Hetzner vswitch & "local" internet access

[mvrhov]

I'm trying to build a network between different machines connected to Hetzner vswitch but I'd like to have two things. I know how to do this with two network interfaces inside a LXC, but I'd really like to only have one.

* network traffic of all LXCs on server X must be NATted out via the external IP of that server
* all LXCs are part of the same network
* (if I'll add 2nd vswitch, I'd prefer to add another vmbr and "route somewhat between them if possible")
This is the config I currently have
* 192.168.0.0/24 network with internet access NATed over local external IP
* 172.17.0.0/24 vswitch network

server 1

auto lo
iface lo inet loopback

iface enp2s0 inet manual

iface enp2s0.4000 inet manual

auto vmbr0
iface vmbr0 inet static
        address  x.x.x.x
        netmask  255.255.255.192
        gateway  y.y.y.y
        bridge-ports enp2s0
        bridge-stp off
        bridge-fd 0

iface vmbr0 inet6 static
        address  x:x:x:x::2
        netmask  128
        gateway  fe80::1

auto vmbr1
iface vmbr1 inet static
        address  192.168.0.1
        netmask  255.255.255.0
        bridge-ports none
        bridge-stp off
        bridge-fd 0
        post-up /bin/echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up /sbin/iptables -t nat -A POSTROUTING -s '192.168.0.0/24' -o vmbr0 -j MASQUERADE
        pre-down /sbin/iptables -t nat -D POSTROUTING -s '192.168.0.0/24' -o vmbr0 -j MASQUERADE
# this doesn't seem to work
#       up route add -net 172.17.0.0/24 netmask 255.255.255.0 gw 172.17.0.1 dev vmbr2
#internet access

auto vmbr2
iface vmbr2 inet static
        address  172.17.0.1
        netmask  255.255.255.0
        bridge-ports enp2s0.4000
        bridge-stp off
        bridge-fd 0
        mtu 1400
#vlan

server 2

auto lo
iface lo inet loopback

iface enp2s0 inet manual

iface enp2s0.4000 inet manual

auto vmbr0
iface vmbr0 inet static
        address  x.x.x.x
        netmask  255.255.255.192
        gateway  y.y.y.y
        bridge-ports enp2s0
        bridge-stp off
        bridge-fd 0

iface vmbr0 inet6 static
        address  x:x:x:x::2
        netmask  128
        gateway  fe80::1

auto vmbr1
iface vmbr1 inet static
        address  192.168.0.1
        netmask  255.255.255.0
        bridge-ports none
        bridge-stp off
        bridge-fd 0
        post-up /bin/echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up /sbin/iptables -t nat -A POSTROUTING -s '192.168.0.0/24' -o vmbr0 -j MASQUERADE
        pre-down /sbin/iptables -t nat -D POSTROUTING -s '192.168.0.0/24' -o vmbr0 -j MASQUERADE
# this doesn't seem to work
#       up route add -net 172.17.0.0/24 netmask 255.255.255.0 gw 172.17.0.2 dev vmbr2
#internet access

auto vmbr2
iface vmbr2 inet static
        address  172.17.0.2
        netmask  255.255.255.0
        bridge-ports enp2s0.4000
        bridge-stp off
        bridge-fd 0
        mtu 1400
#vlan