> indeed igmp is filtered, and that's break my multicast traffic > > -A PVEFW-HOST-OUT --protocol igmp -j ACCEPT > -A PVEFW-HOST-IN --protocol igmp -j ACCEPT > > > is enough to resolve the problem ok, added.