[SOLVED] unable to ping outside when firewall turned on

lodperera

New Member
Jan 28, 2016
15
0
1
Hi Guys,

Need some assistance to figure out why I cannot ping outside from VM when firewall is on.

no firewall rules are enabled.

INPUT and OUTPUT policies are ACCEPT both on datacenter level and VM level.

When the firewall is disabled on the VM interface
  1. can ping outside from VM
  2. can ping the VM from outside
When the firewall is enabled on the VM interface
  1. cannot ping outside from VM
  2. can ping the VM from outside

attached is "iptables -L" extract from the node once I enabled the firewall on the VM interface.
tap103i0 is the interface.
 

Attachments

Last edited:

lodperera

New Member
Jan 28, 2016
15
0
1
I did some further testing.

I added icmp accept out and in. still it didn't do any change.

It is because it has DROP all rule to begin with.

Can any one please be kind enough to explain whether this behavior is expected?

Code:
root@s1n2:~# iptables -L tap103i0-OUT -v
Chain tap103i0-OUT (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 PVEFW-SET-ACCEPT-MARK  udp  --  any    any     anywhere             anywhere            [goto]  udp spt:bootpc dpt:bootps
    0     0 DROP       all  --  any    any     anywhere             anywhere             MAC ! 1A:F8:07:76:29:74
   13  1008 DROP       all  --  any    any     anywhere             anywhere             ! match-set PVEFW-103-ipfilter-net0-v4 src
    0     0 MARK       all  --  any    any     anywhere             anywhere             MARK and 0x7fffffff
    0     0 PVEFW-SET-ACCEPT-MARK  icmp --  any    any     anywhere             anywhere            [goto]
    0     0 GROUP-icmp-OUT  all  --  any    any     anywhere             anywhere
    0     0 RETURN     all  --  any    any     anywhere             anywhere             mark match 0x80000000/0x80000000
    0     0 PVEFW-SET-ACCEPT-MARK  all  --  any    any     anywhere             anywhere            [goto]
    0     0            all  --  any    any     anywhere             anywhere             /* PVESIG:f/r9skkWpkkc3eIoCRuRhVMcTHQ */
root@s1n2:~#
 
Last edited:

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE and Proxmox Mail Gateway. We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get your own in 60 seconds.

Buy now!