Kea-dhcp4,problem. No connection when assigning a static IP to proxmox lxc

[av8r]

backstory;
I've set up Scanopy to help map my network, and in doing so I had to spin up one LXC container on each VLAN. It works as intended if I let OPNsense hand out dynamic IP to each LXC, but as soon as I give it a static IP I loose connection immediately. I cant ping anything, and each deamon cannot connect to the Scanopy server.

I have the correct firewall rules. this is driving me nuts. any help would be greatly appreciated.

My ranges are i.e. 192.168.20.100-192.168.20.200. on each VLAN. I would like to give all the different LXCs .21 octa. thats when the trouble begins. any number I give it below .100 ends in connection loss. but when OPNsense hands out a i.e. .101 everything works as expected.

[nero355]

I am guessing you have got a setting similar to "If the IP Address is not in the DHCP Leases Database then refuse any connectivity to the Client" Enabled somewhere ??

[av8r]

Thank you for the reply, sounds like you could be into something. But it only happens on LXC devices. Do you have any tips on where to start looking for a setting like that?

[meyergru]

Did you set 192.168.20.21/24 and also set the gateway correctly (e.g. 192.168.20.1) for the LXC? Miss that and it won't work - basic stuff, you know.

[av8r]

Yes sir, everything on Proxmox LXC is correct. When I disable firewall in settings it works as intended.
I have the daemon ip's in the alias and have the ALLOWED to reach the server IP as well.

[meyergru]

Since the firewall is the culprit, you can check your firewall rules during a ping test from the client. You have the client's console available, because it is on Proxmox. Then, check the firewall live log (Firewall → Log Files → Live View) for a block and identify the blocking rule. If there are none, enable the "default block" rule logging in the settings.

If need be, you can verify if the traffic even arrives at the VLAN interface via tcpdump.

Also, check the alias if it really contains .21 - matter-of-fact, I recently had an incident where I created an alias, but then found under Firewall → Diagnostics → Aliases, that it was empty. Only changing the alias, applying and changing it back healed that.

Without doubt, you will find either a block rule or a rule that specifically allowed only your specific range or a rule where you reversed source and destination, i.e. a block rule that is too broad or an allow rule that is too narrow to allow the traffic.

[mooh]

If DHCP works but static assignments don't, you may want to try DHCP reservations. This way, your containers will always have the same addresses and you keep all the address assignment business in one place.