storage: fixup PBS wiki link

[pve-docs.git] / pve-network.adoc

diff --git a/pve-network.adoc b/pve-network.adoc
index c61cd42e7e923bfe074b30a5e28a90961a4b82d5..8f3af0daa16f6339ff7ad6581b0556c6933366a1 100644 (file)
--- a/pve-network.adoc
+++ b/pve-network.adoc
@@ -178,8 +178,8 @@ Most hosting providers do not support the above setup. For security
 reasons, they disable networking as soon as they detect multiple MAC
 addresses on a single interface.
 
-TIP: Some providers allows you to register additional MACs on their
-management interface. This avoids the problem, but is clumsy to
+TIP: Some providers allow you to register additional MACs through their
+management interface. This avoids the problem, but can be clumsy to
 configure because you need to register a MAC for each of your VMs.
 
 You can avoid the problem by ``routing'' all traffic via a single
@@ -243,11 +243,29 @@ iface vmbr0 inet static
         bridge_stp off
         bridge_fd 0
 
-        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
+        post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
         post-up   iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o eno1 -j MASQUERADE
         post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o eno1 -j MASQUERADE
 ----
 
+NOTE: In some masquerade setups with firewall enabled, conntrack zones might be
+needed for outgoing connections. Otherwise the firewall could block outgoing
+connections since they will prefer the `POSTROUTING` of the VM bridge (and not
+`MASQUERADE`).
+
+Adding these lines in the `/etc/network/interfaces` can fix this problem:
+
+----
+post-up   iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
+post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1
+----
+
+For more information about this, refer to the following links:
+https://commons.wikimedia.org/wiki/File:Netfilter-packet-flow.svg[Netfilter Packet Flow]
+https://lwn.net/Articles/370152/[Patch on netdev-list introducing conntrack zones]
+https://blog.lobraun.de/2019/05/19/prox/[Blog post with a good explanation by using TRACE in the raw table]
+
+
 
 Linux Bond
 ~~~~~~~~~~