VM VPN Client network traffic not working when Firewall enabled on Datacenter

B

bfkmnemonic

New Member
Dec 19, 2025
5
0
1
Hi,

I have an issue where when I enable the Firewall on the Datacenter some VM traffic is blocked even when firewall is not enabled on the VM.

Just to clearify. This is how I reproduce the problem.

1. Connect to a specific VM using the console
2. Connect to a customer site using Cisco VPN client

Result:
The VPN connection is established after valid login.

3. Enable Firewall on the Datacenter in the tree inside Proxmox VE.
4. Check that Firewall is NOT enabled on the given VM (Also Output Policy traffic is set to ACCEPT on the VM and on the Datacenter. Also Forward Policy is set to ACCEPT on the Datacenter, also there are no rules in the Firewall section for the VM, and the Datacenter has normal management rules. Only allow rules are created.)
5. Connect to a customer site using Cisco VPN client

Result:
The VPN client cannot connect and never asks for credentials

6. Disable Firewall on the Datacenter in the tree inside Proxmox VE.
7. Connect to a customer site using Cisco VPN client

Result:
The VPN connection is established after valid login.

Software Versions:
Proxmox VE 9.2 including all updates from the Non-Subscription Repo last week.
VMs a re running on CEPH's.

Please feel free to ask for additional information.

Does anyone know what can be the cause of this problem? There might be more traffic that does not work, but this is very easy for me to test.

Best Regards
Brian
 
I’m not very familiar with this either, but I’m curious about the firewall logs. With the Datacenter Firewall enabled, do the firewall logs on the affected PVE node show any dropped or rejected traffic related to the VM when you try to connect to the VPN?
 
Just tested.
- The VM firewall log show no output
- The Host firewall log show only ACCEPT entries in the log
 
This sounds like a potential conntrack issue. For testing purposes, does setting nf_conntrack_allow_invalid in the host firewall configuration work?
 
  • Like
Reactions: bfkmnemonic
shanreich said:
This sounds like a potential conntrack issue. For testing purposes, does setting nf_conntrack_allow_invalid in the host firewall configuration work?
Click to expand...
Thank you for helping.

I am not sure what you want me to do..
I have these settings on the host where the VM is running:
1790858506220.png
 
The setting is currently not exposed in the UI, you'd need to add it manually to your host.fw configuration in /etc/pve/nodes/{nodename}/host.fw
 
It does allow all packets to go through that have CT state invalid. This means that all packets that do not start a new connection flow (e.g. a TCP SYN), but are also not part of an existing connection flow get allowed through the firewall. The other firewall rules still apply regardless.

There are certain connection patterns that can wrongfully trigger a CT state invalid on a PVE host, I'd have to take a closer look at the exact VPN traffic in your case in order to know why this happens. If you could provide a tcpdump of a failed connection I could take a closer look.

With Cisco appliances, oftentimes TCP Sequence Randomization can ause this - although I'm not sure if this is the case here since you're using a VPN..
 
You must log in or register to reply here.
Top Bottom
Back