From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id D397B1FF0AF for ; Fri, 06 Nov 2026 12:23:44 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id DE8F621622; Fri, 06 Nov 2026 12:23:33 +0100 (CET) From: Stefan Hanreich To: pve-devel@lists.proxmox.com Subject: [PATCH firewall/proxmox-firewall 0/2] fix bridge-nf-call settings during upgrades and handover Date: Fri, 6 Nov 2026 12:23:12 +0100 Message-ID: <20261106112315.151144-1-s.hanreich@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793964208423 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.312 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: NOSYPUQVRR3TTLPMRVKVQL7TCCUOC2Z2 X-Message-ID-Hash: NOSYPUQVRR3TTLPMRVKVQL7TCCUOC2Z2 X-MailFrom: s.hanreich@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: pve-firewall needs net.bridge.bridge-nf-call-ip{,6}tables set to 1, so that bridged guest traffic passes through iptables and conntrack. It sets them at runtime, while 10-pve.conf sets them to 0. Whenever the sysctl.d configuration is re-applied, e.g. when systemd-sysctl is restarted during a package upgrade, they drop back to 0 until the next update round of pve-firewall, up to 10 seconds later. Conntrack misses the bridged traffic in between, so packets of established connections get dropped as invalid afterwards. The pve-firewall patch writes a drop-in to /run/sysctl.d while the iptables based firewall is active, so re-applying the configuration keeps the values at 1. The proxmox-firewall patch fixes a related issue when switching to the nftables based firewall at runtime. It does not need the sysctls, but nothing reset them either, so the host and cluster forward rules also applied to bridged guest traffic until the next re-apply. It now re-applies the configured values once when it takes over, which keeps any override by the admin. pve-firewall: Stefan Hanreich (1): fix #8268: firewall: keep bridge-nf-call sysctls set on upgrade debian/control | 4 ++-- src/PVE/Firewall.pm | 34 +++++++++++++++++++++++++++++++++- 2 files changed, 35 insertions(+), 3 deletions(-) proxmox-firewall: Stefan Hanreich (1): service: re-apply bridge sysctls when taking over from pve-firewall proxmox-firewall/src/bin/proxmox-firewall.rs | 35 ++++++++++++++++++++ 1 file changed, 35 insertions(+) Summary over all repositories: 3 files changed, 70 insertions(+), 3 deletions(-) -- Generated by murpp 0.12.0