Upgrade PVE5.4 to PVE6 - suddenly, gre conntrack module is needed

H

haukenx

Active Member
Dec 16, 2018
23
1
43
48
Hello there,

this post is more for information puropses, should someone else stumble over the same problem.

We just upgraded our 5.4 environment to 6.0. To provide internal connectivity for some of our VMs, we have another ovs (vmbrX, with no physical device connected) on each node, all of them being linked in a mesh via GRE. It worked nicely all the time, until we upgraded to PVE6. Suddenly, the GRE traffic was blocked, assumingly by this rule:

-A PVEFW-Drop -m conntrack --ctstate INVALID -j DROP
Click to expand...

Solution: load module nf_conntrack_proto_gre.

I don't know, if this is meant to be like this, it got me off guard and had me search a while.

Kind regards,
Hauke
 
Thanks for sharing the find!

Did you see anything in the journal/dmesg which indicated that this might be the reason?

Thanks!
 
Hi,

no, I tcpdump-ed myself through it and then searched online. I found an old thread here, which guided me into the right direction.

Kind regards,
Hauke
 
You must log in or register to reply here.
Top Bottom