Configuring routing on Proxmox

[Jeremiah Steaves Isaac]

Hi All,

I need help with routing on proxmox.

I am trying to configure routing as shown in the diagram attached.

I will start configuring the routing part later, but what i dont understand is how VMs in the 192.168.1.0/24 network are able to ping vmbr0 . I need to isolate them and make them communicate only with vmbr1 as shown the diagram. Once that is achieved , i could configure routing on the ubuntu proxy.

I tried dropping packets on both interfaces of the proxmox server with the following iptables rules but i'm still able to ping vmbr0 from the 192.168.1.0/24 network.

EDIT : vmbr0 is bridged to eth0 on the proxmox server and vmbr1 is bridged to the ethernets of the VMs and eth1 of the ubuntu proxy (as in diagram ).


iptables -I FORWARD -i vmbr0 -o vmbr1 -j DROP
iptables -I FORWARD -o vmbr0 -i vmbr1 -j DROP


I even disabled ip forwarding on the proxmox server . I'm sure i'm missing something, not sure what it is though.

 

[Richard]

I will start configuring the routing part later, but what i dont understand is how VMs in the 192.168.1.0/24 network are able to ping vmbr0 .

but i'm still able to ping vmbr1 from the 192.168.1.0/24 network.

Do you mean now vmbr0 or vmbr1?

vmbr0 is bridged to eth0 on the proxmox server and vmbr1 isnt bridged to any interface.

But the diagram says it is .....

iptables -I FORWARD -i vmbr0 -o vmbr1 -j DROP
iptables -I FORWARD -o vmbr0 -i vmbr1 -j DROP
I even disabled ip forwarding on the proxmox server .

If you ping from any VM to 10.0.0.1 it works when default route it 192.168.1.1, also in case of forwarding disabled respectively DROPped. Since 10.0.0.1 is assigned to the same server as 192.168.1.1 no forward is necessary. To avoid this you have to define

iptables -I INPUT -d 10.0.0.0/24 -s 192.168.1.0/24 -j DROP

 

[Jeremiah Steaves Isaac]

Do you mean now vmbr0 or vmbr1?





But the diagram says it is .....




If you ping from any VM to 10.0.0.1 it works when default route it 192.168.1.1, also in case of forwarding disabled respectively DROPped. Since 10.0.0.1 is assigned to the same server as 192.168.1.1 no forward is necessary. To avoid this you have to define

iptables -I INPUT -d 10.0.0.0/24 -s 192.168.1.0/24 -j DROP

Thanks a lot Richard, that was careless of me, but you got the idea. I have made the edits. Just gotta work on the routing part now