[pve-devel] [PATCH v2 docs] network: add note for possible fix/workaround in NAT setup

Oguz Bektas o.bektas at proxmox.com
Mon Feb 10 16:06:11 CET 2020

apparently sometimes users have problems reaching outside internet with
some network setups. this is the workaround a user suggested that
we should add in the wiki.

Signed-off-by: Oguz Bektas <o.bektas at proxmox.com>

* add more rationale as suggested by stoiko
* fix indent on one line in the example config
* add links stoiko posted in mailing list for reference

 pve-network.adoc | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/pve-network.adoc b/pve-network.adoc
index c61cd42..1913498 100644
--- a/pve-network.adoc
+++ b/pve-network.adoc
@@ -243,11 +243,29 @@ iface vmbr0 inet static
         bridge_stp off
         bridge_fd 0
-        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
+        post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
         post-up   iptables -t nat -A POSTROUTING -s '' -o eno1 -j MASQUERADE
         post-down iptables -t nat -D POSTROUTING -s '' -o eno1 -j MASQUERADE
+NOTE: In some masquerade setups with firewall enabled, conntrack zones might be
+needed for outgoing connections. Otherwise the firewall could block outgoing
+connections since they will prefer the `POSTROUTING` of the VM bridge (and not
+Adding these lines in the `/etc/network/interfaces` can fix this problem:
+post-up   iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
+post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1
+For more information about this, refer to the following links:
+https://commons.wikimedia.org/wiki/File:Netfilter-packet-flow.svg[Netfilter Packet Flow]
+https://lwn.net/Articles/370152/[Patch on netdev-list introducing conntrack zones]
+https://blog.lobraun.de/2019/05/19/prox/[Blog post with a good explanation by using TRACE in the raw table]
 Linux Bond

More information about the pve-devel mailing list