gave this a test on my machine:
* tested outgoing/incoming connectivity for guests
* tested DHCP in a simple zone
* checked generated firewall rulesets with setting on/off
small nit: settings is called nf_conntrack_allow_invalid, not
nt_conntrack_allow_invalid - maybe we could change that on commit?
consider this:
Tested-by: Stefan Hanreich <s.hanre...@proxmox.com>
Reviewed-by: Stefan Hanreich <s.hanre...@proxmox.com>
On 3/12/25 14:20, Hannes Laimer wrote:
> ... on the guest table. There is no reason to not repect that option
> on those two chains. These two were missed in the referenced commit.
>
> Signed-off-by: Hannes Laimer <h.lai...@proxmox.com>
> Fixes: 64dc344b ("firewall: apply `nt_conntrack_allow_invalid` option to
> guest table")
> Tested-by: Stefan Hanreich <s.hanre...@proxmox.com>
> Reviewed-by: Stefan Hanreich <s.hanre...@proxmox.com>
> ---
> no changes since v1, so I kept @Stefans T-b and R-b
>
> proxmox-firewall/resources/proxmox-firewall.nft | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/proxmox-firewall/resources/proxmox-firewall.nft
> b/proxmox-firewall/resources/proxmox-firewall.nft
> index 2dd7c48..30f7b4f 100644
> --- a/proxmox-firewall/resources/proxmox-firewall.nft
> +++ b/proxmox-firewall/resources/proxmox-firewall.nft
> @@ -356,7 +356,7 @@ table bridge proxmox-firewall-guests {
> }
>
> chain pre-vm-out {
> - meta protocol != arp ct state vmap { established : accept, related :
> accept, invalid : drop }
> + meta protocol != arp ct state vmap { established : accept, related :
> accept, invalid : jump invalid-conntrack }
> }
>
> chain vm-out {
> @@ -384,7 +384,7 @@ table bridge proxmox-firewall-guests {
>
> chain before-bridge {
> meta protocol arp accept
> - meta protocol != arp ct state vmap { established : accept, related :
> accept, invalid : drop }
> + meta protocol != arp ct state vmap { established : accept, related :
> accept, invalid : jump invalid-conntrack }
> }
>
> chain forward {
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
