Traffic is only broadcasted to MAC B if the ARP-table in the switch times out.
Which makes this problem a hell to diagnose :-) On 9/10/21 12:53, Josef Johansson wrote: > Hi, > > I've stumpled upon this problem a couple of times and it resulted in me > add ebtables rules. It is a very annoying problem to be fair. In our > case what happen is > > * traffic is sent to MAC A because traffic flows towards IP A > > * traffic is broadcasted to MAC B and MAC A > > * MAC B responds with RST > > * upstream switch learns that IP A is at MAC B > > > We are doing some benchmark testing with it to ensure that performance > will not regress also, not done with that. > > > Another more lean solution would be do to DROP instead of REJECT, which > would solve it. > > > I have a patch for the source code regarding only allowing the VMs MAC > in ebtables for incoming traffic also. > > > On 9/10/21 12:31, alexandre derumier wrote: >> Hi, >> >> multiple users have reported problems with hetzner in bridged mode this >> week and pve-firewall >> https://forum.proxmox.com/threads/proxmox-claiming-mac-address.52601/ >> https://forum.proxmox.com/threads/mac-address-abuse-report.95656/ >> >> Seem that hetzner have bugs or are under attack, but they are flooding >> traffic to proxmox nodes with wrong mac/ip destination. >> >> The problem is that if users use pve-firewall with reject rules, the >> RST packet is send with the wrong mac/ip as source, >> >> and then hertzner is blocking the server of the users .... >> >> >> I'm looking to see if we could add filtering at ebtables level, to drop >> wrong mac destination. >> >> But they are also another problem, if user use DROP as default action, >> we have a default REJECT for whois port 53. >> >> 'PVEFW-Drop' => [ >> # same as shorewall 'Drop', which is equal to DROP, >> # but REJECT/DROP some packages to reduce logging, >> # and ACCEPT critical ICMP types >> { action => 'PVEFW-reject', proto => 'tcp', dport => '43' }, # >> REJECT 'auth' >> >> Does somebody known why we do a reject here ? could it be change to >> drop ? >> >> >> >> >> _______________________________________________ >> pve-devel mailing list >> pve-devel@lists.proxmox.com >> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel -- Med vänliga hälsningar Josef Johansson _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
