PVE firewall with NAT not working

[5k7]

Hello,

I set fresh Proxmox on dedicated server with Hetzner. I have only one IPv4 and IPv6 subnet. Everything is working fine means:
- 3 interfaces: eno1, vmbr0 routed and vmbr1 with NAT.
- I can reach VM directly through ipv6
- VM can reach ipv4 network through NAT

/etc/network/interfaces

### LOOPBACK ###
auto lo
iface lo inet loopback
iface lo inet6 loopback

### IPv4 ###
# Main IPv4 from Host
auto eno1
iface eno1 inet static
  address <MAIN IP>
  netmask 255.255.255.255 
  gateway <GATEWAY_IP>
  pointopoint <GATEWAY_IP>

### IPv6 ###
# Main IPv6
iface eno1 inet6 static
  address <ipv6 addr from subnet>::2
  netmask 128
  gateway <gateway>
  up sysctl -p


### VM-Routed IPv4
auto vmbr0
iface vmbr0 inet static
  address <MainIP>
  netmask 255.255.255.255
  bridge_ports none
  bridge_stp off
  bridge_fd 0

#VM-Routed IPv6
iface vmbr0 inet6 static
  address <ipv6>::3
  netmask 64
  up ip -6 route add <ipv6>::/64 dev vmbr0

### Private NAT used by Proxmox
auto vmbr1
iface vmbr1 inet static
  address  10.10.10.1
  netmask  255.255.255.0
  bridge_ports none
  bridge_stp off
  bridge_fd 0
  bridge_maxwait 0
  post-up   iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o eno1 -j MASQUERADE
  post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o eno1 -j MASQUERADE

VM configuration:

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet6 static
        address <ipv6>::4/64
        gateway <ipv6>::3

auto eth1
iface eth1 inet dhcp

For now at least at point I am everything is working like expected. Problem is when I turn on firewall I cannot longer use IPv4 from VM. I have firewall enabled only at datacenter level with entries for SSH and 8006 port for GUI. IPv6 seems to be working fine.

Should I add some special entry for vmbr1 with NAT to keep connection initiated from VM?

 

[mira]

See 3.3.6 in the docs: https://pve.proxmox.com/pve-docs/pve-admin-guide.html#sysadmin_network_configuration

In some masquerade setups with firewall enabled, conntrack zones might be needed for outgoing connections. Otherwise the firewall could block outgoing connections since they will prefer the POSTROUTING of the VM bridge (and not MASQUERADE).

And the solution mentioned in the docs:

post-up   iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1

See if that fixes the issue for you.

 

[5k7]

Indeed that fixed the problem. Now everything is working like a charm. Thank you very much.

 

[Code-Exec]

May be my decision will be more comfortable for NAT manage - https://forum.proxmox.com/threads/proxmox-nat-on-gui-for-everyone.82323/