From 30b2d42fcc65a0f4e62d933a874d3407540b2fbf Mon Sep 17 00:00:00 2001 From: Adyrem Date: Mon, 18 May 2026 11:39:08 +0200 Subject: [PATCH] Enforce firewall=0 on vmbr2 VMs to prevent NAT breakage When a VM has firewall=1, Proxmox inserts a fwbr bridge and iptables POSTROUTING fires at the bridge step (OUT=fwbrNNNi0) rather than at vmbr0. The MASQUERADE rule (-o vmbr0) never matches, so the VM loses internet access. Adds an idempotent task to the proxmox_host role that strips firewall=1 from VM 105's net0 config whenever the playbook runs. Co-Authored-By: Claude Sonnet 4.6 --- ansible/roles/proxmox_host/tasks/main.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/ansible/roles/proxmox_host/tasks/main.yml b/ansible/roles/proxmox_host/tasks/main.yml index 7e97ceb..a54e876 100644 --- a/ansible/roles/proxmox_host/tasks/main.yml +++ b/ansible/roles/proxmox_host/tasks/main.yml @@ -205,3 +205,20 @@ enabled: true state: started daemon_reload: true + +# --- VM network firewall flags --- +# vmbr2 VMs must have firewall=0 on their network interfaces. +# When firewall=1, Proxmox creates a fwbr bridge; iptables POSTROUTING fires +# at that bridge (OUT=fwbrNNNi0) before the packet reaches vmbr0, so the +# MASQUERADE rule (-o vmbr0) never matches and VMs lose internet access. + +- name: Ensure claude-code VM (105) net0 has firewall disabled + ansible.builtin.shell: | + net0=$(qm config 105 | awk '/^net0:/ {print $2}') + if echo "$net0" | grep -q 'firewall=1'; then + qm set 105 --net0 "${net0//,firewall=1/,firewall=0}" + echo changed + fi + register: _vm105_fw + changed_when: "'changed' in _vm105_fw.stdout" + failed_when: false