← All break/fix scenarios in Proxmox VE
Network becomes unreachable after enabling the PVE firewall
Reported symptoms
- ●After enabling the PVE firewall, the host becomes unreachable
- ●Cannot reach the GUI on port 8006
- ●Console access is required to recover
- ●Cluster nodes cannot communicate with each other
Evidence
- · iptables -L -n -v shows DROP rules for the management network
- · /etc/pve/firewall/cluster.fw has rules that block the management subnet
- · cat /etc/pve/local/net.fw shows node-level rules
- · pve-firewall status shows running with no allow rules
Diagnosis and resolutionclick to reveal
Root cause
The PVE firewall was enabled without explicit allow rules for the management network. The default policy is DROP, and without matching ACCEPT rules, the firewall blocks everything except established connections.
Remediation
1. If you still have shell access (console or out-of-band): Add management allow rules. Write this into `/etc/pve/firewall/cluster.fw`: ```text [OPTIONS] enable: 1 policy_in: DROP [RULES] GROUP management-access GROUP management-access IN ACCEPT -source 10.0.0.0/24 -log nolog GROUP management-access IN ACCEPT -p tcp --dport 8006 -log nolog GROUP management-access IN ACCEPT -p tcp --dport 22 -log nolog ``` Then reload the firewall with `pve-firewall restart`. 2. If you have no access at all: - Use IPMI / iLO / iDRAC console - Disable the firewall via the local config: `/etc/pve/firewall/cluster.fw` set `enable: 0` Or run `pve-firewall stop` then `pve-firewall disable` - Reboot 3. Reconnect via SSH or GUI. 4. Add proper allow rules, then re-enable.
Verification
- GUI is reachable - SSH is reachable from the management network - Cluster nodes can communicate (pvecm status works) - Existing VM traffic is unaffected
Prevention
- Always start with explicit allow rules before enabling the firewall - Test in a lab or staging environment first - Keep IPMI / iLO / iDRAC access available as a fallback - Document the firewall config and review with the team before enabling - Use the `pve-firewall simulate` command to test rules before committing