PVE 9.0.3 suffered from DNS Drop after a upgrade...

[gunterwa]

Hi Buddies,

I suddenly found my PVE both PVE host and VMs running on top of PVE ARE all DNS blocked, CLI on PVE host:



Per ChatGTP's suggestion I tried to delete the DROP ACTION "iptables -D PVEFW-Reject 11" & "iptables -D PVEFW-Drop 12"... But they will be recoveried very soon, like this:

root@CBNi-GZ-PVE01:/etc/pve/firewall# iptables -L -n | grep "DROP.*udp spt:53"
DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:53
DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:53
root@CBNi-GZ-PVE01:/etc/pve/firewall#

And I've also tried to add below RULES to /etc/pve/firewall/cluster.fw and restart pve-firewall, no help at all. The DROP action is obviously of higher priority than below RULES.

[RULES]

IN ACCEPT -p udp --sport 53
IN ACCEPT -p tcp --sport 53
OUT ACCEPT -p udp --dport 53
OUT ACCEPT -p tcp --dport 53

Any suggestions and commnets will be hightly appreciated!

 

[gunterwa]

Online waiting ...

 

[gunterwa]

I've been with PVE 7.x and 8.x for more than three years, they are stable. This new node I tried PVE 9, surprise .(.

 

[gunterwa]

The line 118 is the root cause I think, I cannot remove the blocker so far...

root@PVE01:/home/test# iptables -L PVEFW-FORWARD -n -v | grep "DROP.*udp.*53"
root@PVE01:/home/test# iptables -L PVEFW-INPUT -n -v | grep "DROP.*udp.*53"
root@PVE01:/home/test# iptables -L PVEFW-OUTPUT -n -v | grep "DROP.*udp.*53"
root@PVE01:/home/test#
root@PVE01:/home/test# iptables -L PVEFW-Reject -n -v | grep "DROP.*udp.*53"
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:53
root@PVE01:/home/test# iptables -L PVEFW-Drop -n -v | grep "DROP.*udp.*53"
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:137 dpts:1024:65535
2 118 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:53