Web UI / Shell disconnects with code 1006 – root cause IGMP Proxy / Snooping

[bru87]

I’m sharing this in case it helps someone else, because this issue was extremely hard to diagnose and looked like a Proxmox or kernel problem at first.

Topology​

ISP → ONT → Router → ZimaBoard 2 (pfSense)
→ Switch (VLANs)
→ Proxmox VE nodes

• Proxmox VE cluster (2 nodes + qdevice)
• Multiple VLANs
• pfSense used as router/firewall
• Accessing Proxmox via Web UI shell and SSH

Symptoms​

• Proxmox Web UI works, but shell disconnects after ~10–15 seconds
• SSH sessions from macOS/Linux also freeze and then timeout
• Error in browser console: WebSocket close code 1006
• ICMP (ping) works perfectly and never drops
• TCP connections remain in ESTABLISHED state but stop transferring data
• Issue happens even with no VMs or containers running
• Happens both from Proxmox GUI shell and external SSH clients

This made it look like:

• Proxmox bug
• kernel / driver issue
• cluster or corosync instability
• NIC offloading problem

…but none of those were the cause.

Investigation​

• Verified corosync, quorum, HA → OK
• Disabled GPU passthrough, VMs, containers → no change
• Checked NIC offloading, MTU, VLAN config → no change
• Packet captures showed TCP packets being silently dropped, not reset

At this point it was clear the problem was not Proxmox, but somewhere in the network path.

Root Cause​

On the router, the following were enabled:

• IGMP Proxy
• IGMP Snooping

Even though no multicast was intentionally used for Proxmox management traffic.


With:

VLANs

• bridge interfaces
• inter-VLAN routing

IGMP Proxy / Snooping caused silent drops of long-lived TCP connections, while ICMP kept working.

This resulted in:

SSH freezing

• Proxmox Web UI shell disconnecting (code 1006)
• “ghost” timeouts without clear errors
  

Solution​

On Router:

• Disable IGMP Proxy
• Disable IGMP Snooping

After disabling both:

• SSH sessions remain stable
• Proxmox Web UI shell works indefinitely
• No more WebSocket 1006 errors
• No packet loss observed

Conclusion​

This was a network-layer issue, not a Proxmox bug.

IGMP Proxy / Snooping can break TCP sessions in VLAN + bridge + routing setups, even when multicast is not explicitly used.

Posting this because it’s a very “ghost-like” issue and easy to misdiagnose.

Hope this helps someone else avoid losing days on the same problem.

 

[weehooey-cd]

Hi bru87!

I do not have any comment on the resolution you found, but just wanted to say that I appreciated reading this well laid out post. Thank you for sharing!