From: Oguz Bektas Date: Mon, 10 Feb 2020 15:06:11 +0000 (+0100) Subject: network: add note for possible fix/workaround in NAT setup X-Git-Url: https://git.proxmox.com/?p=pve-docs.git;a=commitdiff_plain;h=22d5244018ccbff3f072b7c0c4e470d130094b79 network: add note for possible fix/workaround in NAT setup apparently sometimes users have problems reaching outside internet with some network setups. this is the workaround a user suggested that we should add in the wiki. Signed-off-by: Oguz Bektas --- diff --git a/pve-network.adoc b/pve-network.adoc index c61cd42..1913498 100644 --- a/pve-network.adoc +++ b/pve-network.adoc @@ -243,11 +243,29 @@ iface vmbr0 inet static bridge_stp off bridge_fd 0 - post-up echo 1 > /proc/sys/net/ipv4/ip_forward + post-up echo 1 > /proc/sys/net/ipv4/ip_forward post-up iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o eno1 -j MASQUERADE post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o eno1 -j MASQUERADE ---- +NOTE: In some masquerade setups with firewall enabled, conntrack zones might be +needed for outgoing connections. Otherwise the firewall could block outgoing +connections since they will prefer the `POSTROUTING` of the VM bridge (and not +`MASQUERADE`). + +Adding these lines in the `/etc/network/interfaces` can fix this problem: + +---- +post-up iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1 +post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1 +---- + +For more information about this, refer to the following links: +https://commons.wikimedia.org/wiki/File:Netfilter-packet-flow.svg[Netfilter Packet Flow] +https://lwn.net/Articles/370152/[Patch on netdev-list introducing conntrack zones] +https://blog.lobraun.de/2019/05/19/prox/[Blog post with a good explanation by using TRACE in the raw table] + + Linux Bond ~~~~~~~~~~