Can't access internet from VMs in bridge network

Schilling8679

New Member
Feb 11, 2025
2
1
3
Hello, community. I'm rookie at proxmox and not a linux expert also. And English is not my main. So, if I forget to show something important, just ask.

Okay, I have proxmox installed on baremetal. I tried both bridge networking and NAT networking, that's why I have configs for both, that's not an error or misconfig. While NAT mode works perfectly with my VMs, in bridge mode they don't. Every firewall on every point is turned off. Proxmox version: 8.3.3.

proxmox host:
Bash:
root@meowth:~# cat /etc/network/interfaces
# network interface settings; autogenerated
# Please do NOT modify this file directly, unless you know what
# you're doing.
#
# If you want to manage parts of the network configuration manually,
# please utilize the 'source' or 'source-directory' directives to do
# so.
# PVE will preserve these directives, but will NOT read its network
# configuration from sourced files, so do not attempt to move any of
# the PVE managed interfaces into external files!

auto lo
iface lo inet loopback

iface eno1 inet manual

iface eno2 inet manual

auto vmbr0
iface vmbr0 inet static
        address 10.127.127.250/24
        gateway 10.127.127.254
        bridge-ports eno1
        bridge-stp off
        bridge-fd 0

auto vmbr1
iface vmbr1 inet static
        address 10.127.128.254/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0

        post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up   iptables -t nat -A POSTROUTING -s '10.127.128.0/24' -o vmbr0 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '10.127.128.0/24' -o vmbr0 -j MASQUERADE
        post-up   iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
        post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1

VM1: bridge=vmbr0 (not work):
Bash:
root@vm1:~# cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug ens18
iface ens18 inet static
address 10.127.127.101/24
gateway 10.127.127.254
# dns -* options are implemented by the resolvconf package, if installed
dns-nameservers 9.9.9.9

so, I change configuration.

VM1: bridge=vmbr1 (working):
Bash:
root@vm1:~# cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug ens18
iface ens18 inet static
address 10.127.128.101/24
gateway 10.127.128.254
# dns -* options are implemented by the resolvconf package, if installed
dns-nameservers 9.9.9.9

What can be wrong? I read the docs, I wached countless videos on Youtube, on similar setups it just works for lots of people.

Also, while VMs not work, looks like there is no problem for LXC containers. I created a couple and they work flawlessly in bridge mode.
 
Dumb question; Is the bridge port on vmbr1 supposed to be "bridge-ports none"? How does it reach the gateway at .254? My bridges all connect to an interface or bond usually - and 'just work'. But I don't use nat rules on the pve host.


Also are you removing the nat rules when testing the bridge? Your config is a bit more advanced than I run, so just curious if you need to set an interface for vmbr1 to connect, to get to the gateway 10.127.128.254?
 
Dumb question; Is the bridge port on vmbr1 supposed to be "bridge-ports none"? How does it reach the gateway at .254? My bridges all connect to an interface or bond usually - and 'just work'. But I don't use nat rules on the pve host.
post-up and post-down rules are written exactly for this. first allow devices in the 10.127.128.0/24 subnet to access the internet through the vmbr0 interface, second removes the rule.
Also are you removing the nat rules when testing the bridge?
no, because it's whole different bridge.
 
  • Like
Reactions: dj423