Hello,
I've just started enabling the Proxmox firewall and am having an issue with a single VM. The VM in question is the only one that is using VLAN tagging within the VM. Networking functionality works fine, but upon enabling the PVE firewall there is no effect on this single VM. The firewall simply does not restrict any traffic that it is configured to. (Note - Other VMs firewall is working and the host firewall is working)
During troubleshooting, I was able to get the firewall to work by reconfiguring the VM nic (net0) to tag=123 and then changing the VM's Debian interface config to reflect the change (omitting the ens1.xx(s) configs and only leave a static IP for ens1. Upon making this change the firewall started working correctly.
Is this normal behavior? Is the PVE firewall unable to work correctly when tagging vlan traffic to the VM? Any help would be appreciated.
I tested with bot virtio and e1000. (quem guest tools are installed)
VM NIC Config
net0 virtio (or e1000) =00:00:00:00:00:00,bridge=vmbr1,firewall=1
Host Bridge Config
auto vmbr1
iface vmbr1 inet manual
bridge-ports xxxxxxxxxxxx
bridge-stp off
bridge-fd 0
bridge-vlan-aware yes
bridge-vids 2-4094
I've just started enabling the Proxmox firewall and am having an issue with a single VM. The VM in question is the only one that is using VLAN tagging within the VM. Networking functionality works fine, but upon enabling the PVE firewall there is no effect on this single VM. The firewall simply does not restrict any traffic that it is configured to. (Note - Other VMs firewall is working and the host firewall is working)
During troubleshooting, I was able to get the firewall to work by reconfiguring the VM nic (net0) to tag=123 and then changing the VM's Debian interface config to reflect the change (omitting the ens1.xx(s) configs and only leave a static IP for ens1. Upon making this change the firewall started working correctly.
Is this normal behavior? Is the PVE firewall unable to work correctly when tagging vlan traffic to the VM? Any help would be appreciated.
I tested with bot virtio and e1000. (quem guest tools are installed)
VM NIC Config
net0 virtio (or e1000) =00:00:00:00:00:00,bridge=vmbr1,firewall=1
Host Bridge Config
auto vmbr1
iface vmbr1 inet manual
bridge-ports xxxxxxxxxxxx
bridge-stp off
bridge-fd 0
bridge-vlan-aware yes
bridge-vids 2-4094