Default Bridge and Masq (NAT) with iptables tables

[pablo808]

Is it possible to have both the Default Configuration using a Bridge and Masquerading (NAT) with iptables with one physical interface?

I currently have Masquerading (NAT) with iptables setup and it's a pain adding NAT rules to /etc/network/interfaces for each service I want to open up to the rest of the network.

auto lo
iface lo inet loopback

auto eno1
# real ip
iface eno1 inet static
    address 192.168.4.2/24
    gateway 192.168.4.1

auto vmbr0
# vm network
iface vmbr0 inet static
    address 192.168.5.1/24
    bridge-ports none
    bridge-stp off
    bridge-fd 0

        post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up   iptables -t nat -A POSTROUTING -s '192.168.5.0/24' -o eno1 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '192.168.5.0/24' -o eno1 -j MASQUERADE
        post-up   iptables -t nat -A PREROUTING -p tcp -i eno1 --dport 2222 -j DNAT --to-destination 192.168.5.3:22
        post-down iptables -t nat -D PREROUTING -p tcp -i eno1 --dport 2222 -j DNAT --to-destination 192.168.5.3:22
#work

iface wlp1s0 inet manual

source /etc/network/interfaces.d/*

 

[Guillaume Delanoy]

Hello,
Instead of calling each iptables rule in /etc/network/interfaces, just call a whole script.
In /etc/network/interfaces:

...
    pre-up /root/scripts/my_nice_iptables_script.sh

And then, in "my_nice_iptables_script.sh" :

#!/bin/bash
 echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s '192.168.5.0/24' -o eno1 -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp -i eno1 --dport 2222 -j DNAT --to-destination 192.168.5.3:22
...

And yes btw, using DNAT --to-destination I'm afraid you'll have to specify each port you want to masquerade to your vms. But doing this in a script will de-clutter your /etc/network/interfaces file and allow you to have a single file for your whole configuration once and for all.

Kind regards,

GD

 

[pablo808]

Thank you for the suggestion in regards to setting up a script to masquerade the ports to the VM's. I might give that a try.

Whenever I add new NAT rules, and restart the network they dont seem to apply. I've also tried the command ifupdown2 so didnt seem to work. I had to reboot the pve box instead.

What is the correct way to apply the new pve network config after updating /etc/network/interfaces without a reboot?

 

[Guillaume Delanoy]

There's no need to restart the network to see IPtables rules applied. They apply right at the moment you command them.
See them with:

# iptables -L -t nat

This means you can call your script without reloading /etc/network/interfaces .
Should you still need to, reloading the network without rebooting goes with:

# ifreload -a

It is highly recommended to flush iptables rules each time you modify them, so that the config doesn't stack up with former rules. Do it with :

# iptables -F
# iptables -X

It could even be a good idea to set those two lines at the very beginning of your script, to avoid any mismatch between "old" and "new" rules while you write your config.

Kind regards,

GD

 

[pablo808]

Thank you. That is very good information. Really appreciate the response.