do not use ctstate in corosync rule

That is not necessary, because we only reach that rule if ctstate is NEW.

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index eea47f297be373a535d638f50a2e0f618d9e6f25..c80664f50907347d7d9807baeef3d924b5c77a11 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -1712,7 +1712,7 @@ sub enable_host_firewall {
        ruleset_addrule($ruleset, $chain, "-s $clusternet -p tcp --dport 22 -j $accept_action");  # SSH
  
        # corosync
        ruleset_addrule($ruleset, $chain, "-s $clusternet -p tcp --dport 22 -j $accept_action");  # SSH
  
        # corosync

-       my $corosync_rule = "-p udp -m conntrack --ctstate NEW --dport 5404:5405 -j $accept_action";
+       my $corosync_rule = "-p udp --dport 5404:5405 -j $accept_action";

        ruleset_addrule($ruleset, $chain, "-s $clusternet -d $clusternet $corosync_rule");
        ruleset_addrule($ruleset, $chain, "-s $clusternet -m addrtype --dst-type MULTICAST $corosync_rule");
     }
        ruleset_addrule($ruleset, $chain, "-s $clusternet -d $clusternet $corosync_rule");
        ruleset_addrule($ruleset, $chain, "-s $clusternet -m addrtype --dst-type MULTICAST $corosync_rule");
     }


@@ -1753,7 +1753,7 @@ sub enable_host_firewall {
        ruleset_addrule($ruleset, $chain, "-d $clusternet -p tcp --dport 5900:5999 -j $accept_action");  # PVE VNC Console 
        ruleset_addrule($ruleset, $chain, "-d $clusternet -p tcp --dport 3128 -j $accept_action");  # SPICE Proxy
  
        ruleset_addrule($ruleset, $chain, "-d $clusternet -p tcp --dport 5900:5999 -j $accept_action");  # PVE VNC Console 
        ruleset_addrule($ruleset, $chain, "-d $clusternet -p tcp --dport 3128 -j $accept_action");  # SPICE Proxy
  

-       my $corosync_rule = "-p udp -m conntrack --ctstate NEW --dport 5404:5405 -j $accept_action";
+       my $corosync_rule = "-p udp --dport 5404:5405 -j $accept_action";

        ruleset_addrule($ruleset, $chain, "-d $clusternet $corosync_rule");
        ruleset_addrule($ruleset, $chain, "-m addrtype --dst-type MULTICAST $corosync_rule");
     }
        ruleset_addrule($ruleset, $chain, "-d $clusternet $corosync_rule");
        ruleset_addrule($ruleset, $chain, "-m addrtype --dst-type MULTICAST $corosync_rule");
     }