superseded: [PATCH firewall/proxmox-firewall 0/2] fix bridge-nf-call settings during upgrades and handover

[Stefan Hanreich <s.hanreich@proxmox.com>]

https://lore.proxmox.com/pve-devel/20261106121015.188115-1-s.hanreich@proxmox.com/T/#t

On 11/6/26 12:23 PM, Stefan Hanreich wrote:
> pve-firewall needs net.bridge.bridge-nf-call-ip{,6}tables set to 1, so
> that bridged guest traffic passes through iptables and conntrack. It
> sets them at runtime, while 10-pve.conf sets them to 0. Whenever the
> sysctl.d configuration is re-applied, e.g. when systemd-sysctl is
> restarted during a package upgrade, they drop back to 0 until the next
> update round of pve-firewall, up to 10 seconds later. Conntrack misses
> the bridged traffic in between, so packets of established connections
> get dropped as invalid afterwards.
> 
> The pve-firewall patch writes a drop-in to /run/sysctl.d while the
> iptables based firewall is active, so re-applying the configuration
> keeps the values at 1.
> 
> The proxmox-firewall patch fixes a related issue when switching to the
> nftables based firewall at runtime. It does not need the sysctls, but
> nothing reset them either, so the host and cluster forward rules also
> applied to bridged guest traffic until the next re-apply. It now
> re-applies the configured values once when it takes over, which keeps
> any override by the admin.
> 
> 
> pve-firewall:
> 
> Stefan Hanreich (1):
>   fix #8268: firewall: keep bridge-nf-call sysctls set on upgrade
> 
>  debian/control      |  4 ++--
>  src/PVE/Firewall.pm | 34 +++++++++++++++++++++++++++++++++-
>  2 files changed, 35 insertions(+), 3 deletions(-)
> 
> 
> proxmox-firewall:
> 
> Stefan Hanreich (1):
>   service: re-apply bridge sysctls when taking over from pve-firewall
> 
>  proxmox-firewall/src/bin/proxmox-firewall.rs | 35 ++++++++++++++++++++
>  1 file changed, 35 insertions(+)
> 
> 
> Summary over all repositories:
>   3 files changed, 70 insertions(+), 3 deletions(-)
>