[pve-devel] hetzner bug with pve-firewall

[Josef Johansson]

Hi,

I've stumpled upon this problem a couple of times and it resulted in me
add ebtables rules. It is a very annoying problem to be fair. In our
case what happen is

* traffic is sent to MAC A because traffic flows towards IP A

* traffic is broadcasted to MAC B and MAC A

* MAC B responds with RST

* upstream switch learns that IP A is at MAC B


We are doing some benchmark testing with it to ensure that performance
will not regress also, not done with that.


Another more lean solution would be do to DROP instead of REJECT, which
would solve it.


I have a patch for the source code regarding only allowing the VMs MAC
in ebtables for incoming traffic also.


On 9/10/21 12:31, alexandre derumier wrote:
> Hi,
>
> multiple users have reported problems with hetzner in bridged mode this
> week and pve-firewall
> https://forum.proxmox.com/threads/proxmox-claiming-mac-address.52601/
> https://forum.proxmox.com/threads/mac-address-abuse-report.95656/
>
> Seem that hetzner have bugs or are under attack, but they are flooding
> traffic to proxmox nodes with wrong mac/ip destination.
>
> The problem is that if users use pve-firewall with reject rules, the
> RST packet is send with the wrong mac/ip as source,
>
> and then hertzner is blocking the server of the users ....
>
>
> I'm looking to see if we could add filtering at ebtables level, to drop
> wrong mac destination.
>
> But they are also another problem, if user use DROP as default action,
>  we have a default REJECT for whois port 53.
>
> 'PVEFW-Drop' => [
>    # same as shorewall 'Drop', which is equal to DROP,
>    # but REJECT/DROP some packages to reduce logging,
>    # and ACCEPT critical ICMP types
>    { action => 'PVEFW-reject', proto => 'tcp', dport => '43' }, #
> REJECT 'auth'
>
> Does somebody known why we do a reject here ?  could it be change to
> drop ?
>
>
>
>
> _______________________________________________
> pve-devel mailing list
> pve-devel at lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

-- 
Med vänliga hälsningar
Josef Johansson