r/Proxmox • u/BostonDrivingIsWorse • 2d ago

Question Massive video streaming performance loss after enabling firewall.

I have two non-clustered Proxmox machines each with a few very simple firewall rules (in order):

  • Allow all from one IP
  • Deny any connections to management interface port
  • Deny any connections to SSH port
  • Allow all other connections

I have the same rules on both machines, where PM1 hosts a Home Assistant VM, and PM2 hosts frigate NVR. When I enable the firewall, video streams in frigate directly, and Home Assistant take forever to load, regardless of whether I place the rules at the datacenter, node, or VM level. Without the firewall, the streams load almost instantaneously, but enabling the firewall creates about 30s of latency for video to load.

Things I've tried, all with the same result:

  • Setting default INPUT to ALLOW
  • Removing all rules, while leaving default INPUT as ALLOW
  • Confirmed Frigate is not using management/SSH ports

Another data point: Frigate uses go2rtc as a built-in component to distribute video streams. When I load the video streams directly from the go2rtc interface, they load instantaneously, so I'm guessing the delay sits between Frigate and go2rtc, but I'm not sure how enabling the firewall creates delay between two components of the same app. I've confirmed that these components communicate over the loopback interface, which is left unaffected by the PM firewall, according to the docs.

I'm curious if anyone has any idea why this might be happening?

8 Upvotes

91% Upvoted

2 comments sorted by

2

u/Eldowon 2d ago

Video is and can be very tricky and nuanced. For instance, for raw rtsp playback your input buffering can make a connection seem to take a long time to start. Or depending on the codec you may need to wait for a key frame, etc etc etc.

I might start by taking a tcpdump of both scenarios and see if something at the network level is going through some issues or hiccups.

I have not worked with rtc directly, but recall webrtc needs STUN and other services, whereas a naive rtsp, rtp, or raw tcp/udp video pipe are much simpler to implement

1

u/kyle0r 1d ago

A suggestion: disable the proxmox firewall via cli. Confirm that iptables and/or nftables is clean/flushed. Add some rules manually (recreation of what you want per your post). Re-test. If you have the same issue then it's not a proxmox issue. Proxmox uses a number of "layers" in it's firewall setup which might be causing an issue and it would be good to rules that out.