Re: [pve-devel] hetzner bug with pve-firewall

[Josef Johansson <josef@oderland.se>]

Traffic is only broadcasted to MAC B if the ARP-table in the switch
times out.

Which makes this problem a hell to diagnose :-)

On 9/10/21 12:53, Josef Johansson wrote:
> Hi,
>
> I've stumpled upon this problem a couple of times and it resulted in me
> add ebtables rules. It is a very annoying problem to be fair. In our
> case what happen is
>
> * traffic is sent to MAC A because traffic flows towards IP A
>
> * traffic is broadcasted to MAC B and MAC A
>
> * MAC B responds with RST
>
> * upstream switch learns that IP A is at MAC B
>
>
> We are doing some benchmark testing with it to ensure that performance
> will not regress also, not done with that.
>
>
> Another more lean solution would be do to DROP instead of REJECT, which
> would solve it.
>
>
> I have a patch for the source code regarding only allowing the VMs MAC
> in ebtables for incoming traffic also.
>
>
> On 9/10/21 12:31, alexandre derumier wrote:
>> Hi,
>>
>> multiple users have reported problems with hetzner in bridged mode this
>> week and pve-firewall
>> https://forum.proxmox.com/threads/proxmox-claiming-mac-address.52601/
>> https://forum.proxmox.com/threads/mac-address-abuse-report.95656/
>>
>> Seem that hetzner have bugs or are under attack, but they are flooding
>> traffic to proxmox nodes with wrong mac/ip destination.
>>
>> The problem is that if users use pve-firewall with reject rules, the
>> RST packet is send with the wrong mac/ip as source,
>>
>> and then hertzner is blocking the server of the users ....
>>
>>
>> I'm looking to see if we could add filtering at ebtables level, to drop
>> wrong mac destination.
>>
>> But they are also another problem, if user use DROP as default action,
>>  we have a default REJECT for whois port 53.
>>
>> 'PVEFW-Drop' => [
>>    # same as shorewall 'Drop', which is equal to DROP,
>>    # but REJECT/DROP some packages to reduce logging,
>>    # and ACCEPT critical ICMP types
>>    { action => 'PVEFW-reject', proto => 'tcp', dport => '43' }, #
>> REJECT 'auth'
>>
>> Does somebody known why we do a reject here ?  could it be change to
>> drop ?
>>
>>
>>
>>
>> _______________________________________________
>> pve-devel mailing list
>> pve-devel@lists.proxmox.com
>> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

-- 
Med vänliga hälsningar
Josef Johansson