From 57ef1fd7bef5f54dcdaf555feb7b163f66057c37 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Fri, 24 Jul 2026 06:09:25 +1000 Subject: [PATCH] proxmox: allow beszel agent port 45876 from mgmt network Adds an inbound ACCEPT rule for TCP 45876 so the beszel hub can poll the agent running on pve1. Scoped to +mgmt (192.168.2.0/24) to stay consistent with the existing default-deny policy. Rule applied live on pve1 via pve-firewall restart (2026-07-24). Co-Authored-By: Claude Sonnet 4.6 --- proxmox/config/pve-firewall/cluster.fw.example | 3 +++ 1 file changed, 3 insertions(+) diff --git a/proxmox/config/pve-firewall/cluster.fw.example b/proxmox/config/pve-firewall/cluster.fw.example index f25ae41..8a4faa6 100644 --- a/proxmox/config/pve-firewall/cluster.fw.example +++ b/proxmox/config/pve-firewall/cluster.fw.example @@ -33,6 +33,9 @@ IN ACCEPT -source +mgmt -p tcp -dport 22 -log nolog # docs/06-pve-test-wifi-network.md for a case this caused real confusion. IN ACCEPT -source +mgmt -p icmp -icmp-type echo-request -log nolog +# Beszel monitoring agent - the hub polls the agent on this port +IN ACCEPT -source +mgmt -p tcp -dport 45876 -log nolog + # Stage 2: Corosync (cluster quorum) - uncomment once node 2/3 join and # the corosync network/VLAN exists. # IN ACCEPT -source -p udp -dport 5404:5405 -log nolog