[SOLVED] unable to ping outside when firewall turned on

[lodperera]

Hi Guys,

Need some assistance to figure out why I cannot ping outside from VM when firewall is on.

no firewall rules are enabled.

INPUT and OUTPUT policies are ACCEPT both on datacenter level and VM level.

When the firewall is disabled on the VM interface

1. can ping outside from VM
2. can ping the VM from outside

When the firewall is enabled on the VM interface

1. cannot ping outside from VM
2. can ping the VM from outside

attached is "iptables -L" extract from the node once I enabled the firewall on the VM interface.
tap103i0 is the interface.

 

[lodperera]

I did some further testing.

I added icmp accept out and in. still it didn't do any change.

It is because it has DROP all rule to begin with.

Can any one please be kind enough to explain whether this behavior is expected?

root@s1n2:~# iptables -L tap103i0-OUT -v
Chain tap103i0-OUT (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 PVEFW-SET-ACCEPT-MARK  udp  --  any    any     anywhere             anywhere            [goto]  udp spt:bootpc dpt:bootps
    0     0 DROP       all  --  any    any     anywhere             anywhere             MAC ! 1A:F8:07:76:29:74
   13  1008 DROP       all  --  any    any     anywhere             anywhere             ! match-set PVEFW-103-ipfilter-net0-v4 src
    0     0 MARK       all  --  any    any     anywhere             anywhere             MARK and 0x7fffffff
    0     0 PVEFW-SET-ACCEPT-MARK  icmp --  any    any     anywhere             anywhere            [goto]
    0     0 GROUP-icmp-OUT  all  --  any    any     anywhere             anywhere
    0     0 RETURN     all  --  any    any     anywhere             anywhere             mark match 0x80000000/0x80000000
    0     0 PVEFW-SET-ACCEPT-MARK  all  --  any    any     anywhere             anywhere            [goto]
    0     0            all  --  any    any     anywhere             anywhere             /* PVESIG:f/r9skkWpkkc3eIoCRuRhVMcTHQ */
root@s1n2:~#

 

[lodperera]

I had to add the IP address of the server into IPSET using the name ipfilter-net0

http://pve.proxmox.com/wiki/Firewall#pve_firewall_ip_sets