0

Yeah, so this one is going to be a journey. Let me outline things and then get to the problem.

I have a Proxmox VE server (ver. 9) installed on my server. I have an SDN setup for a NAT network for my VMs. So far, so good. I have Tailscale installed on the PVE host to allow me to access the server remotely. I also tried to setup UFW to only allow connections through the tailscale connection. For reference, here are the rules:

$ ufw status verbose Status: active Logging: on (low) Default: deny (incoming), allow (outgoing), deny (routed) New profiles: skip To Action From -- ------ ---- Anywhere on tailscale0 ALLOW IN Anywhere Anywhere (v6) on tailscale0 ALLOW IN Anywhere (v6)

Fairly simple, which is all that I need. I have a Proxmox Backup Server also running on this tailnet, so it's a nice little package.

However, what happens is that when I enable UFW, my VMs cannot get an IP from the SDN. For reference, I setup the SDN for a private NAT network using this guide: https://pve.proxmox.com/wiki/Setup_Simple_Zone_With_SNAT_and_DHCP Again, a nice and simple setup.

I did think there was a problem with the UFW setup with a few changes:

  • I updated /etc/default/ufw and set DEFAULT_FORWARD_POLICY="ACCEPT"
  • I updated /etc/ufw/sysctl.conf and uncommented net.ipv4.ip_forward=1
  • I added the following to /etc/ufw/before.rule before the filter rules:
 *nat :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s 10.0.0.0/24 -o eno1 -j MASQUERADE COMMIT

Unfortunately this did not make a difference after applying the changes or rebooting the server. Essentially with UFW running, my VMs have a broken network. Any advice is appreciated.

Improve this question
2
  • One idea I have is to use the Proxmox firewall to define a default deny rule but adding an allow all rule for the Tailscale interface at the Datacenter level. I'll try that tomorrow, but curious on thoughts for this approach. Commented Aug 10 at 4:03
  • Just to note, using the Proxmox firewall didn't help - same problem. Commented Aug 11 at 2:52

1 Answer 1

Reset to default
0

So quick update here, the solution was to enable DHCP on the host, i.e. adding the following rules to UFW:

  • ufw allow bootos
  • ufw allow bootpc

It's arguable if I needed both, but I figured I may as well be complete, and this worked out great! Hopefully this helps others who may be running into the same issue.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.