[SOLVED] Linux Bridge on a public address

MarOwN said:
Now another question, how can I make sure that some ports are listened to by a VM, another port on another VM, etc...
Click to expand...

The setup we did was to make POSTROUTING NAT, for PREROUTING NAT, just add the necessary rules below the POSTROUTING sector that you already have on your network setup.. probably you will need to prerouting to the correct inbound guest tap interface, each guest has a specific TAP interface inside the proxmox node for networking bridge... as this is a more complicated setup that I never used before, maybe you need to test it a little bit deeper!

my advice is to use an external FIREWALL to control this kind of NAT rules... but it is up to you!!!
 
Last edited:
Did I make a mistake? The VM does not have access to the Internet https://prnt.sc/pza4dm .... And do you have a doc on PREROUTING ?
I have find this for PREROUTING :

Change the destination address of web traffic to 5.6.7.8 :
Code: 
iptables -t nat -A PREROUTING -p tcp --dport 80 -i eth0 \
        -j DNAT --to 5.6.7.8:80
 
Last edited:
Code: 
iptables -t nat -nL -v

Code: 
Chain PREROUTING (policy ACCEPT 157M packets, 210G bytes)
pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 17888 packets, 1174K bytes)
pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 630 packets, 42748 bytes)
pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 630 packets, 42748 bytes)
pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  all  --  *      vmbr0   10.0.0.0/24          0.0.0.0/0
 
Last edited:
MarOwN said:
pkts bytes target prot opt in out source destination 0 0 MASQUERADE all -- * vmbr0 10.0.0.0/24 0.0.0.0/0
Click to expand...

My understanding is that this line should do the JOB regarding the INTERNET access from guests...

maybe the proxmox node is not allowing forwarding traffic or the routing is not enabled on sysctl.conf

try this:

on /etc/network/interfaces, add these lines below the other POSTROUTING rules..

post-up iptables -A FORWARD -s 10.0.0.0/24 -j ACCEPT
post-down iptables -D FORWARD -s 10.0.0.0/24 -j ACCEPT

also check if the routing is enabled on proxmox node:

cat /proc/sys/net/ipv4/ip_forward

if this files shows '0' the routing is not enabled.. soh make it turn '1'..

echo 1 > /proc/sys/net/ipv4/ip_forward
 
Last edited:
  • Like
Reactions: MarOwN
Indeed the file /proc/sys/net/ipv4/ip_forward was at 0... I added the two additional lines to the /etc/network/interfaces file. I also restarted the server to correctly apply all of them. Unfortunately I can't test right away, I'll be back to you in an hour :)
 
On however I just noticed that /proc/sys/net/ipv4/ip_forward has gone back to 0 after the reboot....
After changing the value to 1 I can ping 8.8.8.8.8.8
 
MarOwN said:
On however I just noticed that /proc/sys/net/ipv4/ip_forward has gone back to 0 after the reboot
Click to expand...

yes, it will always happen!! you have to fix it on /etc/sysctl.conf

the file /etc/sysctl.conf on proxmox already have a sector explaining this:

# Uncomment the next line to enable packet forwarding for IPv4
#net.ipv4.ip_forward=1
 
  • Like
Reactions: MarOwN
Ok! for the file /etc/sysctl.conf it's done! Now I have access to the internet on my VMs thanks to you! ;) Thank you!!!

Now if you don't mind, do you want to spend a few minutes on port forwarding for incoming connections on VMs?
I found something on post #22 but maybe you have a cleaner and more permanent solution in the /etc/network/interfaces file to offer me? ;)
 
MarOwN said:
maybe you have a cleaner and more permanent solution in the /etc/network/interfaces file to offer me?
Click to expand...

Just spend some time to understand how iptables works inside a linux box!!! You will need also some networking knowledge!!

As an example, try this:

iptables -t nat -A PREROUTING -p tcp --dport 80 -i vmbr0 -d 185.246.87.214 -j DNAT --to 10.0.0.15:80
iptables -A FORWARD -p tcp --dport 80 -i vmbr0 -d 10.0.0.15 -j ACCEPT

insert this command directly on proxmox shell/ssh and test the connection from outside... if it works, put the lines inside the /etc/network/interfaces to load at boot.
 
  • Like
Reactions: MarOwN
I tried to test with Windows remote desktop control ports and everything works! ;)

Thank you for your precious help Danilo Montagna ! I think this subject is closed ;)
 
Last edited:
  • Like
Reactions: DANILO MONTAGNA
For your information, here is my final configuration with an example of port forwarding to one of my VMs. I hope everything will be fine. Thank you again for your help

Code: 
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet manual

# interface iface - public address interfae bridge
auto vmbr0
iface vmbr0 inet static
address 185.246.xx.xxx
netmask 255.255.255.0
gateway 185.246.xx.x
broadcast 185.246.xx.xxx
network 185.246.xx.x
bridge_ports eth0
bridge_stp off
bridge_fd 0

# internal iface - used to bridge VMs with invalid address with NAT
auto vmbr2
iface vmbr2 inet static
address 10.0.0.1
netmask 255.255.255.0
bridge_ports none
bridge_stp off
bridge_fd 0
post-up iptables -A POSTROUTING -t nat -s '10.0.0.0/24' -o vmbr0 -j MASQUERADE
post-up iptables -A POSTROUTING -t mangle -p udp --dport bootpc -j CHECKSUM --checksum-fill
post-up iptables -A FORWARD -s 10.0.0.0/24 -j ACCEPT
post-up iptables -t nat -A PREROUTING -p tcp --dport 23 -i vmbr0 -d 185.246.xx.xxx -j DNAT --to 10.0.0.11:22
post-up iptables -A FORWARD -p tcp --dport 23 -i vmbr0 -d 10.0.0.11 -j ACCEPT
post-down iptables -t filter -F
post-down iptables -t nat -F
post-down iptables -t mangle -F
 
You must log in or register to reply here.

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Quick Navigation

Home Get Subscription Wiki Downloads Proxmox Customer Portal About

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!
Community platform by XenForo® © 2010-2024 XenForo Ltd.
Top Bottom