VMs not reacheable after en- and disabling Firewall

[esprox]

I wanted to firewall a specific vm. I set a rule that should allow ssh in at the vm and then enabled the firewall for the vm and for the data center. My rule didn't work and I disabled the firewall at data center level. But my vms and lxcs are still not reachable.

I can:

• ssh into proxmox node
• open proxmox web interface
• open vm's novnc console in web interface
• see the vms in my router's list of connected devices

I can't

• ping my vms
• ssh into my vms
• open their web apps on their ports
• ping any website from the vm (via novnc)

I found some similar threads but they are mostly about losing access to the web interface - this was always reachable for me.

Some checks:
I disabled firewall on datacenter, node and vm levels

pve-firewall status
Status: disabled/stopped

ufw status on a vm allows ssh

Rebooting the node did not help.

I then re-enabled firewall on data center level and set Input Policy to ACCEPT, but I still can't reach my vms. During my tinkering, they are sometimes running into a timeout and sometimes instantly failing, I guess that's the difference between DROP and REJECT, but should they not be reacheable if the firewall is disabled on every level?

 

[esprox]

It's working again after I restored a backup of the proxmox machine. Can't say exactly what the issue was unfortunately.

 

[changlee]

Where do you store the backups? You used backup or snapshot for restore?

 

[esprox]

I meant a backup of the proxmox installation itself. I've been using this:
https://github.com/DerDanilo/proxmox-stuff/tree/master

The Restore didn't work out of the box, had to change the path in the restore script and remove /etc/pve as it said

Mär 07 20:36:15 pmxcfs[5036]: fuse: mountpoint is not empty
Mär 07 20:36:15 pmxcfs[5036]: fuse: if you are sure this is safe, use the 'nonempty' mount option
Mär 07 20:36:15 pmxcfs[5036]: [main] crit: fuse_mount error: File exists

(solution from https://forum.proxmox.com/threads/installation-to-start-pve-cluster.85490/ )

Regarding my vms/lxcs, their life partitions are on one zfs pool and the daily snapshots on another, but those were not needed in this case.

 

[changlee]

Thanks for that.