public inbox for pve-devel@lists.proxmox.com
 help / color / mirror / Atom feed
From: alexandre derumier <aderumier@odiso.com>
To: pve-devel <pve-devel@pve.proxmox.com>
Subject: [pve-devel] hetzner bug with pve-firewall
Date: Fri, 10 Sep 2021 12:31:17 +0200	[thread overview]
Message-ID: <a8964d56b11abd57afcab5b304ff484216cb9d21.camel@odiso.com> (raw)

Hi,

multiple users have reported problems with hetzner in bridged mode this
week and pve-firewall
https://forum.proxmox.com/threads/proxmox-claiming-mac-address.52601/
https://forum.proxmox.com/threads/mac-address-abuse-report.95656/

Seem that hetzner have bugs or are under attack, but they are flooding
traffic to proxmox nodes with wrong mac/ip destination.

The problem is that if users use pve-firewall with reject rules, the
RST packet is send with the wrong mac/ip as source,

and then hertzner is blocking the server of the users ....


I'm looking to see if we could add filtering at ebtables level, to drop
wrong mac destination.

But they are also another problem, if user use DROP as default action,
 we have a default REJECT for whois port 53.

'PVEFW-Drop' => [
   # same as shorewall 'Drop', which is equal to DROP,
   # but REJECT/DROP some packages to reduce logging,
   # and ACCEPT critical ICMP types
   { action => 'PVEFW-reject', proto => 'tcp', dport => '43' }, #
REJECT 'auth'

Does somebody known why we do a reject here ?  could it be change to
drop ?






             reply	other threads:[~2021-09-10 10:31 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-10 10:31 alexandre derumier [this message]
2021-09-10 10:43 ` Fabian Grünbichler
2021-09-13 17:43   ` alexandre derumier
2021-09-10 10:53 ` Josef Johansson
2021-09-10 12:34   ` Josef Johansson
2021-09-10 16:18   ` alexandre derumier
2021-09-12 10:37     ` Josef Per Johansson
2021-09-14  0:27       ` alexandre derumier
2021-09-14  7:21         ` Josef Per Johansson
2021-10-01 15:19           ` Josef Johansson
2021-10-12 12:41             ` Josef Johansson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=a8964d56b11abd57afcab5b304ff484216cb9d21.camel@odiso.com \
    --to=aderumier@odiso.com \
    --cc=pve-devel@pve.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal