[pve-devel] [RFC PATCH qemu-server 14/14] migrate: flush old VM conntrack entries after successful migration
Christoph Heiss
c.heiss at proxmox.com
Mon Mar 17 15:11:51 CET 2025
After a successful live-migration, the old VM-specific conntrack entries
are not needed anymore on the source node and can thus be flushed.
Signed-off-by: Christoph Heiss <c.heiss at proxmox.com>
---
Depends on patch #13 for pve-firewall & a bump thereof.
Marked RFC since technically this isn't really needed. But as we can now
easily filter/differentiate traffic on a per-VM basis thanks to the
connmark, we can flush them. It's a nice-to-have, optional cleanup,
IMHO.
PVE/QemuMigrate.pm | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/PVE/QemuMigrate.pm b/PVE/QemuMigrate.pm
index 7d32fc00..12723b4e 100644
--- a/PVE/QemuMigrate.pm
+++ b/PVE/QemuMigrate.pm
@@ -11,6 +11,7 @@ use Time::HiRes qw( usleep );
use PVE::AccessControl;
use PVE::Cluster;
use PVE::Format qw(render_bytes);
+use PVE::Firewall::Helpers;
use PVE::GuestHelpers qw(safe_boolean_ne safe_string_ne);
use PVE::INotify;
use PVE::JSONSchema;
@@ -1614,6 +1615,10 @@ sub phase3_cleanup {
if (my $err = $@) {
$self->log('warn', "failed to stop dbus-vmstate on $targetnode: $err\n");
}
+
+ # also flush now-old local conntrack entries for the migrated VM
+ $self->log('info', 'flushing conntrack state for guest on source');
+ PVE::Firewall::Helpers::flush_fw_ct_entries_by_mark($vmid);
}
}
--
2.48.1
More information about the pve-devel
mailing list