From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 45F11750D8 for ; Tue, 12 Oct 2021 14:41:59 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 314AB2C622 for ; Tue, 12 Oct 2021 14:41:29 +0200 (CEST) Received: from office.oderland.com (office.oderland.com [91.201.60.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id 44A862C617 for ; Tue, 12 Oct 2021 14:41:28 +0200 (CEST) Received: from [193.180.18.161] (port=33230 helo=[10.137.0.14]) by office.oderland.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1maH5t-0028SJ-Td for pve-devel@lists.proxmox.com; Tue, 12 Oct 2021 14:41:21 +0200 Message-ID: <787e1c04-fd74-e375-d6d6-728d397f5d7a@oderland.se> Date: Tue, 12 Oct 2021 14:41:21 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:93.0) Gecko/20100101 Thunderbird/93.0 Content-Language: en-US To: pve-devel@lists.proxmox.com References: <7686571e-ebf0-8ad5-8bc3-af484fd2ac88@oderland.se> <641042205.2631725.1631443070304@localhost> <0ef5cbe7c222199e7032c28c50a37fe12b71154b.camel@odiso.com> <1015626530.2812024.1631604108478@localhost> From: Josef Johansson In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - office.oderland.com X-AntiAbuse: Original Domain - lists.proxmox.com X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - oderland.se X-Get-Message-Sender-Via: office.oderland.com: authenticated_id: josjoh@oderland.se X-Authenticated-Sender: office.oderland.com: josjoh@oderland.se X-SPAM-LEVEL: Spam detection results: 0 AWL -1.136 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% KAM_ASCII_DIVIDERS 0.8 Spam that uses ascii formatting tricks KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment NICE_REPLY_A -0.001 Looks like a legit reply (A) SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [proxmox.com] Subject: Re: [pve-devel] hetzner bug with pve-firewall X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Oct 2021 12:41:59 -0000 Hi, I deployed on all interfaces, both fwnl and fwpr. It seems to have solve a bunch of troubles on our side. Med vänliga hälsningar Josef Johansson On 10/1/21 17:19, Josef Johansson wrote: > Hi, > > Sorry for the late answer. > > It seems to do what it's intended to do. > > I ran `bridge link set dev fwprp0 flood off` > > If it works ok I will deploy it on more VMs. > > Med vänliga hälsningar > Josef Johansson > > On 9/14/21 09:21, Josef Per Johansson wrote: >> Hi, >> >> I can check it out for sure, not touching ebtables would be nice. >> >> Sent from Nine >> ________________________________ >> From: alexandre derumier >> Sent: Tuesday, 14 September 2021 02:28 >> To: Proxmox VE development discussion >> Subject: Re: [pve-devel] hetzner bug with pve-firewall >> >> >> Hi, I just send another patch, >> >> without ebtables, but with disabling unicast_flood on vm bridge ports.  >> >> maybe can you try it ? >> >> >> Le dimanche 12 septembre 2021 à 12:37 +0200, Josef Per Johansson a >> écrit : >>> Hi, >>> >>> Yeah sure! It seems a bit better than my hack! >>> >>> Yeah I meant the mac-address-table, my bad. >>> >>> Sent from Nine >>> ________________________________ >>> From: alexandre derumier >>> Sent: Friday, 10 September 2021 18:19 >>> To: Proxmox VE development discussion >>> Subject: Re: [pve-devel] hetzner bug with pve-firewall >>> >>> >>> Hi, >>> >>> Le vendredi 10 septembre 2021 à 12:53 +0200, Josef Johansson a >>> écrit : >>>> I have a patch for the source code regarding only allowing the VMs >>>> MAC >>>> in ebtables for incoming traffic also. >>> I just send a patch too for incoming traffic, maybe could you try it >>> ? >>> >>> >>> >>>>> Traffic is only broadcasted to MAC B if the ARP-table in the >>>>> switch >>>>> times out. >>>>> >>>>> Which makes this problem a hell to diagnose :-) >>> to be exact, if the mac-address-table timeout in the switch. (switch >>> don't have arp, until it's a router) >>> That's why in general, switch need to be configured with mac-address- >>> table aging-time (2h for exemple)  > than arp timeout on servers. >>> >>> Like this, if no traffic occur on servers, and arp is timeout out, >>> server is sending a new arp request, and the switch see the arp reply >>> with the mac address, >>> (and no expiration in mac-address-table). >>> >>> Looking at hetzner problem, the tcpdump send by users show really >>> stranges mac address vendor. (sound like forged flood). >>> Anyway, they should fix this, with static mac in their switch, as >>> they >>> known allowed mac by server anyway. >>> (Until they have poor cheap switch without mac filtering ....) >>> I wonder if they are not only filtering/detecting the wrong mac on >>> their gateway. (as here, we send tcp reset to an external ip, going >>> through the gateway) >>> >>> >>> >>> _______________________________________________ >>> pve-devel mailing list >>> pve-devel@lists.proxmox.com >>> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel >>> _______________________________________________ >>> pve-devel mailing list >>> pve-devel@lists.proxmox.com >>> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel >> _______________________________________________ >> pve-devel mailing list >> pve-devel@lists.proxmox.com >> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel >> >> _______________________________________________ >> pve-devel mailing list >> pve-devel@lists.proxmox.com >> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel > _______________________________________________ > pve-devel mailing list > pve-devel@lists.proxmox.com > https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel