Today I noticed that the integrated firewall does not apply any changes and doesn't filter traffic. It looks like some module for the network bridge is missing or not loaded.
Status: enabled/running (pending changes)
create PVEFW-0-management-v4 (PWD31JmBcC/0aYW2jK2JsOwXDO8)
create PVEFW-0-management-v4 hash:net family inet hashsize 64 maxelem 64 bucketsize 12
add PVEFW-0-management-v4 x.x.x.0/24
create PVEFW-0-management-v6 (6g+lzHFoCegXcweHRfBY4vRsbOc)
create PVEFW-0-management-v6 hash:net family inet6 hashsize 64 maxelem 64 bucketsize 12
iptables cmdlist:
create GROUP-default-IN (CNd1DuhyCdbmOVpU1vbYSJjWHqo)
-A GROUP-default-IN -j MARK --set-mark 0x00000000/0x80000000
create GROUP-default-OUT (tsnPkIAHd6d4iCYjG485zXP3eI0)
-A GROUP-default-OUT -j MARK --set-mark 0x00000000/0x80000000
-A GROUP-default-OUT -d x.x.x.4 -p udp --dport 53 -g PVEFW-SET-ACCEPT-MARK
-A GROUP-default-OUT -d x.x.x.4 -p tcp --dport 53 -g PVEFW-SET-ACCEPT-MARK
-A GROUP-default-OUT -d x.x.x.0/8 -j DROP
-A GROUP-default-OUT -d x.x.x.0/12 -j DROP
-A GROUP-default-OUT -d x.x.x.0/16 -j DROP
create PVEFW-Drop (83WlR/a4wLbmURFqMQT3uJSgIG8)
-A PVEFW-Drop -j PVEFW-DropBroadcast
-A PVEFW-Drop -p icmp -m icmp --icmp-type fragmentation-needed -j ACCEPT
-A PVEFW-Drop -p icmp -m icmp --icmp-type time-exceeded -j ACCEPT
-A PVEFW-Drop -m conntrack --ctstate INVALID -j DROP
-A PVEFW-Drop -p udp --match multiport --dports 135,445 -j DROP
-A PVEFW-Drop -p udp --dport 137:139 -j DROP
-A PVEFW-Drop -p udp --sport 137 --dport 1024:65535 -j DROP
-A PVEFW-Drop -p tcp --match multiport --dports 135,139,445 -j DROP
-A PVEFW-Drop -p udp --dport 1900 -j DROP
-A PVEFW-Drop -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A PVEFW-Drop -p udp --sport 53 -j DROP
create PVEFW-DropBroadcast (NyjHNAtFbkH7WGLamPpdVnxHy4w)
-A PVEFW-DropBroadcast -m addrtype --dst-type BROADCAST -j DROP
-A PVEFW-DropBroadcast -m addrtype --dst-type MULTICAST -j DROP
-A PVEFW-DropBroadcast -m addrtype --dst-type ANYCAST -j DROP
-A PVEFW-DropBroadcast -d 224.0.0.0/4 -j DROP
create PVEFW-FORWARD (qnNexOcGa+y+jebd4dAUqFSp5nw)
-A PVEFW-FORWARD -m conntrack --ctstate INVALID -j DROP
-A PVEFW-FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PVEFW-FORWARD -m physdev --physdev-is-bridged --physdev-in fwln+ -j PVEFW-FWBR-IN
-A PVEFW-FORWARD -m physdev --physdev-is-bridged --physdev-out fwln+ -j PVEFW-FWBR-OUT
create PVEFW-FWBR-IN (BSfT3ROZgjc9bnx2RjYgT2ZBhfk)
-A PVEFW-FWBR-IN -m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs
-A PVEFW-FWBR-IN -p tcp -j PVEFW-tcpflags
-A PVEFW-FWBR-IN -m physdev --physdev-is-bridged --physdev-out tap800i0 -j tap800i0-IN
-A PVEFW-FWBR-IN -m physdev --physdev-is-bridged --physdev-out tap801i0 -j tap801i0-IN
-A PVEFW-FWBR-IN -m physdev --physdev-is-bridged --physdev-out tap802i0 -j tap802i0-IN
-A PVEFW-FWBR-IN -m physdev --physdev-is-bridged --physdev-out veth100i0 -j veth100i0-IN
-A PVEFW-FWBR-IN -m physdev --physdev-is-bridged --physdev-out veth700i0 -j veth700i0-IN
create PVEFW-FWBR-OUT (a3XLOO96rl7sA8sks3wMKsfYY+8)
-A PVEFW-FWBR-OUT -m physdev --physdev-is-bridged --physdev-in tap800i0 -j tap800i0-OUT
-A PVEFW-FWBR-OUT -m physdev --physdev-is-bridged --physdev-in tap801i0 -j tap801i0-OUT
-A PVEFW-FWBR-OUT -m physdev --physdev-is-bridged --physdev-in tap802i0 -j tap802i0-OUT
-A PVEFW-FWBR-OUT -m physdev --physdev-is-bridged --physdev-in veth100i0 -j veth100i0-OUT
-A PVEFW-FWBR-OUT -m physdev --physdev-is-bridged --physdev-in veth700i0 -j veth700i0-OUT
create PVEFW-HOST-IN (nYiug+DLaBrUddfKb/HgFQb82WM)
-A PVEFW-HOST-IN -i lo -j ACCEPT
-A PVEFW-HOST-IN -m conntrack --ctstate INVALID -j DROP
-A PVEFW-HOST-IN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PVEFW-HOST-IN -m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs
-A PVEFW-HOST-IN -p tcp -j PVEFW-tcpflags
-A PVEFW-HOST-IN -p igmp -j RETURN
-A PVEFW-HOST-IN -i vmbr0 -j GROUP-default-IN
-A PVEFW-HOST-IN -m mark --mark 0x80000000/0x80000000 -j RETURN
-A PVEFW-HOST-IN -i vmbro -s x.x.x.0/24 -p tcp --dport 8006 -j RETURN
-A PVEFW-HOST-IN -m set --match-set PVEFW-0-management-v4 src -p tcp --dport 8006 -j RETURN
-A PVEFW-HOST-IN -m set --match-set PVEFW-0-management-v4 src -p tcp --dport 5900:5999 -j RETURN
-A PVEFW-HOST-IN -m set --match-set PVEFW-0-management-v4 src -p tcp --dport 3128 -j RETURN
-A PVEFW-HOST-IN -m set --match-set PVEFW-0-management-v4 src -p tcp --dport 22 -j RETURN
-A PVEFW-HOST-IN -m set --match-set PVEFW-0-management-v4 src -p tcp --dport 60000:60050 -j RETURN
-A PVEFW-HOST-IN -j PVEFW-Drop
-A PVEFW-HOST-IN -j DROP
create PVEFW-HOST-OUT (mu4KE7UJdZaYxpkjY5nKmIYfizc)
-A PVEFW-HOST-OUT -o lo -j ACCEPT
-A PVEFW-HOST-OUT -m conntrack --ctstate INVALID -j DROP
-A PVEFW-HOST-OUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PVEFW-HOST-OUT -p igmp -j RETURN
-A PVEFW-HOST-OUT -o vmbr0 -j GROUP-default-OUT
-A PVEFW-HOST-OUT -m mark --mark 0x80000000/0x80000000 -j RETURN
-A PVEFW-HOST-OUT -o vmbr0 -p tcp --dport 80 -j RETURN
-A PVEFW-HOST-OUT -o vmbr0 -p tcp -j RETURN
-A PVEFW-HOST-OUT -d x.x.x.0/24 -p tcp --dport 8006 -j RETURN
-A PVEFW-HOST-OUT -d x.x.x.0/24 -p tcp --dport 22 -j RETURN
-A PVEFW-HOST-OUT -d x.x.x.0/24 -p tcp --dport 5900:5999 -j RETURN
-A PVEFW-HOST-OUT -d x.x.x.0/24 -p tcp --dport 3128 -j RETURN
-A PVEFW-HOST-OUT -j PVEFW-Drop
-A PVEFW-HOST-OUT -j DROP
create PVEFW-INPUT (+5iMmLaxKXynOB/+5xibfx7WhFk)
-A PVEFW-INPUT -j PVEFW-HOST-IN
create PVEFW-OUTPUT (LjHoZeSSiWAG3+2ZAyL/xuEehd0)
-A PVEFW-OUTPUT -j PVEFW-HOST-OUT
create PVEFW-Reject (h3DyALVslgH5hutETfixGP08w7c)
-A PVEFW-Reject -j PVEFW-DropBroadcast
-A PVEFW-Reject -p icmp -m icmp --icmp-type fragmentation-needed -j ACCEPT
-A PVEFW-Reject -p icmp -m icmp --icmp-type time-exceeded -j ACCEPT
-A PVEFW-Reject -m conntrack --ctstate INVALID -j DROP
-A PVEFW-Reject -p udp --match multiport --dports 135,445 -j PVEFW-reject
-A PVEFW-Reject -p udp --dport 137:139 -j PVEFW-reject
-A PVEFW-Reject -p udp --sport 137 --dport 1024:65535 -j PVEFW-reject
-A PVEFW-Reject -p tcp --match multiport --dports 135,139,445 -j PVEFW-reject
-A PVEFW-Reject -p udp --dport 1900 -j DROP
-A PVEFW-Reject -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A PVEFW-Reject -p udp --sport 53 -j DROP
create PVEFW-SET-ACCEPT-MARK (Hg/OIgIwJChBUcWU8Xnjhdd2jUY)
-A PVEFW-SET-ACCEPT-MARK -j MARK --set-mark 0x80000000/0x80000000
create PVEFW-logflags (MN4PH1oPZeABMuWr64RrygPfW7A)
-A PVEFW-logflags -j DROP
create PVEFW-reject (Jlkrtle1mDdtxDeI9QaDSL++Npc)
-A PVEFW-reject -m addrtype --dst-type BROADCAST -j DROP
-A PVEFW-reject -s 224.0.0.0/4 -j DROP
-A PVEFW-reject -p icmp -j DROP
-A PVEFW-reject -p tcp -j REJECT --reject-with tcp-reset
-A PVEFW-reject -p udp -j REJECT --reject-with icmp-port-unreachable
-A PVEFW-reject -p icmp -j REJECT --reject-with icmp-host-unreachable
-A PVEFW-reject -j REJECT --reject-with icmp-host-prohibited
create PVEFW-smurflog (2gfT1VMkfr0JL6OccRXTGXo+1qk)
-A PVEFW-smurflog -j DROP
create PVEFW-smurfs (HssVe5QCBXd5mc9kC88749+7fag)
-A PVEFW-smurfs -s 0.0.0.0/32 -j RETURN
-A PVEFW-smurfs -m addrtype --src-type BROADCAST -g PVEFW-smurflog
-A PVEFW-smurfs -s 224.0.0.0/4 -g PVEFW-smurflog
create PVEFW-tcpflags (CMFojwNPqllyqD67NeI5m+bP5mo)
-A PVEFW-tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -g PVEFW-logflags
-A PVEFW-tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -g PVEFW-logflags
-A PVEFW-tcpflags -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -g PVEFW-logflags
-A PVEFW-tcpflags -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -g PVEFW-logflags
-A PVEFW-tcpflags -p tcp -m tcp --sport 0 --tcp-flags FIN,SYN,RST,ACK SYN -g PVEFW-logflags
create tap800i0-IN (0X1WBDahrSg5QUIbxusNMrB/agQ)
-A tap800i0-IN -p udp --sport 67 --dport 68 -j ACCEPT
-A tap800i0-IN -j GROUP-default-IN
-A tap800i0-IN -m mark --mark 0x80000000/0x80000000 -j ACCEPT
-A tap800i0-IN -s x.x.x.0/24 -p tcp --dport 22 -j ACCEPT
-A tap800i0-IN -j PVEFW-Drop
-A tap800i0-IN -j DROP
create tap800i0-OUT (cc92hk+NKX0z9Y5RHqo/5ry4j8o)
-A tap800i0-OUT -p udp --sport 68 --dport 67 -g PVEFW-SET-ACCEPT-MARK
-A tap800i0-OUT -m mac ! --mac-source XX:XX:XX:XX:XX:XX -j DROP
-A tap800i0-OUT -j MARK --set-mark 0x00000000/0x80000000
-A tap800i0-OUT -j GROUP-default-OUT
-A tap800i0-OUT -m mark --mark 0x80000000/0x80000000 -j RETURN
-A tap800i0-OUT -p tcp --dport 80 -g PVEFW-SET-ACCEPT-MARK
-A tap800i0-OUT -j PVEFW-Drop
-A tap800i0-OUT -j DROP
create tap801i0-IN (K359Au2B83LeGAXuozldyWma8IY)
-A tap801i0-IN -p udp --sport 67 --dport 68 -j ACCEPT
-A tap801i0-IN -j GROUP-default-IN
-A tap801i0-IN -m mark --mark 0x80000000/0x80000000 -j ACCEPT
-A tap801i0-IN -s x.x.x.0/24 -p tcp --dport 22 -j ACCEPT
-A tap801i0-IN -j PVEFW-Drop
-A tap801i0-IN -j DROP
create tap801i0-OUT (p2Z8+uCAp0o78gCqxPYjQn548pU)
-A tap801i0-OUT -p udp --sport 68 --dport 67 -g PVEFW-SET-ACCEPT-MARK
-A tap801i0-OUT -m mac ! --mac-source XX:XX:XX:XX:XX:XX -j DROP
-A tap801i0-OUT -j MARK --set-mark 0x00000000/0x80000000
-A tap801i0-OUT -j GROUP-default-OUT
-A tap801i0-OUT -m mark --mark 0x80000000/0x80000000 -j RETURN
-A tap801i0-OUT -p tcp --dport 80 -g PVEFW-SET-ACCEPT-MARK
-A tap801i0-OUT -p tcp --dport 443 -g PVEFW-SET-ACCEPT-MARK
-A tap801i0-OUT -j PVEFW-Drop
-A tap801i0-OUT -j DROP
create tap802i0-IN (IM5H1EbEixrkfhgRAzRMT4tS7hQ)
-A tap802i0-IN -p udp --sport 67 --dport 68 -j ACCEPT
-A tap802i0-IN -j GROUP-default-IN
-A tap802i0-IN -m mark --mark 0x80000000/0x80000000 -j ACCEPT
-A tap802i0-IN -s x.x.x.0/24 -p tcp --dport 22 -j ACCEPT
-A tap802i0-IN -j PVEFW-Drop
-A tap802i0-IN -j DROP
create tap802i0-OUT (DDEHCCe73Rc12m6nIFyXFVnlNgM)
-A tap802i0-OUT -p udp --sport 68 --dport 67 -g PVEFW-SET-ACCEPT-MARK
-A tap802i0-OUT -m mac ! --mac-source XX:XX:XX:XX:XX:XX -j DROP
-A tap802i0-OUT -j MARK --set-mark 0x00000000/0x80000000
-A tap802i0-OUT -j GROUP-default-OUT
-A tap802i0-OUT -m mark --mark 0x80000000/0x80000000 -j RETURN
-A tap802i0-OUT -p tcp --dport 80 -g PVEFW-SET-ACCEPT-MARK
-A tap802i0-OUT -p tcp --dport 443 -g PVEFW-SET-ACCEPT-MARK
-A tap802i0-OUT -j PVEFW-Drop
-A tap802i0-OUT -j DROP
create veth100i0-IN (bJyUpWfa1Gy8Uf8cpRIYNxhI8fw)
-A veth100i0-IN -p udp --sport 67 --dport 68 -j ACCEPT
-A veth100i0-IN -j GROUP-default-IN
-A veth100i0-IN -m mark --mark 0x80000000/0x80000000 -j ACCEPT
-A veth100i0-IN -p udp --dport 53 -j ACCEPT
-A veth100i0-IN -p tcp --dport 53 -j ACCEPT
-A veth100i0-IN -s x.x.x.0/24 -p tcp --dport 80 -j ACCEPT
-A veth100i0-IN -j PVEFW-Drop
-A veth100i0-IN -j DROP
create veth100i0-OUT (qOM8WmeirxF1gGG1DbxIEmY2Bes)
-A veth100i0-OUT -p udp --sport 68 --dport 67 -g PVEFW-SET-ACCEPT-MARK
-A veth100i0-OUT -m mac ! --mac-source XX:XX:XX:XX:XX:XX -j DROP
-A veth100i0-OUT -j MARK --set-mark 0x00000000/0x80000000
-A veth100i0-OUT -j GROUP-default-OUT
-A veth100i0-OUT -m mark --mark 0x80000000/0x80000000 -j RETURN
-A veth100i0-OUT -p tcp --dport 80 -g PVEFW-SET-ACCEPT-MARK
-A veth100i0-OUT -p tcp --dport 443 -g PVEFW-SET-ACCEPT-MARK
-A veth100i0-OUT -j PVEFW-Drop
-A veth100i0-OUT -j DROP
create veth700i0-IN (95DDwIXA9ixmdBnPXTyRyntok8k)
-A veth700i0-IN -p udp --sport 67 --dport 68 -j ACCEPT
-A veth700i0-IN -j GROUP-default-IN
-A veth700i0-IN -m mark --mark 0x80000000/0x80000000 -j ACCEPT
-A veth700i0-IN -s x.x.x.0/24 -p tcp --dport 22 -j ACCEPT
-A veth700i0-IN -j PVEFW-Drop
-A veth700i0-IN -j DROP
create veth700i0-OUT (Ko4gSzqYb3rfjIsv+gGx06BLIXg)
-A veth700i0-OUT -p udp --sport 68 --dport 67 -g PVEFW-SET-ACCEPT-MARK
-A veth700i0-OUT -m mac ! --mac-source XX:XX:XX:XX:XX:XX -j DROP
-A veth700i0-OUT -j MARK --set-mark 0x00000000/0x80000000
-A veth700i0-OUT -j GROUP-default-OUT
-A veth700i0-OUT -m mark --mark 0x80000000/0x80000000 -j RETURN
-A veth700i0-OUT -p tcp --dport 80 -g PVEFW-SET-ACCEPT-MARK
-A veth700i0-OUT -j PVEFW-Drop
-A veth700i0-OUT -j DROP
ip6tables cmdlist:
create GROUP-default-IN (CNd1DuhyCdbmOVpU1vbYSJjWHqo)
-A GROUP-default-IN -j MARK --set-mark 0x00000000/0x80000000
create GROUP-default-OUT (m40rxGxRolSs4B26P5z+oKHDMIc)
-A GROUP-default-OUT -j MARK --set-mark 0x00000000/0x80000000
create PVEFW-Drop (Jb79Uw7z1vZglIcV7QXA5uY/nbk)
-A PVEFW-Drop -p tcp --dport 43 -j PVEFW-reject
-A PVEFW-Drop -j PVEFW-DropBroadcast
-A PVEFW-Drop -p icmpv6 -m icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
-A PVEFW-Drop -p icmpv6 -m icmpv6 --icmpv6-type time-exceeded -j ACCEPT
-A PVEFW-Drop -p icmpv6 -m icmpv6 --icmpv6-type packet-too-big -j ACCEPT
-A PVEFW-Drop -m conntrack --ctstate INVALID -j DROP
-A PVEFW-Drop -p udp --match multiport --dports 135,445 -j DROP
-A PVEFW-Drop -p udp --dport 137:139 -j DROP
-A PVEFW-Drop -p udp --sport 137 --dport 1024:65535 -j DROP
-A PVEFW-Drop -p tcp --match multiport --dports 135,139,445 -j DROP
-A PVEFW-Drop -p udp --dport 1900 -j DROP
-A PVEFW-Drop -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A PVEFW-Drop -p udp --sport 53 -j DROP
create PVEFW-DropBroadcast (8Krk5Nh8pDZOOc7BQAbM6PlyFSU)
-A PVEFW-DropBroadcast -d ff00::/8 -j DROP
create PVEFW-FORWARD (qnNexOcGa+y+jebd4dAUqFSp5nw)
-A PVEFW-FORWARD -m conntrack --ctstate INVALID -j DROP
-A PVEFW-FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PVEFW-FORWARD -m physdev --physdev-is-bridged --physdev-in fwln+ -j PVEFW-FWBR-IN
-A PVEFW-FORWARD -m physdev --physdev-is-bridged --physdev-out fwln+ -j PVEFW-FWBR-OUT
create PVEFW-FWBR-IN (jEvMpjKi+QBNFQ7F7fa408lM/1E)
-A PVEFW-FWBR-IN -p tcp -j PVEFW-tcpflags
-A PVEFW-FWBR-IN -m physdev --physdev-is-bridged --physdev-out tap800i0 -j tap800i0-IN
-A PVEFW-FWBR-IN -m physdev --physdev-is-bridged --physdev-out tap801i0 -j tap801i0-IN
-A PVEFW-FWBR-IN -m physdev --physdev-is-bridged --physdev-out tap802i0 -j tap802i0-IN
-A PVEFW-FWBR-IN -m physdev --physdev-is-bridged --physdev-out veth100i0 -j veth100i0-IN
-A PVEFW-FWBR-IN -m physdev --physdev-is-bridged --physdev-out veth700i0 -j veth700i0-IN
create PVEFW-FWBR-OUT (a3XLOO96rl7sA8sks3wMKsfYY+8)
-A PVEFW-FWBR-OUT -m physdev --physdev-is-bridged --physdev-in tap800i0 -j tap800i0-OUT
-A PVEFW-FWBR-OUT -m physdev --physdev-is-bridged --physdev-in tap801i0 -j tap801i0-OUT
-A PVEFW-FWBR-OUT -m physdev --physdev-is-bridged --physdev-in tap802i0 -j tap802i0-OUT
-A PVEFW-FWBR-OUT -m physdev --physdev-is-bridged --physdev-in veth100i0 -j veth100i0-OUT
-A PVEFW-FWBR-OUT -m physdev --physdev-is-bridged --physdev-in veth700i0 -j veth700i0-OUT
create PVEFW-HOST-IN (wYO4RxtGWIi0jV12dP6ai3R27Js)
-A PVEFW-HOST-IN -i lo -j ACCEPT
-A PVEFW-HOST-IN -m conntrack --ctstate INVALID -j DROP
-A PVEFW-HOST-IN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PVEFW-HOST-IN -p icmpv6 --icmpv6-type router-solicitation -j RETURN
-A PVEFW-HOST-IN -p icmpv6 --icmpv6-type router-advertisement -j RETURN
-A PVEFW-HOST-IN -p icmpv6 --icmpv6-type neighbor-solicitation -j RETURN
-A PVEFW-HOST-IN -p icmpv6 --icmpv6-type neighbor-advertisement -j RETURN
-A PVEFW-HOST-IN -p tcp -j PVEFW-tcpflags
-A PVEFW-HOST-IN -p igmp -j RETURN
-A PVEFW-HOST-IN -i vmbr0 -j GROUP-default-IN
-A PVEFW-HOST-IN -m mark --mark 0x80000000/0x80000000 -j RETURN
-A PVEFW-HOST-IN -m set --match-set PVEFW-0-management-v6 src -p tcp --dport 8006 -j RETURN
-A PVEFW-HOST-IN -m set --match-set PVEFW-0-management-v6 src -p tcp --dport 5900:5999 -j RETURN
-A PVEFW-HOST-IN -m set --match-set PVEFW-0-management-v6 src -p tcp --dport 3128 -j RETURN
-A PVEFW-HOST-IN -m set --match-set PVEFW-0-management-v6 src -p tcp --dport 22 -j RETURN
-A PVEFW-HOST-IN -m set --match-set PVEFW-0-management-v6 src -p tcp --dport 60000:60050 -j RETURN
-A PVEFW-HOST-IN -j PVEFW-Drop
-A PVEFW-HOST-IN -j DROP
create PVEFW-HOST-OUT (xDjizyEwaEN268ucLgIqQIUQ7vg)
-A PVEFW-HOST-OUT -o lo -j ACCEPT
-A PVEFW-HOST-OUT -m conntrack --ctstate INVALID -j DROP
-A PVEFW-HOST-OUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PVEFW-HOST-OUT -p icmpv6 --icmpv6-type router-solicitation -j RETURN
-A PVEFW-HOST-OUT -p icmpv6 --icmpv6-type neighbor-solicitation -j RETURN
-A PVEFW-HOST-OUT -p icmpv6 --icmpv6-type neighbor-advertisement -j RETURN
-A PVEFW-HOST-OUT -p igmp -j RETURN
-A PVEFW-HOST-OUT -o vmbr0 -j GROUP-default-OUT
-A PVEFW-HOST-OUT -m mark --mark 0x80000000/0x80000000 -j RETURN
-A PVEFW-HOST-OUT -o vmbr0 -p tcp --dport 80 -j RETURN
-A PVEFW-HOST-OUT -o vmbr0 -p tcp -j RETURN
-A PVEFW-HOST-OUT -j PVEFW-Drop
-A PVEFW-HOST-OUT -j DROP
create PVEFW-INPUT (+5iMmLaxKXynOB/+5xibfx7WhFk)
-A PVEFW-INPUT -j PVEFW-HOST-IN
create PVEFW-OUTPUT (LjHoZeSSiWAG3+2ZAyL/xuEehd0)
-A PVEFW-OUTPUT -j PVEFW-HOST-OUT
create PVEFW-Reject (aL1nrxJk/u3XmTb3Am2eaM/3yCM)
-A PVEFW-Reject -p tcp --dport 43 -j PVEFW-reject
-A PVEFW-Reject -j PVEFW-DropBroadcast
-A PVEFW-Reject -p icmpv6 -m icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
-A PVEFW-Reject -p icmpv6 -m icmpv6 --icmpv6-type time-exceeded -j ACCEPT
-A PVEFW-Reject -p icmpv6 -m icmpv6 --icmpv6-type packet-too-big -j ACCEPT
-A PVEFW-Reject -m conntrack --ctstate INVALID -j DROP
-A PVEFW-Reject -p udp --match multiport --dports 135,445 -j PVEFW-reject
-A PVEFW-Reject -p udp --dport 137:139 -j PVEFW-reject
-A PVEFW-Reject -p udp --sport 137 --dport 1024:65535 -j PVEFW-reject
-A PVEFW-Reject -p tcp --match multiport --dports 135,139,445 -j PVEFW-reject
-A PVEFW-Reject -p udp --dport 1900 -j DROP
-A PVEFW-Reject -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A PVEFW-Reject -p udp --sport 53 -j DROP
create PVEFW-SET-ACCEPT-MARK (Hg/OIgIwJChBUcWU8Xnjhdd2jUY)
-A PVEFW-SET-ACCEPT-MARK -j MARK --set-mark 0x80000000/0x80000000
create PVEFW-logflags (MN4PH1oPZeABMuWr64RrygPfW7A)
-A PVEFW-logflags -j DROP
create PVEFW-reject (etEECUYcgUdzuuO+LDP83pu0S8Y)
-A PVEFW-reject -p icmpv6 -j DROP
-A PVEFW-reject -p tcp -j REJECT --reject-with tcp-reset
-A PVEFW-reject -p udp -j REJECT --reject-with icmp6-port-unreachable
-A PVEFW-reject -j REJECT --reject-with icmp6-adm-prohibited
create PVEFW-tcpflags (CMFojwNPqllyqD67NeI5m+bP5mo)
-A PVEFW-tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -g PVEFW-logflags
-A PVEFW-tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -g PVEFW-logflags
-A PVEFW-tcpflags -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -g PVEFW-logflags
-A PVEFW-tcpflags -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -g PVEFW-logflags
-A PVEFW-tcpflags -p tcp -m tcp --sport 0 --tcp-flags FIN,SYN,RST,ACK SYN -g PVEFW-logflags
create tap800i0-IN (lTLjVGHVuubG8Qd8RtshZFxpHbo)
-A tap800i0-IN -p udp --sport 547 --dport 546 -j ACCEPT
-A tap800i0-IN -p icmpv6 --icmpv6-type router-solicitation -j ACCEPT
-A tap800i0-IN -p icmpv6 --icmpv6-type router-advertisement -j ACCEPT
-A tap800i0-IN -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-A tap800i0-IN -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-A tap800i0-IN -j GROUP-default-IN
-A tap800i0-IN -m mark --mark 0x80000000/0x80000000 -j ACCEPT
-A tap800i0-IN -j PVEFW-Drop
-A tap800i0-IN -j DROP
create tap800i0-OUT (d2JztIS+moByZ00wpYT6fbxUTf4)
-A tap800i0-OUT -p udp --sport 546 --dport 547 -g PVEFW-SET-ACCEPT-MARK
-A tap800i0-OUT -m mac ! --mac-source XX:XX:XX:XX:XX:XX -j DROP
-A tap800i0-OUT -p icmpv6 --icmpv6-type router-advertisement -j DROP
-A tap800i0-OUT -j MARK --set-mark 0x00000000/0x80000000
-A tap800i0-OUT -p icmpv6 --icmpv6-type router-solicitation -g PVEFW-SET-ACCEPT-MARK
-A tap800i0-OUT -p icmpv6 --icmpv6-type neighbor-solicitation -g PVEFW-SET-ACCEPT-MARK
-A tap800i0-OUT -p icmpv6 --icmpv6-type neighbor-advertisement -g PVEFW-SET-ACCEPT-MARK
-A tap800i0-OUT -j GROUP-default-OUT
-A tap800i0-OUT -m mark --mark 0x80000000/0x80000000 -j RETURN
-A tap800i0-OUT -p tcp --dport 80 -g PVEFW-SET-ACCEPT-MARK
-A tap800i0-OUT -j PVEFW-Drop
-A tap800i0-OUT -j DROP
create tap801i0-IN (vnk8h8ss7S4w+VtyKAN2JdiaFEk)
-A tap801i0-IN -p udp --sport 547 --dport 546 -j ACCEPT
-A tap801i0-IN -p icmpv6 --icmpv6-type router-solicitation -j ACCEPT
-A tap801i0-IN -p icmpv6 --icmpv6-type router-advertisement -j ACCEPT
-A tap801i0-IN -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-A tap801i0-IN -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-A tap801i0-IN -j GROUP-default-IN
-A tap801i0-IN -m mark --mark 0x80000000/0x80000000 -j ACCEPT
-A tap801i0-IN -j PVEFW-Drop
-A tap801i0-IN -j DROP
create tap801i0-OUT (6fFptpL+B7DbCrFRgToS1Fp4zOE)
-A tap801i0-OUT -p udp --sport 546 --dport 547 -g PVEFW-SET-ACCEPT-MARK
-A tap801i0-OUT -m mac ! --mac-source XX:XX:XX:XX:XX:XX -j DROP
-A tap801i0-OUT -p icmpv6 --icmpv6-type router-advertisement -j DROP
-A tap801i0-OUT -j MARK --set-mark 0x00000000/0x80000000
-A tap801i0-OUT -p icmpv6 --icmpv6-type router-solicitation -g PVEFW-SET-ACCEPT-MARK
-A tap801i0-OUT -p icmpv6 --icmpv6-type neighbor-solicitation -g PVEFW-SET-ACCEPT-MARK
-A tap801i0-OUT -p icmpv6 --icmpv6-type neighbor-advertisement -g PVEFW-SET-ACCEPT-MARK
-A tap801i0-OUT -j GROUP-default-OUT
-A tap801i0-OUT -m mark --mark 0x80000000/0x80000000 -j RETURN
-A tap801i0-OUT -p tcp --dport 80 -g PVEFW-SET-ACCEPT-MARK
-A tap801i0-OUT -p tcp --dport 443 -g PVEFW-SET-ACCEPT-MARK
-A tap801i0-OUT -j PVEFW-Drop
-A tap801i0-OUT -j DROP
create tap802i0-IN (lMzGJ0+SMdqtoStyXvH1IPcbDCg)
-A tap802i0-IN -p udp --sport 547 --dport 546 -j ACCEPT
-A tap802i0-IN -p icmpv6 --icmpv6-type router-solicitation -j ACCEPT
-A tap802i0-IN -p icmpv6 --icmpv6-type router-advertisement -j ACCEPT
-A tap802i0-IN -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-A tap802i0-IN -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-A tap802i0-IN -j GROUP-default-IN
-A tap802i0-IN -m mark --mark 0x80000000/0x80000000 -j ACCEPT
-A tap802i0-IN -j PVEFW-Drop
-A tap802i0-IN -j DROP
create tap802i0-OUT (OCNJfG5t8FjpmGXGo0UmTE96jg4)
-A tap802i0-OUT -p udp --sport 546 --dport 547 -g PVEFW-SET-ACCEPT-MARK
-A tap802i0-OUT -m mac ! --mac-source XX:XX:XX:XX:XX:XX -j DROP
-A tap802i0-OUT -p icmpv6 --icmpv6-type router-advertisement -j DROP
-A tap802i0-OUT -j MARK --set-mark 0x00000000/0x80000000
-A tap802i0-OUT -p icmpv6 --icmpv6-type router-solicitation -g PVEFW-SET-ACCEPT-MARK
-A tap802i0-OUT -p icmpv6 --icmpv6-type neighbor-solicitation -g PVEFW-SET-ACCEPT-MARK
-A tap802i0-OUT -p icmpv6 --icmpv6-type neighbor-advertisement -g PVEFW-SET-ACCEPT-MARK
-A tap802i0-OUT -j GROUP-default-OUT
-A tap802i0-OUT -m mark --mark 0x80000000/0x80000000 -j RETURN
-A tap802i0-OUT -p tcp --dport 80 -g PVEFW-SET-ACCEPT-MARK
-A tap802i0-OUT -p tcp --dport 443 -g PVEFW-SET-ACCEPT-MARK
-A tap802i0-OUT -j PVEFW-Drop
-A tap802i0-OUT -j DROP
create veth100i0-IN (qK/wAlqYPsacG+UwfOSLuroaSZw)
-A veth100i0-IN -p udp --sport 547 --dport 546 -j ACCEPT
-A veth100i0-IN -p icmpv6 --icmpv6-type router-solicitation -j ACCEPT
-A veth100i0-IN -p icmpv6 --icmpv6-type router-advertisement -j ACCEPT
-A veth100i0-IN -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-A veth100i0-IN -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-A veth100i0-IN -j GROUP-default-IN
-A veth100i0-IN -m mark --mark 0x80000000/0x80000000 -j ACCEPT
-A veth100i0-IN -p udp --dport 53 -j ACCEPT
-A veth100i0-IN -p tcp --dport 53 -j ACCEPT
-A veth100i0-IN -j PVEFW-Drop
-A veth100i0-IN -j DROP
create veth100i0-OUT (SEeXJUJonSWXjbLzlDSklhk8aAU)
-A veth100i0-OUT -p udp --sport 546 --dport 547 -g PVEFW-SET-ACCEPT-MARK
-A veth100i0-OUT -m mac ! --mac-source XX:XX:XX:XX:XX:XX -j DROP
-A veth100i0-OUT -p icmpv6 --icmpv6-type router-advertisement -j DROP
-A veth100i0-OUT -j MARK --set-mark 0x00000000/0x80000000
-A veth100i0-OUT -p icmpv6 --icmpv6-type router-solicitation -g PVEFW-SET-ACCEPT-MARK
-A veth100i0-OUT -p icmpv6 --icmpv6-type neighbor-solicitation -g PVEFW-SET-ACCEPT-MARK
-A veth100i0-OUT -p icmpv6 --icmpv6-type neighbor-advertisement -g PVEFW-SET-ACCEPT-MARK
-A veth100i0-OUT -j GROUP-default-OUT
-A veth100i0-OUT -m mark --mark 0x80000000/0x80000000 -j RETURN
-A veth100i0-OUT -p tcp --dport 80 -g PVEFW-SET-ACCEPT-MARK
-A veth100i0-OUT -p tcp --dport 443 -g PVEFW-SET-ACCEPT-MARK
-A veth100i0-OUT -j PVEFW-Drop
-A veth100i0-OUT -j DROP
create veth700i0-IN (IO0SD3iWECj+s+cUILk9a5dptac)
-A veth700i0-IN -p udp --sport 547 --dport 546 -j ACCEPT
-A veth700i0-IN -p icmpv6 --icmpv6-type router-solicitation -j ACCEPT
-A veth700i0-IN -p icmpv6 --icmpv6-type router-advertisement -j ACCEPT
-A veth700i0-IN -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
-A veth700i0-IN -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT
-A veth700i0-IN -j GROUP-default-IN
-A veth700i0-IN -m mark --mark 0x80000000/0x80000000 -j ACCEPT
-A veth700i0-IN -j PVEFW-Drop
-A veth700i0-IN -j DROP
create veth700i0-OUT (G6pWIdizFZTxn0ASNUI6RF1nJtY)
-A veth700i0-OUT -p udp --sport 546 --dport 547 -g PVEFW-SET-ACCEPT-MARK
-A veth700i0-OUT -m mac ! --mac-source XX:XX:XX:XX:XX:XX -j DROP
-A veth700i0-OUT -p icmpv6 --icmpv6-type router-advertisement -j DROP
-A veth700i0-OUT -j MARK --set-mark 0x00000000/0x80000000
