Reboot Caused PVE-firewall to block all lxc/vm traffic to the network

[joeslost]

Hello Gang,
I am at my wits end with the pve-firewall. I had everything working swimmingly but I had a crash with pihole and had to reboot the host.
Since the reboot all of my LXCx/and VMs cannot ping even the host, or gateway. But I can ping them from the host. Trying to ping them from other devices on the network results in a timeout.

I am able to access the PVE GUI fine by direct Ip access, but I cannot access any guest, with the browser, with curl, or ping.

When it comes to networking, I am a total newbie. I have learned a ton working with proxmox and setting up my dream router 7, but my ignorance is still vast.

I have uploaded here the results of pve-firewall compile, iptables-save, the contents of cluster.fw and host.fw.

Its worth noting that in order to disable the firewall I need to uncheck the firewall at the datacenter level and then reboot the node.
Unchecking that box and running pve-firewall stop does not seem to be enough, even though pve-firewall status shows disabled/stopped.

Thanks in advance for taking the time to read this and give advice.
Joseph

 

[shanreich]

Looks like you have Docker running on the host, which is known to mess with the firewall rules generated by pve-firewall. Have you tried turning off docker and checking if the network works then? Generally we recommend to run docker in a separate VM, not in a container and definitely not on the host - since it will lead to issues like you are seeing.

 

[joeslost]

Thank you so much! Docker was indeed installed and running (albeit doing nothing) on the host causing this problem. I must have absentmindedly installed it there since I do run docker in a separate lxc. After another reboot I am up in running!