automating annoying tasks, sharing tips, and embracing less frustration Astro 2024-10-04T00:00:00+00:00 https://svnscha.de/tags/rescue/atom.xml 2024-10-04T00:00:00+00:00 2024-10-04T00:00:00+00:00 Sven Scharmentke https://svnscha.de/posts/proxmox-rescue-firewall-disable/

Ah, so you've locked yourself out of your own Proxmox server. Don't worry, happens.

<h2 id="why-you-ask">Why, You Ask?</h2> <p>If a firewall rule has locked you out of a Proxmox server, you can disable the firewall from a rescue system. Here is the process I used to regain access.</p> <h2 id="step-1-mount-the-proxmox-system">Step 1: Mount the Proxmox System</h2> <p>First, you need to access your Proxmox filesystem. If you're using LVM (Logical Volume Management), this step is pretty straightforward:</p> <pre class="astro-code dark-plus" style="background-color:#1E1E1E;color:#D4D4D4; overflow-x: auto;" tabindex="0" data-language="bash"><code><span class="line"><span style="color:#DCDCAA">mount</span><span style="color:#CE9178"> /dev/mapper/vg0-root</span><span style="color:#CE9178"> /mnt</span></span></code></pre> <p>With your filesystem mounted, chroot into it:</p> <pre class="astro-code dark-plus" style="background-color:#1E1E1E;color:#D4D4D4; overflow-x: auto;" tabindex="0" data-language="bash"><code><span class="line"><span style="color:#DCDCAA">chroot</span><span style="color:#CE9178"> /mnt/</span></span></code></pre> <p>Now you're inside your system, ready to work some magic.</p> <h2 id="step-2-disabling-the-firewall">Step 2: Disabling the Firewall</h2> <p>The firewall is likely what caused you to get locked out, so we'll need to disable it temporarily. Run the following commands:</p> <pre class="astro-code dark-plus" style="background-color:#1E1E1E;color:#D4D4D4; overflow-x: auto;" tabindex="0" data-language="bash"><code><span class="line"><span style="color:#DCDCAA">systemctl</span><span style="color:#CE9178"> disable</span><span style="color:#CE9178"> pve-firewall</span></span> <span class="line"><span style="color:#DCDCAA">systemctl</span><span style="color:#CE9178"> mask</span><span style="color:#CE9178"> pve-firewall</span></span></code></pre> <p>Once you've done that, reboot the server. You should now be able to reconnect to your system normally, without the firewall cutting you off.</p> <h2 id="step-3-fix-the-issue-and-restore-the-firewall">Step 3: Fix the Issue and Restore the Firewall</h2> <p>After fixing whatever issue got you locked out, it's time to re-enable the firewall. Run these commands to restore it:</p> <pre class="astro-code dark-plus" style="background-color:#1E1E1E;color:#D4D4D4; overflow-x: auto;" tabindex="0" data-language="bash"><code><span class="line"><span style="color:#DCDCAA">systemctl</span><span style="color:#CE9178"> unmask</span><span style="color:#CE9178"> pve-firewall</span></span> <span class="line"><span style="color:#DCDCAA">systemctl</span><span style="color:#CE9178"> enable</span><span style="color:#CE9178"> pve-firewall</span></span> <span class="line"><span style="color:#DCDCAA">systemctl</span><span style="color:#CE9178"> start</span><span style="color:#CE9178"> pve-firewall</span></span></code></pre> <p>Your firewall should now be back up and running, but without the lockout problem.</p> <h2 id="a-note-about-etcpvefirewallclusterfw">A Note About <code>/etc/pve/firewall/cluster.fw</code></h2> <p>If you're hunting for <code>/etc/pve/firewall/cluster.fw</code> while in rescue mode, hoping it's a typical file you can modify directly, you're out of luck. This file is part of Proxmox's cluster-wide configuration and is not stored as a regular file on the disk. Instead, it's managed through Proxmox's internal database, which is part of the <a href="https://pve.proxmox.com/wiki/Proxmox_Cluster_File_System_(pmxcfs)">Proxmox Cluster File System (pmxcfs)</a>. As such, it doesn't exist as a standalone file you can access from rescue mode. To modify this configuration, you'll need to regain full access to Proxmox and make changes from within the Proxmox interface or by editing it via the proper tools once you're back online.</p> <h2 id="summary">Summary</h2> <p>And there you have it! With your system back up and running, and the firewall behaving, you can get back to managing your Proxmox server. Just be cautious next time you tweak the firewall rules - locking yourself out isn't the most fun way to spend your day!</p>