-A veth700i0-OUT -p icmpv6 --icmpv6-type router-solicitation -g PVEFW-SET-ACCEPT-MARK
-A veth700i0-OUT -p icmpv6 --icmpv6-type neighbor-solicitation -g PVEFW-SET-ACCEPT-MARK
-A veth700i0-OUT -p icmpv6 --icmpv6-type neighbor-advertisement -g PVEFW-SET-ACCEPT-MARK
-A veth700i0-OUT -j GROUP-default-OUT
-A veth700i0-OUT -m mark --mark 0x80000000/0x80000000 -j RETURN
-A veth700i0-OUT -p tcp --dport 80 -g PVEFW-SET-ACCEPT-MARK
-A veth700i0-OUT -j PVEFW-Drop
-A veth700i0-OUT -j DROP
ebtables cmdlist:
create PVEFW-FORWARD (ULtZ6lqjrD/jAKLY+OZo3BbXs9k)
-A PVEFW-FORWARD -p IPv4 -j ACCEPT
-A PVEFW-FORWARD -p IPv6 -j ACCEPT
-A PVEFW-FORWARD -o fwln+ -j PVEFW-FWBR-OUT
create PVEFW-FWBR-OUT (lAOUWz7/GgaoB9l9aoEGwRdqYU8)
-A PVEFW-FWBR-OUT -i tap800i0 -j tap800i0-OUT
-A PVEFW-FWBR-OUT -i tap801i0 -j tap801i0-OUT
-A PVEFW-FWBR-OUT -i tap802i0 -j tap802i0-OUT
-A PVEFW-FWBR-OUT -i veth100i0 -j veth100i0-OUT
-A PVEFW-FWBR-OUT -i veth700i0 -j veth700i0-OUT
create tap800i0-OUT (iv41Vxxe0F4IL50yCpCsxp4i6Ow)
-A tap800i0-OUT -s ! 3e:66:ee:4e:ba:76 -j DROP
-A tap800i0-OUT -j ACCEPT
create tap801i0-OUT (GZ+46bW9sPo9jNjvmBFMKIUh7wI)
-A tap801i0-OUT -s ! be:36:87:2b:1:3a -j DROP
-A tap801i0-OUT -j ACCEPT
create tap802i0-OUT (bclPyCr1jxyZ4tDlS274bstB2nQ)
-A tap802i0-OUT -s ! fe:d9:25:40:3e:2e -j DROP
-A tap802i0-OUT -j ACCEPT
create veth100i0-OUT (T3ApX1bXeEz2QkXj5fbPJ4jFAKw)
-A veth100i0-OUT -s ! 66:4e:88:f9:f0:a1 -j DROP
-A veth100i0-OUT -j ACCEPT
create veth700i0-OUT (ex7PX8TAPDSz8RHp+7fkz/y+puE)
-A veth700i0-OUT -s ! 1a:e7:60:55:5e:1b -j DROP
-A veth700i0-OUT -j ACCEPT
iptables table raw cmdlist:
ip6tables table raw cmdlist:
detected changes
---snip---
Mar 27 19:00:06 pve-pi pvestatd[1284]: QEMU/KVM cannot detect CPU flags on ARM (aarch64)
Mar 27 19:00:06 pve-pi pvestatd[1284]: CPU flag detection failed, will try again after delay
Mar 27 19:00:16 pve-pi pve-firewall[1268]: status update error: unable to open file '/proc/sys/net/bridge/bridge-nf-call-iptables' - No such file or directory
Mar 27 19:00:26 pve-pi pve-firewall[1268]: status update error: unable to open file '/proc/sys/net/bridge/bridge-nf-call-iptables' - No such file or directory
Mar 27 19:00:36 pve-pi pve-firewall[1268]: status update error: unable to open file '/proc/sys/net/bridge/bridge-nf-call-iptables' - No such file or directory
Mar 27 19:00:46 pve-pi pve-firewall[1268]: status update error: unable to open file '/proc/sys/net/bridge/bridge-nf-call-iptables' - No such file or directory
Mar 27 19:00:56 pve-pi pve-firewall[1268]: status update error: unable to open file '/proc/sys/net/bridge/bridge-nf-call-iptables' - No such file or directory
Mar 27 19:01:06 pve-pi pve-firewall[1268]: status update error: unable to open file '/proc/sys/net/bridge/bridge-nf-call-iptables' - No such file or directory
Mar 27 19:01:16 pve-pi pve-firewall[1268]: status update error: unable to open file '/proc/sys/net/bridge/bridge-nf-call-iptables' - No such file or directory
Mar 27 19:01:26 pve-pi pve-firewall[1268]: status update error: unable to open file '/proc/sys/net/bridge/bridge-nf-call-iptables' - No such file or directory
Mar 27 19:01:36 pve-pi pve-firewall[1268]: status update error: unable to open file '/proc/sys/net/bridge/bridge-nf-call-iptables' - No such file or directory
Mar 27 19:01:46 pve-pi pve-firewall[1268]: status update error: unable to open file '/proc/sys/net/bridge/bridge-nf-call-iptables' - No such file or directory
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent