Resolving portblock Version Incompatibility on Debian 12, Proxmox VE 8, and Ubuntu 24.04

For some versions of Linux, the iptables utility might be incompatible with the OCF portblock resource agent. This is a known incompatibility between iptables version 1.8.9 (and some 1.8.10 versions) and the portblock resource agent.

At the time of writing, the versions of Linux distributions that are known to be affected by this issue are:

• Debian 12
• Proxmox VE 8 (extension of Debian 12)
• Ubuntu 24.04 LTS

The issue is fixed in iptables 1.8.11 and in OCF resource-agents 4.14.0, so later releases such as Debian 13 and Ubuntu 26.04 are not affected.

The incompatibility issue between some versions of iptables and the portblock resource agent might show up in a high-availability deployment as:

• Resource “flapping” behavior between the hosting nodes, that is, DRBD Reactor (or another cluster resource manager) might attempt to continually promote resources on various nodes, yet always fail to promote the iSCSI or NFS services due to the portblock incompatibility.
• You might also experience an inability to connect to a promoted NFS or iSCSI resource, for example, in LINSTOR Gateway deployments.

Running the following script (with sudo or as root) creates a dummy iptables rule, checks whether the system is affected, then deletes the dummy rule:

#!/bin/bash

iptables -A OUTPUT -d 1.2.3.4 -j LOG -p tcp

case $(iptables -nL | awk '/^LOG/ && /1\.2\.3\.4/ { print $2 }') in
        tcp) echo "not affected" ;;  # human-readable protocol
        6)   echo "affected"     ;;  # numeric protocol
        *)   echo "test failed"  ;;
esac

iptables -D OUTPUT -d 1.2.3.4 -j LOG -p tcp

Until distribution maintainers implement a patch, you will need to manually patch Ubuntu 24.04 (iptables 1.8.10, resource-agents 4.13.0), Debian 12 (iptables 1.8.9, resource-agents 4.12.0), and as a consequence, Proxmox VE 8 systems.

Replace the portblock resource agent with the upstream 4.16.0 version:

wget -O /usr/lib/ocf/resource.d/heartbeat/portblock \
  https://raw.githubusercontent.com/ClusterLabs/resource-agents/v4.16.0/heartbeat/portblock

📝 NOTE: Version 4.16.0 of the portblock resource agent relies only on OCF shell functions (ocf-shellfuncs and ocf-binaries) that the resource-agents packages on Debian 12 and Ubuntu 24.04 provide. Download this tagged version rather than the agent on the main branch, which expects newer definitions in those files than these packages ship.

Prevent future system updates from overwriting the patched resource agent:

# Ubuntu 24.04
apt-mark hold resource-agents-extra

# Debian 12
apt-mark hold resource-agents

Distribution-shipped resource-agents packages can be older than upstream and might not include the latest fixes or features. In a DRBD Reactor deployment, you can install OCF resource agents directly from upstream with the resource_agents_upstream role from the linbit.drbd_reactor collection. The role downloads resource agents and dependencies from upstream, bypassing the need to rely on system packaging.

The role does not overwrite agents that a distribution package installed, so first remove those packages:

# apt
apt remove 'resource-agents*'

# dnf
dnf remove 'resource-agents*'

# zypper
zypper remove 'resource-agents*'

⚠️ WARNING: Use this role only in DRBD Reactor deployments. It is not intended for Pacemaker clusters, which depend on resource-agents* packages. Removing resource-agents packages on a Pacemaker system will remove Pacemaker.

Then install the upstream agents:

- name: Install OCF resource agents from upstream
  hosts: all
  become: true
  tasks:
    - name: Install OCF resource agents
      ansible.builtin.import_role:
        name: linbit.drbd_reactor.resource_agents_upstream

Written by MAT, 2025-06-26.

Reviewed by CB, 2025-08-05.