Masquerading (NAT) with iptables partially working

parazitenew

New Member
Dec 27, 2023
16
2
3
Hello, I'm new to the community, I'm an enthusiastic about virtualization so I bought a mini PC "hp elitedesk 800 G3" and turned it as proxmox server. My goal is to learn and be able to create a virtualization environment on a dedicate server with a public IP, and VMs with private IPs.

Before explaining my problem, I have to say that I have some knowledge on networking and routing (CCNA 1 completed) and Linux administration (LPI Essentials).

So to simulate this scenario, I pluged the server to my home LAN 192.168.1.0/24. By default proxmox create a bridge vmbr0, but since I want a private network inside proxmox, I followed the "3.4.6. Masquerading (NAT) with iptables" section in the documentation.

Please, see attached image to see my topology.

2023-12-27 00_49_18-Cisco Packet Tracer.png

As you can see, I have a wireless/wired router eero 6 that is directly connected to the modem, so one interface has a public IP address (38.xx.xx.xx), and an internal interface that creates the local private network 192.168.1.0/24. The router has 192.168.1.1 IP, my workstation 192.168.1.110, proxmox server 192.168.1.254.

Here is the network configuration of proxmox.

2023-12-27 00_31_13-192.168.1.254.png
Here is the network configuration of my debian VM.

2023-12-27 00_30_40-192.168.1.254.png

So, what is the problem? Everything seems good.
The problem is that : from the VM I can ping all devices in the 192.168.1.0/24 network, but, the VM is unreachable from other devices. When I tried the tracert command from my Windows workstation, it stops at the first hop, the gateway 192.168.1.1 , I guess that the eero 6 router doesn't know how to route to the 172.16.0.0/24 network, and what it confuses me is that how the vmbr0 knows how to route to the 192.168.1.0/24 and most of all, how the answer for the ping can find its way back to the VM ???

The eero 6 does not have static routing feature, so I'm stuck. But, I still don't understand the ping story, if the router does not know how to reach the VM network, the ping should not work from VM to other devices.

Any idea ? Any hope ?
 
Last edited: