Create additional Masquerading (NAT) bridge

[alex1452]

Dear all,

I have a PC with 4 physical ethernet ports behind a router that I connected with a bridge, so that I can connect additional ethernet equipment. For proxmox, I would like to create an additional "internal" brigde for my VMs (KVM and LXC) with private networking that are then routed. I do not want to router to see these additional virtual machines. According to the manual I have tried the following:

auto lo
iface lo inet loopback
iface enp1s0 inet manual
iface enp2s0 inet manual
iface enp3s0 inet manual
iface enp4s0 inet manual

auto br0
iface br0 inet static
    address 192.168.178.71/24
    gateway 192.168.178.1
    bridge-ports enp1s0 enp2s0 enp3s0 enp4s0
    bridge-stp off
    bridge-fd 0

iface br0 inet6 auto
    accept_ra 2

auto vmbr0
#private sub network
iface vmbr0 inet static
        address  10.10.10.1/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0

        post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up   iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o br0 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o br0 -j MASQUERADE

source /etc/network/interfaces.d/*

Unfortunately this does not work! When I connect LXC-containers to br0, I have internet access. However, when I try to connect them to vmbr0 (using dhcp or static) I have no internet access. What am I doing wrong?

• What is the correct setup for the additional bridge?
• What do I need to do to have DHCP on this bridge?

Any pointers on how I can debug this? Ideally my VMs would get an IP via DHCP like 10.10.10.100 and the traffic gets routed to my dsl router at 192.168.178.1. Can I provide additional information to help debugging?