pve-firewall log: "value does not look like a valid IP address or CIDR network"

[markus7220]

Hello,

above error currently pollutes my machine's log with 24 log entries every 10 seconds. These are all shown via journalctl, MyNode > System > System log and pve-firewall:

root@pve:~# pve-firewall status
value does not look like a valid IP address or CIDR network
...
value does not look like a valid IP address or CIDR network
Status: enabled/running

There is no hint in the log line, what the actual mal-formatted entry is. There also is no error indicator for firewall/ipset entries in web interface. Having had a first manual glance at all rules/ipsets/aliases, I could not find an obvious format mistake (like non-fitting CIDR IP).

What is weird: I always entered firewall rules, IP sets, and aliases via Promox web interface, never manually edited files on terminal, so no idea, how this could have been caused.

PVEv9 with iptables/pve-firewall is used.
(There was a hint, that proxmox-firewall/nftables might deliver more details, but IIRC that's currently experimental and not used as default. )

How can this error be debugged and traced further, as apparently not providing additional information?

Thanks in advance

 

[abied-charreton]

Hello, which pve-firewall version do you currently run? (pveversion -v)?

Also, do you have any ipfilter-* IPSets with alias members defined in some guest firewall configs?

 

[markus7220]

Appreciate the quick answer @abied-charreton.

root@pve:~# pveversion -v
proxmox-ve: 9.2.0
...
proxmox-firewall: 1.2.3
...
pve-firewall: 6.0.6

Also, do you have any ipfilter-* IPSets with alias members defined in some guest firewall configs?

Do you mean those values under [VM ID] > Firewall > IPSet > ipfilter-net0 ?
Yes, multiple VMs have an alias dc/xxx declared for IP spoofing protection - is that wrong or not supported?

 

[abied-charreton]

Okay, thanks for confirming. This is a supported configuration, however there is a bug in how pve-firewall builds the ARP filter from those IPSets. Alias members are not resolved, which aborts the generation of all ebtables rules for the guest.

The rules have already been missing before, but the error was not logged; pve-firewall 6.0.6 started logging it with this commit [0], which is why the messages only started appearing recently.

I sent a fix already [1]. Until it is released, you can work around this bug by replacing all alias members in the ipfilter-netX IPSets with the actual IP addresses. You can verify the result with ebtables -L.

Thanks a lot for reporting this!!

[0] https://git.proxmox.com/?p=pve-fire...e;hp=0644089430cd7feac0c1058cc82188db7b661173
[1] https://lore.proxmox.com/pve-devel/20261012093956.285433-1-a.bied-charreton@proxmox.com/T/#t

 

[markus7220]

Ah, that's interesting.
Out of interest: The bug must have been introduced at some point in v9, right? As latest v8 + ipfilter-netX worked fine for me.
I can live with those logs, till your fix gets released, so that I do not need to re-configure aliases.
Thank you very much!