Masquerading (NAT) with iptables partially working

parazitenew

New Member
Dec 27, 2023
16
2
3
Hello, I'm new to the community, I'm an enthusiastic about virtualization so I bought a mini PC "hp elitedesk 800 G3" and turned it as proxmox server. My goal is to learn and be able to create a virtualization environment on a dedicate server with a public IP, and VMs with private IPs.

Before explaining my problem, I have to say that I have some knowledge on networking and routing (CCNA 1 completed) and Linux administration (LPI Essentials).

So to simulate this scenario, I pluged the server to my home LAN 192.168.1.0/24. By default proxmox create a bridge vmbr0, but since I want a private network inside proxmox, I followed the "3.4.6. Masquerading (NAT) with iptables" section in the documentation.

Please, see attached image to see my topology.

2023-12-27 00_49_18-Cisco Packet Tracer.png

As you can see, I have a wireless/wired router eero 6 that is directly connected to the modem, so one interface has a public IP address (38.xx.xx.xx), and an internal interface that creates the local private network 192.168.1.0/24. The router has 192.168.1.1 IP, my workstation 192.168.1.110, proxmox server 192.168.1.254.

Here is the network configuration of proxmox.

2023-12-27 00_31_13-192.168.1.254.png
Here is the network configuration of my debian VM.

2023-12-27 00_30_40-192.168.1.254.png

So, what is the problem? Everything seems good.
The problem is that : from the VM I can ping all devices in the 192.168.1.0/24 network, but, the VM is unreachable from other devices. When I tried the tracert command from my Windows workstation, it stops at the first hop, the gateway 192.168.1.1 , I guess that the eero 6 router doesn't know how to route to the 172.16.0.0/24 network, and what it confuses me is that how the vmbr0 knows how to route to the 192.168.1.0/24 and most of all, how the answer for the ping can find its way back to the VM ???

The eero 6 does not have static routing feature, so I'm stuck. But, I still don't understand the ping story, if the router does not know how to reach the VM network, the ping should not work from VM to other devices.

Any idea ? Any hope ?
 
Last edited:

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!