[pve-devel] applied: [PATCH v2 docs] network: add note for possible fix/workaround in NAT setup

[Thomas Lamprecht]

On 2/10/20 4:06 PM, Oguz Bektas wrote:
> apparently sometimes users have problems reaching outside internet with
> some network setups. this is the workaround a user suggested that
> we should add in the wiki.
> 
> Signed-off-by: Oguz Bektas <o.bektas at proxmox.com>
> ---
> 
> v1->v2:
> * add more rationale as suggested by stoiko
> * fix indent on one line in the example config
> * add links stoiko posted in mailing list for reference
> 
>  pve-network.adoc | 20 +++++++++++++++++++-
>  1 file changed, 19 insertions(+), 1 deletion(-)
> 
> diff --git a/pve-network.adoc b/pve-network.adoc
> index c61cd42..1913498 100644
> --- a/pve-network.adoc
> +++ b/pve-network.adoc
> @@ -243,11 +243,29 @@ iface vmbr0 inet static
>          bridge_stp off
>          bridge_fd 0
>  
> -        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
> +        post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
>          post-up   iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o eno1 -j MASQUERADE
>          post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o eno1 -j MASQUERADE
>  ----
>  
> +NOTE: In some masquerade setups with firewall enabled, conntrack zones might be
> +needed for outgoing connections. Otherwise the firewall could block outgoing
> +connections since they will prefer the `POSTROUTING` of the VM bridge (and not
> +`MASQUERADE`).
> +
> +Adding these lines in the `/etc/network/interfaces` can fix this problem:
> +
> +----
> +post-up   iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
> +post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1
> +----
> +
> +For more information about this, refer to the following links:
> +https://commons.wikimedia.org/wiki/File:Netfilter-packet-flow.svg[Netfilter Packet Flow]
> +https://lwn.net/Articles/370152/[Patch on netdev-list introducing conntrack zones]
> +https://blog.lobraun.de/2019/05/19/prox/[Blog post with a good explanation by using TRACE in the raw table]
> +
> +
>  
>  Linux Bond
>  ~~~~~~~~~~
> 

applied, thanks!