bridging is b0rked: private lan can't do anything

[clickface]

I have two bridges:
br0 for publically routed ip addresses
br1 for a private subnet

I would like a VM with an ip address in the br0 range to forward traffic to vms in the br1 range, but I'm a total n00b and nothing works

/etc/network/interfaces
auto lo
iface lo inet loopback
iface lo inet6 loopback

iface enp4s0 inet manual

auto vmbr0
iface vmbr0 inet static
address 176.2.3.4
netmask 255.255.255.224
gateway 176.2.3.1
bridge_ports enp4s0
bridge_stp off
bridge_fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up echo 1 > /proc/sys/net/ipv4/conf/enp4s0/proxy_arp

auto vmbr1
iface vmbr1 inet static
address 10.10.10.1
netmask 255.255.255.0
bridge_ports none
bridge_stp off
bridge_fd 0

I can ping the gateway at 10.10.10.1 from 10.10.10.20 but that's it. I can't ping 8.8.8.8 or any vm in the vmbr0 network.
Can someone rescue me from my lameness?

 

[Richard]

I have two bridges:
br0 for publically routed ip addresses
br1 for a private subnet

I would like a VM with an ip address in the br0 range to forward traffic to vms in the br1 range, but I'm a total n00b and nothing works

/etc/network/interfaces
auto lo
iface lo inet loopback
iface lo inet6 loopback

iface enp4s0 inet manual

auto vmbr0
iface vmbr0 inet static
address 176.2.3.4
netmask 255.255.255.224
gateway 176.2.3.1
bridge_ports enp4s0
bridge_stp off
bridge_fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up echo 1 > /proc/sys/net/ipv4/conf/enp4s0/proxy_arp

auto vmbr1
iface vmbr1 inet static
address 10.10.10.1
netmask 255.255.255.0
bridge_ports none
bridge_stp off
bridge_fd 0

I can ping the gateway at 10.10.10.1 from 10.10.10.20 but that's it. I can't ping 8.8.8.8 or any vm in the vmbr0 network.
Can someone rescue me from my lameness?

The VM should have rather an address in 176.2.3.0/27 range than in 10.10.10.0/24. Why not simply connecting all VMs with vmbr0?

If not possible (too small IP range) run Proxmox host as a nat router using 10.10.10.1 as gateway address (is simpler than proxy_arp):

iptables -t nat -A POSTROUTING -o vmbr0 -s 10.10.10.0/24 -j MASQUERADE