Masquerading (NAT) with iptables, routing not working well

[parazitenew]

Hello, I'm new to the community, I'm an enthusiastic about virtualization so I bought a mini PC "hp elitedesk 800 G3" and turned it as proxmox server. My goal is to learn and be able to create a virtualization environment on a dedicate server with a public IP, and VMs with private IPs.

Before explaining my problem, I have to say that I have some knowledge on networking et routing (CCNA 1 completed) and Linux administration (LPI Essentials).

So to simulate this scenario, I pluged the server to my home LAN 192.168.1.0/24. By default proxmox create a bridge vmbr0, but since I want a private network inside proxmox, I followed the "3.4.6. Masquerading (NAT) with iptables" section in the documentation.

Please, see attached image to see my topology.

View attachment 60380

As you can see, I have a wireless/wired router eero 6 that is directly connected to the modem, so one interface has a public IP address (38.xx.xx.xx), and an internal interface that creates the local private network 192.168.1.0/24. The router has 192.168.1.1 IP, my workstation 192.168.1.110, proxmox server 192.168.1.254.

Here is the network configuration of proxmox.

View attachment 60378
Here is the network configuration of my debian VM.

View attachment 60379

So, what is the problem? Everything seems good.
The problem is that : from the VM I can ping all devices in the 192.168.1.0/24 network, but, the VM is unreachable from other devices. When I tried the tracert command from my Windows workstation, it stops at the first hop, the gateway 192.168.1.1 , I guess that the eero 6 router doesn't know how to route to the 172.16.0.0/24 network, and what it confuses me is that how the vmbr0 knows how to route to the 192.168.1.0/24 and most of all, how the answer for the ping can find its way back to the VM ???

The eero 6 does not have static routing feature, so I'm stuck. But, I still don't understand the ping story, if the router does not know how to reach the VM network, the ping should not work from VM to other devices.

Any idea ? Any hope ?

 

[spirit]

Well, you are doing s-nat, so it's only working 1 way.

If you want to ping 172.16.0.0/24 from 192.168.1.0, don't do nat. Use simple routing.

on your machines in 192.168.1.X network, add a route like "172.16.0.0/24 gw 192.168.1.254"

remove the nat rules but keep the forward rule. (BTW, you can also use "ip-forward on" instead the post-up rule)

 

[parazitenew]

Well, you are doing s-nat, so it's only working 1 way.

If you want to ping 172.16.0.0/24 from 192.168.1.0, don't do nat. Use simple routing.

on your machines in 192.168.1.X network, add a route like "172.16.0.0/24 gw 192.168.1.254"

remove the nat rules but keep the forward rule. (BTW, you can also use "ip-forward on" instead the post-up rule)

Thanks for your reply.
Actually I found out that the problem is in fact that the eero 6 router can't route to 172.16.0.0.
Adding the routing on the machines is not a good solution for me.
So there are 2 ways
1 - port forwarding : but it prevents me to have 2 or more VMs having the same role, for example 2 web servers, cause the port forwarding route to only one VM
2 - Routed configuration : this is in case we have a block of public ip adresses to assign to VMs, and i'm not in this scenario.

So I think here are the possibilities.