PVE + Hetzner vSwitch network issue

AdiP

New Member
Mar 20, 2020
1
0
1
Hello,
I am having a very odd issue with my setup - it is on PVE (7.1-10) running on a Hetzner dedicated box and using vSwitch additional network.

Background and setup:
I have a Hetzner vSwitch attached to my server. That vSwitch has an additional /28 public network on it.
When working with hetzner rescue system, everything is ok. However, as soon as i route it through PVE, I get very weird issues, such as apt update not working on the machines even though they have network connectivity.

The issue:
I use a Mikrotik router in a VM normally; but to test this issue, I removed that step - I created a simple ubuntu CT directly connected to vmbr1, having a public IP address, correct netmask & gateway.
It is able to ping, but when i do apt update, or even wget google.com it just sits there.. either at 0% or 'Waiting for Headers' state.
If I see network stats, I see data moving at few B/s (bytes per second) rate, which I don't seems to understand why.

If someone has experienced this, or knows what might be the issue, any help is appreciated!
Thanks in advance!

My PVE network config:
Code:
auto enp9s0
iface enp9s0 inet static
        address xxx.xxx.xxx.xx/xx
        gateway xxx.xxx.xxx.x
        up route add -net xxx.xxx.xxx.x netmask xxx.xxx.xxx.xxx gw xxx.xxx.xxx.x dev enp9s0

auto enp9s0.4000
iface enp9s0.4000 inet manual
        mtu 1400
#vSwitch WAN

auto vmbr0
iface vmbr0 inet manual
        bridge-ports none
        bridge-stp off
        bridge-fd 0
#LAN bridge

auto vmbr1
iface vmbr1 inet manual
        bridge-ports enp9s0.4000
        bridge-stp off
        bridge-fd 0
        mtu 1400
#up route add -host xx.xx.xx.xxx dev vmbr1
#WAN bridge

I tried with MTU 1400 & 1500 on the additional network (vmbr1 & VLAN). When 1500 - all of the additional network stops working.
And I tried with and without this up route add -host xx.xx.xx.xxx dev vmbr1 line in vmbr1. Both times, same issue.
 
VM is connected to vmbr1 I assume? In that case probably adjust vm's nic mtu to 1400. Test with
Code:
ping -s 1410 1.1.1.1
 
What is your /etc/pve/lxc/CT-ID.conf?

I'm also not sure, do you need to enable ip forwarding? I need it for the private network on vlan vmbr1, but I'm not sure if it is needed if you have public /28 on vlan vmbr1. I'm a networking noob.
 
Last edited: