On 2/10/20 4:06 PM, Oguz Bektas wrote: > apparently sometimes users have problems reaching outside internet with > some network setups. this is the workaround a user suggested that > we should add in the wiki. > > Signed-off-by: Oguz Bektas <o.bek...@proxmox.com> > --- > > v1->v2: > * add more rationale as suggested by stoiko > * fix indent on one line in the example config > * add links stoiko posted in mailing list for reference > > pve-network.adoc | 20 +++++++++++++++++++- > 1 file changed, 19 insertions(+), 1 deletion(-) > > diff --git a/pve-network.adoc b/pve-network.adoc > index c61cd42..1913498 100644 > --- a/pve-network.adoc > +++ b/pve-network.adoc > @@ -243,11 +243,29 @@ iface vmbr0 inet static > bridge_stp off > bridge_fd 0 > > - post-up echo 1 > /proc/sys/net/ipv4/ip_forward > + post-up echo 1 > /proc/sys/net/ipv4/ip_forward > post-up iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o eno1 > -j MASQUERADE > post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o eno1 > -j MASQUERADE > ---- > > +NOTE: In some masquerade setups with firewall enabled, conntrack zones might > be > +needed for outgoing connections. Otherwise the firewall could block outgoing > +connections since they will prefer the `POSTROUTING` of the VM bridge (and > not > +`MASQUERADE`). > + > +Adding these lines in the `/etc/network/interfaces` can fix this problem: > + > +---- > +post-up iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1 > +post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1 > +---- > + > +For more information about this, refer to the following links: > +https://commons.wikimedia.org/wiki/File:Netfilter-packet-flow.svg[Netfilter > Packet Flow] > +https://lwn.net/Articles/370152/[Patch on netdev-list introducing conntrack > zones] > +https://blog.lobraun.de/2019/05/19/prox/[Blog post with a good explanation > by using TRACE in the raw table] > + > + > > Linux Bond > ~~~~~~~~~~ >
applied, thanks! _______________________________________________ pve-devel mailing list pve-devel@pve.proxmox.com https://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
