> I justed test vms ipset, and it don't apply here. > > (don't see iptables rule or ipset created). I am just implementing that now. > Can you tell me where are the firewall compiler debug/warn logs ? use the following command to check: # pve-firewall status