MAC filtering causing issues inside virtual machines (nesting)

[harmonyp]

I have installed Proxmox inside of a virtual machine with a provider and want to create multiple small virtual machines out of it (nesting).

I have come across issues trying to get the network working inside of these virtual machines. This is due to the provider using "MAC filtering"

auto lo
iface lo inet loopback


iface ens3 inet manual


auto vmbr0
iface vmbr0 inet static
        address 107.189.30.xxx/24
        gateway 107.189.30.1
        bridge_ports ens3
        bridge_stp off
        bridge_fd 0
    up ip route add 104.244.74.xxx/32 dev vmbr0 #additional IP 1
    post-up echo 1 > /proc/sys/net/ipv4/ip_forward
    post-up echo 1 > /proc/sys/net/ipv4/conf/ens3/proxy_arp

107.189.30.xxx/24 is the main VPS IP and I am trying to get 104.244.74.xxx/32 working inside of that. 104.244.74.xxx/32 would need to use 104.244.74.1 normally as the gateway.

I have read I can "MAC address NAT" but not too sure how to do that.

 

[ph0x]

NAT automatically does MAC translation, how else should that work?
You probably have to spoof vmbr0's MAC address for the one that's registered with your provider.

 

[harmonyp]

NAT automatically does MAC translation, how else should that work?
You probably have to spoof vmbr0's MAC address for the one that's registered with your provider.

How would I do that?

I have read vmbr0 has the same MAC as the main interface but I also tried adding "hwaddress ether xx:xx:xx:xx:xx" inside /etc/network/interfaces for vmbr0 with no luck.

 

[ph0x]

Since you virtualized Proxmox you probably also have to set the MAC address in the hypervisor.

 

[blueguy31]

I had the same problem trying to use Proxmox nested on Hyper-V (on Windows 11).
MAC address spoofing is the answer.

In order for network packets to be routed through two virtual switches, MAC address spoofing must be enabled on the first (L1) level of virtual switch

The second option could relies on network address translation (NAT).
This approach is best suited for cases where MAC address spoofing isn't possible, like in a public cloud environment.

Source : https://learn.microsoft.com/en-us/v...ndows/user-guide/enable-nested-virtualization