[SOLVED] unable to ping outside when firewall turned on

Discussion in 'Proxmox VE: Networking and Firewall' started by lodperera, Feb 13, 2017.

  1. lodperera

    lodperera New Member

    Joined:
    Jan 28, 2016
    Messages:
    15
    Likes Received:
    0
    Hi Guys,

    Need some assistance to figure out why I cannot ping outside from VM when firewall is on.

    no firewall rules are enabled.

    INPUT and OUTPUT policies are ACCEPT both on datacenter level and VM level.

    When the firewall is disabled on the VM interface
    1. can ping outside from VM
    2. can ping the VM from outside
    When the firewall is enabled on the VM interface
    1. cannot ping outside from VM
    2. can ping the VM from outside

    attached is "iptables -L" extract from the node once I enabled the firewall on the VM interface.
    tap103i0 is the interface.
     

    Attached Files:

    #1 lodperera, Feb 13, 2017
    Last edited: Feb 14, 2017
  2. lodperera

    lodperera New Member

    Joined:
    Jan 28, 2016
    Messages:
    15
    Likes Received:
    0
    I did some further testing.

    I added icmp accept out and in. still it didn't do any change.

    It is because it has DROP all rule to begin with.

    Can any one please be kind enough to explain whether this behavior is expected?

    Code:
    root@s1n2:~# iptables -L tap103i0-OUT -v
    Chain tap103i0-OUT (1 references)
     pkts bytes target     prot opt in     out     source               destination
        0     0 PVEFW-SET-ACCEPT-MARK  udp  --  any    any     anywhere             anywhere            [goto]  udp spt:bootpc dpt:bootps
        0     0 DROP       all  --  any    any     anywhere             anywhere             MAC ! 1A:F8:07:76:29:74
       13  1008 DROP       all  --  any    any     anywhere             anywhere             ! match-set PVEFW-103-ipfilter-net0-v4 src
        0     0 MARK       all  --  any    any     anywhere             anywhere             MARK and 0x7fffffff
        0     0 PVEFW-SET-ACCEPT-MARK  icmp --  any    any     anywhere             anywhere            [goto]
        0     0 GROUP-icmp-OUT  all  --  any    any     anywhere             anywhere
        0     0 RETURN     all  --  any    any     anywhere             anywhere             mark match 0x80000000/0x80000000
        0     0 PVEFW-SET-ACCEPT-MARK  all  --  any    any     anywhere             anywhere            [goto]
        0     0            all  --  any    any     anywhere             anywhere             /* PVESIG:f/r9skkWpkkc3eIoCRuRhVMcTHQ */
    root@s1n2:~#
    
    
     
    #2 lodperera, Feb 14, 2017
    Last edited: Feb 14, 2017
  3. lodperera

    lodperera New Member

    Joined:
    Jan 28, 2016
    Messages:
    15
    Likes Received:
    0
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice