Forward port 5000/5001, Proxmox on VPS

[redfury]

Hi guys, I have a small problem, I can not find a way (and I tried so many) to properly forward 2 ports (5000/5001) from a Synology machine installed as VM on Proxmox. Proxmox is installed on a VPS at Contabo (maybe it matter).
I have a public IP assigned to my VPS (Debian 12 based), on top of Debian I have installed Proxmox latest and configured a simple SDN for a VM where I have installed DSM 7.2 from Synology. I just need to expose to internet ports 5000/5001 to be able to continue installation and configuration of Synology machine but from the moment I activate the firewall from GUI, at the level of datacenter I lost connection with Proxmox machine from internet and everything is lost.
Can I use ebtables or other method to forward those 2 ports to internet? From GUI will be even better. The IP of Synology machine is 10.0.0.51
Thanks for understanding, my knowledge in networking are not so high to deal with cli, iptables and more...

LEdit Why is so important to expose those ports? Becase installation and configuring is done by web interface.

LLEdit
This is how it looks my interfaces settings, including some tested method.

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
address xx.xx.xx.xx/23
gateway xx.xx.x.x
# dns-search invalid
# dns-nameservers 195.179.224.52 195.179.224.51
# up ip route replace xx.xx.xx.xx/23 via xx.xx.xx.xx dev eth0

# post-up echo 1 > /proc/sys/net/ipv4/ip_forward
# post-up iptables -t nat -A POSTROUTING -s '10.0.0.0/24' -o eth0 -j MASQUERADE
# post-down iptables -t nat -D POSTROUTING -s '10.0.0.0/24' -o eth0 -j MASQUERADE
# post-up iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
# post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1
# VM-Syno machine 5000:10.0.0.51:5000
# post-up iptables -t nat -A PREROUTING -i vnet0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000
# post-down iptables -t nat -D PREROUTING -i vnet0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000

source /etc/network/interfaces.d/*

 

[shanreich]

# post-up iptables -t nat -A PREROUTING -i vnet0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000
# post-down iptables -t nat -D PREROUTING -i vnet0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000

This looks like the proper command, but the interface name looks wrong - have you tried eth0 over vnet0?

 

[redfury]

Somehow I managed to forward those ports, I can access the Synology VM but I tried to do the same with SSH to forward to a different port (922) but this doesn`t seems to work, so I ssh 1st to Proxmox.

this is how look like the interfaces config:

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
address public IP/23
gateway GW
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '10.0.0.0/24' -o eth0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '10.0.0.0/24' -o eth0 -j MASQUERADE
post-up iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000
post-down iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000
post-up iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 5001 -j DNAT --to 10.0.0.51:5001
post-down iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 5001 -j DNAT --to 10.0.0.51:5001
post-up iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 922 -j DNAT --to 10.0.0.51:922
post-down iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 922 -j DNAT --to 10.0.0.51:922
post-up iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7681 -j DNAT --to 10.0.0.51:7681
post-down iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 7681 -j DNAT --to 10.0.0.51:7681
# post-up iptables -t nat -A PREROUTING -i vnet0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000
# post-down iptables -t nat -D PREROUTING -i vnet0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000
# post-up iptables -t nat -A PREROUTING -i vnet0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000
# post-down iptables -t nat -D PREROUTING -i vnet0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000
# post-up iptables -t nat -A PREROUTING -i vnet0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000
# post-down iptables -t nat -D PREROUTING -i vnet0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000
# post-up iptables -t nat -A PREROUTING -i vnet0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000
# post-down iptables -t nat -D PREROUTING -i vnet0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000
# post-up iptables -t nat -A PREROUTING -i vnet0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000
# post-down iptables -t nat -D PREROUTING -i vnet0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000
# post-up iptables -t nat -A PREROUTING -i vnet0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000
# post-down iptables -t nat -D PREROUTING -i vnet0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000

source /etc/network/interfaces.d/*


and this look like the sdn config.

auto vnet0
iface vnet0
address 10.0.0.1/24
post-up iptables -t nat -A POSTROUTING -s '10.0.0.0/24' -o eth0 -j SNAT --to-source PUBLIC IP
post-down iptables -t nat -D POSTROUTING -s '10.0.0.0/24' -o eth0 -j SNAT --to-source PUBLIC IP
. post-up iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000
post-down iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 5000 -j DNAT --to 10.0.0.51:5000
post-up iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1
bridge_ports none
bridge_stp off
bridge_fd 0
ip-forward on

My best guess is that the forward port line deos not have any effect becuase I set up Synology to be accesible on 5001 https.