVE-A & PVE-B) running on 8.4.14 & 8.2.4 for more than 2 years (same configuration), a newly deployed PVE with PVE 9.0.3 reused the configuration of PVE-A & PVE-B. BUT the firewall does not work...

Config summary:

1. Enable FW on DC level with security-group;
2. Enable FW on physical host level with same security-group in step_1;
3. Enable FW (in "Option" menu) on VM&LXC level with white-list (ipset & fw entries)

trouble shooting summary (Per gemini suggestion):

1. Carefully check the configuration, make sure FW enabled on DC and host level; VM/LXC level, FW-->Option-->Enable FW, Input Policy default "DROP"....
2. I added two new entries in LXC FW entry then check on host "pve-firewall compile" can see the newly added ones. Yes, it did in my case, but still didn't work.

Any comments and suggestions will be highly appreciated!
 
What is the status of the firewall daemon?

Code: 
systemctl status pve-firewall
 
I checked the status of daemon pve-firewall, it's running well without any warning or error as below (I also restart pve-firewall but no help...) :

root@PVE01:/home/gunterwa# systemctl status pve-firewall
â—Ź pve-firewall.service - Proxmox VE firewall
Loaded: loaded (/usr/lib/systemd/system/pve-firewall.service; enabled; preset: enabled)
Active: active (running) since Mon 2026-09-07 13:32:00 CST; 6 days ago
Invocation: eb8e4a46ca224c13b30105c3339fff1b
Process: 4083191 ExecReload=/usr/sbin/pve-firewall restart (code=exited, status=0/SUCCESS)
Main PID: 3285565 (pve-firewall)
Tasks: 1 (limit: 154439)
Memory: 106M (peak: 207.2M)
CPU: 3h 46min 31.169s
CGroup: /system.slice/pve-firewall.service
└─3285565 pve-firewall

Sep 07 13:57:22 PVE01 pve-firewall[3285565]: received signal HUP
Sep 07 13:57:22 PVE01 pve-firewall[3285565]: server shutdown (restart)
Sep 07 13:57:22 PVE01 systemd[1]: Reloaded pve-firewall.service - Proxmox VE firewall.
Sep 07 13:57:23 PVE01 pve-firewall[3285565]: restarting server
Sep 08 11:37:22 PVE01 systemd[1]: Reloading pve-firewall.service - Proxmox VE firewall...
Sep 08 11:37:23 PVE01 pve-firewall[4083191]: send HUP to 3285565
Sep 08 11:37:23 PVE01 pve-firewall[3285565]: received signal HUP
Sep 08 11:37:23 PVE01 pve-firewall[3285565]: server shutdown (restart)
Sep 08 11:37:23 PVE01 systemd[1]: Reloaded pve-firewall.service - Proxmox VE firewall.
Sep 08 11:37:24 PVE01 pve-firewall[3285565]: restarting server
root@PVE01:/home/gunterwa#
 
Is it possible that you're running into this bug [1]?
If not, could you indicate what traffic you are trying to block (e.g. ping from 192.0.2.1 to 198.51.100.1) and the output of the generated firewall ruleset (iptables-save -c)?


https://bugzilla.proxmox.com/show_bug.cgi?id=2976
 
shanreich said:
Is it possible that you're running into this bug [1]?
If not, could you indicate what traffic you are trying to block (e.g. ping from 192.0.2.1 to 198.51.100.1) and the output of the generated firewall ruleset (iptables-save -c)?


https://bugzilla.proxmox.com/show_bug.cgi?id=2976
Click to expand...

I'd collected "the output of the generated firewall ruleset" to Gemini for analysis, and tried all the suggestions Gemini gave... Now, I configured iptables on VM/LXC basis for access control.
Is there any known bugs on PVE-firewall with PVE 9.0.3 which is of similar issue as I met?
 
gunterwa said:
Is there any known bugs on PVE-firewall with PVE 9.0.3 which is of similar issue as I met?
Click to expand...

I don't know of any that would match besides the one I mentioned, but in order to find out why it's not working in your case I'd need the output from iptables, as well as the indicated information so I can check for potential issues myself - otherwise it's hard to tell.


Can you please post the output of the following commands (in CODE blocks for better readability):

Code: 
iptables-save -c
cat /etc/pve/firewall/cluster.fw

As well for the VM in question (replace <VMID> in the commands below with the actual vmid, e.g. 100):

Code: 
qm config <VMID>
cat /etc/pve/firewall/<VMID>.fw

Please also indicate what kind of traffic is getting through the firewall that should get blocked (IPs, Protocol, Ports, ...).
 
shanreich said:
I don't know of any that would match besides the one I mentioned, but in order to find out why it's not working in your case I'd need the output from iptables, as well as the indicated information so I can check for potential issues myself - otherwise it's hard to tell.


Can you please post the output of the following commands (in CODE blocks for better readability):

Code: 
iptables-save -c
cat /etc/pve/firewall/cluster.fw

As well for the VM in question (replace <VMID> in the commands below with the actual vmid, e.g. 100):

Code: 
qm config <VMID>
cat /etc/pve/firewall/<VMID>.fw

Please also indicate what kind of traffic is getting through the firewall that should get blocked (IPs, Protocol, Ports, ...).
Click to expand...

Enclosed pls find the collected info, appreciate your support!
 

Attachments

Are the firewall bridges getting created? Can you post the output of

Code: 
ip a


Did you manually create firewall rules? It seems as if the following rule does prevent any guest firewalling from taking place:

Code: 
[19203900824:22648911724238] -A FORWARD -j ACCEPT

This rule usually should not get created by the PVE firewall stack.
 
Last edited:
You must log in or register to reply here.
Top Bottom
Back