Container inside VM can't access internet on a Proxmox host at Hetzner

[frankhommers]

I have a server an an extra /29 subnet at Hetzner.
Everything seems to work, except that my containers running on a VM don't have internet access... Can someone please help?

My hosts /etc/network/interfaces looks like this:

auto lo
iface lo inet loopback
iface lo inet6 loopback

auto enp41s0
iface enp41s0 inet static
        address 65.109.88.92/26
        gateway 65.109.88.65
        up ip route add 65.109.88.64/26 via 65.109.88.65 dev enp41s0

iface enp41s0 inet6 static
  address 2a01:4f9:3051:429f::2/128
  gateway fe80::1

# VM-Bridge used by Proxmox Guests
auto vmbr0
iface vmbr0 inet static
  address 65.109.88.92/32
  bridge_stp off
  bridge_ports none
  bridge_fd 0
  bridge_maxwait 0

  up ip route add 95.217.69.120 dev vmbr0
  up ip route add 95.217.69.121 dev vmbr0
  up ip route add 95.217.69.122 dev vmbr0
  up ip route add 95.217.69.123 dev vmbr0
  up ip route add 95.217.69.124 dev vmbr0
  up ip route add 95.217.69.125 dev vmbr0
  up ip route add 95.217.69.126 dev vmbr0
  up ip route add 95.217.69.127 dev vmbr0

iface vmbr0 inet6 static
  address 2a01:4f9:3051:429f::2/64

auto vmbr1
iface vmbr1 inet static

        address 10.20.0.1/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0
        post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up   iptables -t nat -A POSTROUTING -s '10.20.0.0/24' -o vmbr0 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '10.20.0.0/24' -o vmbr0 -j MASQUERADE

source /etc/network/interfaces.d/*

Not all VM's are connected to the Private lan (10.20.*.*).
Now one of the VMs (Ubuntu) has this netplan config:

network:
  version: 2
  ethernets:
    ens18:
      dhcp4: no
      addresses: [95.217.69.125/32] #change this ip
      routes:
      - to: 0.0.0.0/0
        via: 65.109.88.92
        on-link: true
      nameservers:
        addresses: [1.1.1.1, 8.8.8.8]

 

[frankhommers]

Further investigation shows that the docker containers have internet access, but are unable to resolve DNS... Weird!

 

[frankhommers]

It's driving me nuts. If I force the DNS to be TCP it works. So there is something missing with UDP....

 

[frankhommers]

It was the firewall blocking the returning UDP DNS messages. Not sure why only the containers were affected.