allow igmp traffic

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index eda3e55650ce50f329250feb24a9d1dff178f597..79e0622714ebfb9e9ec4b688d5990da32a74c4b8 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -1690,6 +1690,8 @@ sub enable_host_firewall {
     # we use RETURN because we need to check also tap rules
     my $accept_action = 'RETURN';
 
     # we use RETURN because we need to check also tap rules
     my $accept_action = 'RETURN';
 

+    ruleset_addrule($ruleset, $chain, "-p igmp -j $accept_action"); # important for multicast
+

     # add host rules first, so that cluster wide rules can be overwritten
     foreach my $rule (@$rules, @$cluster_rules) {
        $rule->{iface_in} = $rule->{iface} if $rule->{iface};
     # add host rules first, so that cluster wide rules can be overwritten
     foreach my $rule (@$rules, @$cluster_rules) {
        $rule->{iface_in} = $rule->{iface} if $rule->{iface};


@@ -1735,6 +1737,8 @@ sub enable_host_firewall {
     # we use RETURN because we may want to check other thigs later
     $accept_action = 'RETURN';
 
     # we use RETURN because we may want to check other thigs later
     $accept_action = 'RETURN';
 

+    ruleset_addrule($ruleset, $chain, "-p igmp -j $accept_action"); # important for multicast
+

     # add host rules first, so that cluster wide rules can be overwritten
     foreach my $rule (@$rules, @$cluster_rules) {
        $rule->{iface_out} = $rule->{iface} if $rule->{iface};
     # add host rules first, so that cluster wide rules can be overwritten
     foreach my $rule (@$rules, @$cluster_rules) {
        $rule->{iface_out} = $rule->{iface} if $rule->{iface};

diff --git a/src/PVE/FirewallSimulator.pm b/src/PVE/FirewallSimulator.pm
index 22ddee47c95c1d3463931dd75ea16bd37b41a882..ba3b161a801ee34f36e2118ab0752ac8d2643bb1 100644 (file)
--- a/src/PVE/FirewallSimulator.pm
+++ b/src/PVE/FirewallSimulator.pm
@@ -111,7 +111,7 @@ sub rule_match {
            next;
        }
 
            next;
        }
 

-       if ($rule =~ s/^-p (tcp|udp)\s*//) {
+       if ($rule =~ s/^-p (tcp|udp|igmp|icmp)\s*//) {

            die "missing proto" if !$pkg->{proto};
            return undef if $pkg->{proto} ne $1; # no match
            next;
            die "missing proto" if !$pkg->{proto};
            return undef if $pkg->{proto} ne $1; # no match
            next;